glupteba | fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

Target

Setup.exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

glupteba metasploit raccoon redline vidar 1 backdoor discovery dropper evasion infostealer loader persistence spyware stealer themida trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

37.0.8.88:44263

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 1 IoCs

Processes:

resource	yara_rule
behavioral5/memory/1116-217-0x0000000004750000-0x0000000005076000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerUNdlL32.eXerundll32.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6036	4768	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6884	4768	rUNdlL32.eXe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	4768	rundll32.exe

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 12 IoCs

Processes:

resource	yara_rule
behavioral5/memory/1788-339-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/1788-340-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral5/memory/2880-382-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/2604-391-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/476-414-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/1012-475-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/1872-462-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/5364-511-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/5584-524-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/5784-543-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/6072-574-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/5396-594-0x0000000000000000-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 41 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exewEzNj4RHYjtVPR9oDYR5v_c2.exerundll32.exeWerFault.exeWerFault.exewEzNj4RHYjtVPR9oDYR5v_c2.exeh5jxHhKitFgx81LrvzPzZ_mi.exeWerFault.exeWerFault.exeWerFault.exeschtasks.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeidentity_helper.exeWerFault.exeh5jxHhKitFgx81LrvzPzZ_mi.exeWerFault.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeWerFault.exeWerFault.exeWerFault.exewEzNj4RHYjtVPR9oDYR5v_c2.exeWerFault.exewEzNj4RHYjtVPR9oDYR5v_c2.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeWerFault.exewEzNj4RHYjtVPR9oDYR5v_c2.exewEzNj4RHYjtVPR9oDYR5v_c2.exe

description	pid	process	target process
PID 2164 created 2984	2164	WerFault.exe	Cp2xJsrZET8GjWBoFEOl7RV4.exe
PID 1880 created 1116	1880	WerFault.exe	Q72q8lQfHW00w2ocsoclB9A6.exe
PID 1924 created 1500	1924	WerFault.exe	ylFuuRO65UDYhYtJH1iLXAW3.exe
PID 1992 created 1112	1992	WerFault.exe	vfo107HGtIGH8IkSOABOKAu1.exe
PID 1864 created 2896	1864	WerFault.exe	1dPrWtvS4zjaHeqViKgI927X.exe
PID 4468 created 1676	4468	WerFault.exe	di1B62jRZ3lJK4FH_65vYtnD.exe
PID 5036 created 2488	5036	WerFault.exe	UWFJm6dTX_pyGjfLcn9Gmq_u.exe
PID 3300 created 4932	3300	WerFault.exe	N_QOenS05Z6BgOENGg7vcXbi.exe
PID 5448 created 2824	5448	WerFault.exe	Tt_u_78vuUdZLT4jSPRlPQxU.exe
PID 5196 created 6092	5196	WerFault.exe	rundll32.exe
PID 2248 created 1472	2248	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 6524 created 4196	6524	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 6952 created 5012	6952	rundll32.exe	3389790.exe
PID 6572 created 660	6572	WerFault.exe	2107243.exe
PID 7648 created 6952	7648	WerFault.exe	rundll32.exe
PID 7760 created 4364	7760	wEzNj4RHYjtVPR9oDYR5v_c2.exe	4341200.exe
PID 8008 created 1808	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	1636954.exe
PID 8156 created 5924	8156	WerFault.exe	4674657.exe
PID 6580 created 5576	6580	WerFault.exe	EQPEoKSbKO4mFR7N8AyETlg3.exe
PID 4292 created 6336	4292	WerFault.exe	yDqbjYK1tt8I4_Uhml83830v.exe
PID 8500 created 6904	8500	schtasks.exe	BJxk5qWmEc2m0zfM8HQfvLM_.exe
PID 8368 created 8096	8368	WerFault.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 8688 created 7444	8688	WerFault.exe	ZaXHv2MKQpnlfc21MuAHJLEz.exe
PID 8612 created 5388	8612	WerFault.exe	3375273.exe
PID 8772 created 7264	8772	WerFault.exe	vnIUnTjsoEJYdB3Lpgi8fOez.exe
PID 3996 created 7296	3996	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	dwriaMruyrmhciUhHSVq1bk8.exe
PID 6684 created 7636	6684	identity_helper.exe	kgNu7CKDx9vefqZ0_gkLF90K.exe
PID 1624 created 5660	1624	WerFault.exe	Vo0VFH1IM4VTt5tS2W9SE0oj.exe
PID 680 created 7776	680	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 5092 created 6780	5092	WerFault.exe	4379956.exe
PID 4376 created 5848	4376	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	rundll32.exe
PID 8624 created 6164	8624	WerFault.exe	5594086.exe
PID 8112 created 6664	8112	WerFault.exe	5396538.exe
PID 5820 created 5032	5820	WerFault.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 8100 created 7784	8100	wEzNj4RHYjtVPR9oDYR5v_c2.exe	3853591.exe
PID 7600 created 8248	7600	WerFault.exe	3766018.exe
PID 8408 created 3424	8408	wEzNj4RHYjtVPR9oDYR5v_c2.exe	Bf4YOJOO.exe
PID 2032 created 7184	2032	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	Bf4YOJOO.exe
PID 2608 created 6604	2608	WerFault.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 7092 created 9200	7092	wEzNj4RHYjtVPR9oDYR5v_c2.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 4552 created 5384	4552	wEzNj4RHYjtVPR9oDYR5v_c2.exe	TRY4LfvW.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral5/memory/4932-255-0x0000000002DD0000-0x0000000002EA3000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

Processes:

HcbPd3mmnHLsHqf8rJNVbbu2.exevfo107HGtIGH8IkSOABOKAu1.exeUWFJm6dTX_pyGjfLcn9Gmq_u.exedi1B62jRZ3lJK4FH_65vYtnD.exewEzNj4RHYjtVPR9oDYR5v_c2.exeKcUYEO15ww0qhkEHNMkS2Ybg.exeN_QOenS05Z6BgOENGg7vcXbi.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exe8WuE_E2Anuiz3jSakPPUgElY.exefjo4nAaO2gvIKhsvTgHC1mEr.exeaRm5KdqY7g33grRYOKMWqjfu.exelnQ5wXdnTzqWKrLrsoNktHaP.exe83YXMwskFHfOxbgzO8AZO8lD.exeCp2xJsrZET8GjWBoFEOl7RV4.exeavXopjlJVCYV9hnF1T5d1Zlk.exeEBzlFzw9fcVu3UrUqqxzRRn2.exe1dPrWtvS4zjaHeqViKgI927X.exeylFuuRO65UDYhYtJH1iLXAW3.exeQ72q8lQfHW00w2ocsoclB9A6.exebgyCNXIhUpksgKctPnpQB2rY.exeBVoMx_fHQOJwEng3aOU2dT3Y.exeinst001.exeBVoMx_fHQOJwEng3aOU2dT3Y.tmpavXopjlJVCYV9hnF1T5d1Zlk.executm3.exeBf4YOJOO.exemd8_8eus.exeJ77cmUgJX0OQi4nZtiqUPG2L.exe2107243.exe3389790.exeDllHost.exe2500164.exe4951894.exe4201421.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exewEzNj4RHYjtVPR9oDYR5v_c2.exe4341200.exe1636954.exeKRkNvH~YgUUt9O.exEwEzNj4RHYjtVPR9oDYR5v_c2.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeYQKNIE81rcPOrZcq8om0_rMo.exeTt_u_78vuUdZLT4jSPRlPQxU.exewEzNj4RHYjtVPR9oDYR5v_c2.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exewEzNj4RHYjtVPR9oDYR5v_c2.exeSetup.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exewEzNj4RHYjtVPR9oDYR5v_c2.exeWinHoster.exe4674657.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exe5852793.exe8670401.exewEzNj4RHYjtVPR9oDYR5v_c2.exe3375273.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exewEzNj4RHYjtVPR9oDYR5v_c2.exe9840432e051a6fa1192594db02b80a4c1fd73456.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeWerFault.exelg.exeLivelyScreenRecS3.0.exenote866.exe

pid	process
1184	HcbPd3mmnHLsHqf8rJNVbbu2.exe
1112	vfo107HGtIGH8IkSOABOKAu1.exe
2488	UWFJm6dTX_pyGjfLcn9Gmq_u.exe
1676	di1B62jRZ3lJK4FH_65vYtnD.exe
3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe
5032	KcUYEO15ww0qhkEHNMkS2Ybg.exe
4932	N_QOenS05Z6BgOENGg7vcXbi.exe
4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
4544	8WuE_E2Anuiz3jSakPPUgElY.exe
5044	fjo4nAaO2gvIKhsvTgHC1mEr.exe
4528	aRm5KdqY7g33grRYOKMWqjfu.exe
4536	lnQ5wXdnTzqWKrLrsoNktHaP.exe
3544	83YXMwskFHfOxbgzO8AZO8lD.exe
2984	Cp2xJsrZET8GjWBoFEOl7RV4.exe
3888	avXopjlJVCYV9hnF1T5d1Zlk.exe
4808	EBzlFzw9fcVu3UrUqqxzRRn2.exe
2896	1dPrWtvS4zjaHeqViKgI927X.exe
1500	ylFuuRO65UDYhYtJH1iLXAW3.exe
1116	Q72q8lQfHW00w2ocsoclB9A6.exe
3704	bgyCNXIhUpksgKctPnpQB2rY.exe
3096	BVoMx_fHQOJwEng3aOU2dT3Y.exe
2624	inst001.exe
2568	BVoMx_fHQOJwEng3aOU2dT3Y.tmp
3120	avXopjlJVCYV9hnF1T5d1Zlk.exe
4488	cutm3.exe
3424	Bf4YOJOO.exe
4120	md8_8eus.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
660	2107243.exe
5012	3389790.exe
3180	DllHost.exe
4004	2500164.exe
1172	4951894.exe
4188	4201421.exe
1788	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
4216	wEzNj4RHYjtVPR9oDYR5v_c2.exe
4364	4341200.exe
1808	1636954.exe
2472	KRkNvH~YgUUt9O.exE
2880	wEzNj4RHYjtVPR9oDYR5v_c2.exe
2604	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
2508	YQKNIE81rcPOrZcq8om0_rMo.exe
2824	Tt_u_78vuUdZLT4jSPRlPQxU.exe
476	wEzNj4RHYjtVPR9oDYR5v_c2.exe
1872	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
1012	wEzNj4RHYjtVPR9oDYR5v_c2.exe
5340	Setup.exe
5276	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
5364	wEzNj4RHYjtVPR9oDYR5v_c2.exe
5724	WinHoster.exe
5924	4674657.exe
5584	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
6012	5852793.exe
1500	8670401.exe
5784	wEzNj4RHYjtVPR9oDYR5v_c2.exe
5388	3375273.exe
6072	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
5396	wEzNj4RHYjtVPR9oDYR5v_c2.exe
5176	9840432e051a6fa1192594db02b80a4c1fd73456.exe
1472	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
4292	WerFault.exe
1216	lg.exe
3888	LivelyScreenRecS3.0.exe
5920	note866.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dfadhTgeRQ2YNqA6LN7VKaND.exeaRm5KdqY7g33grRYOKMWqjfu.exeKcUYEO15ww0qhkEHNMkS2Ybg.exeV3kWg5hAnbI6Io6P0iviypK3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dfadhTgeRQ2YNqA6LN7VKaND.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aRm5KdqY7g33grRYOKMWqjfu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aRm5KdqY7g33grRYOKMWqjfu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KcUYEO15ww0qhkEHNMkS2Ybg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KcUYEO15ww0qhkEHNMkS2Ybg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	V3kWg5hAnbI6Io6P0iviypK3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	V3kWg5hAnbI6Io6P0iviypK3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dfadhTgeRQ2YNqA6LN7VKaND.exe

Loads dropped DLL 12 IoCs

Processes:

BVoMx_fHQOJwEng3aOU2dT3Y.tmprundll32.exestats.tmp9840432e051a6fa1192594db02b80a4c1fd73456.exerundll32.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exetVZzfuDTPE9RzMTGT94DcAk7.tmprundll32.exe

pid	process
2568	BVoMx_fHQOJwEng3aOU2dT3Y.tmp
2568	BVoMx_fHQOJwEng3aOU2dT3Y.tmp
6092	rundll32.exe
4064	stats.tmp
4064	stats.tmp
5176	9840432e051a6fa1192594db02b80a4c1fd73456.exe
6952	rundll32.exe
5176	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
5176	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
9168	tVZzfuDTPE9RzMTGT94DcAk7.tmp
9168	tVZzfuDTPE9RzMTGT94DcAk7.tmp
5848	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\aRm5KdqY7g33grRYOKMWqjfu.exe	themida
C:\Users\Admin\Documents\KcUYEO15ww0qhkEHNMkS2Ybg.exe	themida
C:\Users\Admin\Documents\aRm5KdqY7g33grRYOKMWqjfu.exe	themida
C:\Users\Admin\Documents\KcUYEO15ww0qhkEHNMkS2Ybg.exe	themida
behavioral5/memory/4528-248-0x0000000000CA0000-0x0000000000CA1000-memory.dmp	themida
behavioral5/memory/5032-244-0x0000000000410000-0x0000000000411000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DllHost.exetmp6E1C_tmp.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	DllHost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmp6E1C_tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmp6E1C_tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5"	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

aRm5KdqY7g33grRYOKMWqjfu.exemd8_8eus.exedfadhTgeRQ2YNqA6LN7VKaND.exeV3kWg5hAnbI6Io6P0iviypK3.exenote866.exeKcUYEO15ww0qhkEHNMkS2Ybg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aRm5KdqY7g33grRYOKMWqjfu.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md8_8eus.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dfadhTgeRQ2YNqA6LN7VKaND.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	V3kWg5hAnbI6Io6P0iviypK3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	note866.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	KcUYEO15ww0qhkEHNMkS2Ybg.exe

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

8Jrxbt8BZTsIcHQ4WrXF_d4l.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exe

description ioc process

File opened (read-only) \??\Z: 8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
File opened (read-only) \??\Z: 8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

192 ipinfo.io
1 ip-api.com
22 ipinfo.io
78 ipinfo.io
94 ipinfo.io
150 ipinfo.io
323 ipinfo.io
1 ipinfo.io
3 ipinfo.io
97 ipinfo.io
292 ipinfo.io
293 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

aRm5KdqY7g33grRYOKMWqjfu.exeKcUYEO15ww0qhkEHNMkS2Ybg.exeV3kWg5hAnbI6Io6P0iviypK3.exedfadhTgeRQ2YNqA6LN7VKaND.exe

pid process

4528 aRm5KdqY7g33grRYOKMWqjfu.exe
5032 KcUYEO15ww0qhkEHNMkS2Ybg.exe
4904 V3kWg5hAnbI6Io6P0iviypK3.exe
572 dfadhTgeRQ2YNqA6LN7VKaND.exe

description	ioc	process
File opened (read-only)	\??\Z:	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
File opened (read-only)	\??\Z:	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe

flow	ioc
192	ipinfo.io
1	ip-api.com
22	ipinfo.io
78	ipinfo.io
94	ipinfo.io
150	ipinfo.io
323	ipinfo.io
1	ipinfo.io
3	ipinfo.io
97	ipinfo.io
292	ipinfo.io
293	ipinfo.io

pid	process
4528	aRm5KdqY7g33grRYOKMWqjfu.exe
5032	KcUYEO15ww0qhkEHNMkS2Ybg.exe
4904	V3kWg5hAnbI6Io6P0iviypK3.exe
572	dfadhTgeRQ2YNqA6LN7VKaND.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

8Jrxbt8BZTsIcHQ4WrXF_d4l.exewEzNj4RHYjtVPR9oDYR5v_c2.exeh5jxHhKitFgx81LrvzPzZ_mi.exe

description	pid	process	target process
PID 4540 set thread context of 1788	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 2880	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 2604	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 476	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 1872	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 1012	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 3904 set thread context of 5364	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 5584	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 5784	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 6072	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 5396	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 1472	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 4424	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 2252	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 2212	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 2248	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 4196	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 6240	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 6464	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 4540 set thread context of 6876	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 7104	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 3904 set thread context of 4608	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 7160	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 7996	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 7980	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 7532	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 4512	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 5812	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 3904 set thread context of 8096	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 8256	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 8336	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 8788	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 8872	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 3904 set thread context of 8680	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 8848	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 1636	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 3904 set thread context of 9188	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 8140	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 912	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 3904 set thread context of 228	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 4592	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 7776	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 4540 set thread context of 6456	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3904 set thread context of 7760	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 1780	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 3324	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 3904 set thread context of 6356	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 4540 set thread context of 8440	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 2964	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 3904 set thread context of 6640	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 4308	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 8084	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 8008 set thread context of 5604	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 3904 set thread context of 9040	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 8008 set thread context of 9212	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 3904 set thread context of 4328	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 9060	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 9096	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 3904 set thread context of 6960	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 3700	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 8228	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
PID 3904 set thread context of 8960	3904	wEzNj4RHYjtVPR9oDYR5v_c2.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 4540 set thread context of 1016	4540	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 8008 set thread context of 5676	8008	h5jxHhKitFgx81LrvzPzZ_mi.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe

Drops file in Program Files directory 30 IoCs

Processes:

Setup.exeHcbPd3mmnHLsHqf8rJNVbbu2.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeSetup.exemd8_8eus.exe_W4CjUZklbDrdxqWJIdSEC2M.exenote866.exe83YXMwskFHfOxbgzO8AZO8lD.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe	Setup.exe
File created	C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.ini	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	HcbPd3mmnHLsHqf8rJNVbbu2.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	HcbPd3mmnHLsHqf8rJNVbbu2.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe	Setup.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe	Setup.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	_W4CjUZklbDrdxqWJIdSEC2M.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File created	C:\Program Files (x86)\SmartPDF\SmartPDF\d	note866.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	HcbPd3mmnHLsHqf8rJNVbbu2.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe	Setup.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	83YXMwskFHfOxbgzO8AZO8lD.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	_W4CjUZklbDrdxqWJIdSEC2M.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	HcbPd3mmnHLsHqf8rJNVbbu2.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	83YXMwskFHfOxbgzO8AZO8lD.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.exe	Setup.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	HcbPd3mmnHLsHqf8rJNVbbu2.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe

Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 39 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3344	1500	WerFault.exe	ylFuuRO65UDYhYtJH1iLXAW3.exe
3348	2984	WerFault.exe	Cp2xJsrZET8GjWBoFEOl7RV4.exe
2836	1112	WerFault.exe	vfo107HGtIGH8IkSOABOKAu1.exe
2800	1116	WerFault.exe	Q72q8lQfHW00w2ocsoclB9A6.exe
5652	2824	WerFault.exe	Tt_u_78vuUdZLT4jSPRlPQxU.exe
2032	6092	WerFault.exe	rundll32.exe
664	1472	WerFault.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
6752	4196	WerFault.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
6608	5012	WerFault.exe	3389790.exe
8140	4364	WerFault.exe	4341200.exe
7236	660	WerFault.exe	2107243.exe
3552	5924	WerFault.exe	4674657.exe
6476	7264	WerFault.exe	vnIUnTjsoEJYdB3Lpgi8fOez.exe
7720	5388	WerFault.exe	3375273.exe
884	7636	WerFault.exe	kgNu7CKDx9vefqZ0_gkLF90K.exe
9072	7776	WerFault.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
4640	6780	WerFault.exe	4379956.exe
8400	5848	WerFault.exe	rundll32.exe
7836	6164	WerFault.exe	5594086.exe
6156	6664	WerFault.exe	5396538.exe
6864	5032	WerFault.exe	6155964.exe
4612	7784	WerFault.exe	3853591.exe
7932	8248	WerFault.exe	3766018.exe
5044	3424	WerFault.exe	Bf4YOJOO.exe
5072	7184	WerFault.exe	Bf4YOJOO.exe
2096	6604	WerFault.exe	TRY4LfvW.exe
3112	9200	WerFault.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
884	5384	WerFault.exe	TRY4LfvW.exe
9012	5780	WerFault.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
1176	5912	WerFault.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
6680	12244	WerFault.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
7840	3496	WerFault.exe	h5jxHhKitFgx81LrvzPzZ_mi.exe
10388	9600	WerFault.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
9248	10688	WerFault.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
9504	12160	WerFault.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
692	10008	WerFault.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
7332	4252	WerFault.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
10988	5628	WerFault.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
3652	10924	WerFault.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exesvchost.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeh5jxHhKitFgx81LrvzPzZ_mi.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	h5jxHhKitFgx81LrvzPzZ_mi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	h5jxHhKitFgx81LrvzPzZ_mi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe

Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4948 schtasks.exe
4952 schtasks.exe
8064 schtasks.exe
8828 schtasks.exe
8500 schtasks.exe
4168 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

6024 timeout.exe

pid	process
4948	schtasks.exe
4952	schtasks.exe
8064	schtasks.exe
8828	schtasks.exe
8500	schtasks.exe
4168	schtasks.exe

pid	process
6024	timeout.exe

Enumerates system info in registry 2 TTPs 57 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeWerFault.exeWerFault.exeWerFault.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeh5jxHhKitFgx81LrvzPzZ_mi.exeWerFault.exeWerFault.exesvchost.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeh5jxHhKitFgx81LrvzPzZ_mi.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	h5jxHhKitFgx81LrvzPzZ_mi.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	h5jxHhKitFgx81LrvzPzZ_mi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	h5jxHhKitFgx81LrvzPzZ_mi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	h5jxHhKitFgx81LrvzPzZ_mi.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

4116 taskkill.exe
8988 taskkill.exe

pid	process
4116	taskkill.exe
8988	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5488 PING.EXE

pid	process
5488	PING.EXE

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	327	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	89	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	103	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	148	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	174	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	319	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Setup.exeWerFault.exeWerFault.exeWerFault.exeJ77cmUgJX0OQi4nZtiqUPG2L.exeWerFault.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeWerFault.exe4341200.exe1636954.exe2107243.exe3389790.exemsedge.exeSmartPDF.exeh5jxHhKitFgx81LrvzPzZ_mi.exewEzNj4RHYjtVPR9oDYR5v_c2.exemsedge.exeWerFault.exewEzNj4RHYjtVPR9oDYR5v_c2.exesvchost.exeWerFault.exe4674657.exe3375273.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exe

pid	process
3564	Setup.exe
3564	Setup.exe
2836
2836
2800	WerFault.exe
2800	WerFault.exe
3348	WerFault.exe
3348	WerFault.exe
3344	WerFault.exe
3344	WerFault.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
4192	J77cmUgJX0OQi4nZtiqUPG2L.exe
5652	WerFault.exe
5652	WerFault.exe
2032	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
2032	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
664	WerFault.exe
664	WerFault.exe
4364	4341200.exe
4364	4341200.exe
1808	1636954.exe
1808	1636954.exe
660	2107243.exe
660	2107243.exe
5012	3389790.exe
5012	3389790.exe
6800	msedge.exe
6800	msedge.exe
3584	SmartPDF.exe
3584	SmartPDF.exe
4528	h5jxHhKitFgx81LrvzPzZ_mi.exe
4528	h5jxHhKitFgx81LrvzPzZ_mi.exe
5032	wEzNj4RHYjtVPR9oDYR5v_c2.exe
5032	wEzNj4RHYjtVPR9oDYR5v_c2.exe
2780	msedge.exe
2780	msedge.exe
6752	WerFault.exe
6752	WerFault.exe
7132	wEzNj4RHYjtVPR9oDYR5v_c2.exe
7132	wEzNj4RHYjtVPR9oDYR5v_c2.exe
7132	wEzNj4RHYjtVPR9oDYR5v_c2.exe
7132	wEzNj4RHYjtVPR9oDYR5v_c2.exe
7132	wEzNj4RHYjtVPR9oDYR5v_c2.exe
7132	wEzNj4RHYjtVPR9oDYR5v_c2.exe
7132	wEzNj4RHYjtVPR9oDYR5v_c2.exe
7132	wEzNj4RHYjtVPR9oDYR5v_c2.exe
6608	svchost.exe
6608	svchost.exe
7236	WerFault.exe
7236	WerFault.exe
5924	4674657.exe
5924	4674657.exe
5388	3375273.exe
5388	3375273.exe
8140	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
8140	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
4528	h5jxHhKitFgx81LrvzPzZ_mi.exe
4528	h5jxHhKitFgx81LrvzPzZ_mi.exe

Suspicious behavior: SetClipboardViewer 5 IoCs

Processes:

WinHoster.exe5852793.exe1903063.exe8694641.exe3652655.exe

pid process

5724 WinHoster.exe
6012 5852793.exe
7076 1903063.exe
1052 8694641.exe
2052 3652655.exe

pid	process
5724	WinHoster.exe
6012	5852793.exe
7076	1903063.exe
1052	8694641.exe
2052	3652655.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

bgyCNXIhUpksgKctPnpQB2rY.exelnQ5wXdnTzqWKrLrsoNktHaP.exeWerFault.exe2107243.exe3389790.exe4341200.exe1636954.exetaskkill.exeYQKNIE81rcPOrZcq8om0_rMo.exemd8_8eus.exe4674657.exe3375273.exewEzNj4RHYjtVPR9oDYR5v_c2.exeh5jxHhKitFgx81LrvzPzZ_mi.exe2500164.exe4201421.exeWerFault.exeLivelyScreenRecS3.0.exeSmartPDF.exewEzNj4RHYjtVPR9oDYR5v_c2.exe4379956.exe5594086.exe8670401.exewEzNj4RHYjtVPR9oDYR5v_c2.exe8Jrxbt8BZTsIcHQ4WrXF_d4l.exeLGf7Dh_5haPDN4crY_hGCC4M.exeservices32.exewEzNj4RHYjtVPR9oDYR5v_c2.exe5396538.exeh5jxHhKitFgx81LrvzPzZ_mi.exe3766018.exe4249756.exe3853591.exesvchost.exewEzNj4RHYjtVPR9oDYR5v_c2.exedfadhTgeRQ2YNqA6LN7VKaND.exeV3kWg5hAnbI6Io6P0iviypK3.exe2204540.exe5964606.exeh5jxHhKitFgx81LrvzPzZ_mi.exeh5jxHhKitFgx81LrvzPzZ_mi.exeh5jxHhKitFgx81LrvzPzZ_mi.exewEzNj4RHYjtVPR9oDYR5v_c2.exeh5jxHhKitFgx81LrvzPzZ_mi.exewEzNj4RHYjtVPR9oDYR5v_c2.exewEzNj4RHYjtVPR9oDYR5v_c2.exeh5jxHhKitFgx81LrvzPzZ_mi.exewEzNj4RHYjtVPR9oDYR5v_c2.exewEzNj4RHYjtVPR9oDYR5v_c2.exewEzNj4RHYjtVPR9oDYR5v_c2.exeh5jxHhKitFgx81LrvzPzZ_mi.exewEzNj4RHYjtVPR9oDYR5v_c2.exewEzNj4RHYjtVPR9oDYR5v_c2.exeh5jxHhKitFgx81LrvzPzZ_mi.exewEzNj4RHYjtVPR9oDYR5v_c2.exeh5jxHhKitFgx81LrvzPzZ_mi.exe

description	pid	process
Token: SeDebugPrivilege	3704	bgyCNXIhUpksgKctPnpQB2rY.exe
Token: SeDebugPrivilege	4536	lnQ5wXdnTzqWKrLrsoNktHaP.exe
Token: SeRestorePrivilege	3348	WerFault.exe
Token: SeBackupPrivilege	3348	WerFault.exe
Token: SeBackupPrivilege	3348	WerFault.exe
Token: SeDebugPrivilege	660	2107243.exe
Token: SeDebugPrivilege	5012	3389790.exe
Token: SeDebugPrivilege	4364	4341200.exe
Token: SeDebugPrivilege	1808	1636954.exe
Token: SeDebugPrivilege	4116	taskkill.exe
Token: SeDebugPrivilege	2508	YQKNIE81rcPOrZcq8om0_rMo.exe
Token: SeManageVolumePrivilege	4120	md8_8eus.exe
Token: SeDebugPrivilege	5924	4674657.exe
Token: SeDebugPrivilege	5388	3375273.exe
Token: SeDebugPrivilege	5032	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	4528	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	4004	2500164.exe
Token: SeDebugPrivilege	4188	4201421.exe
Token: SeDebugPrivilege	4292	WerFault.exe
Token: SeDebugPrivilege	3888	LivelyScreenRecS3.0.exe
Token: SeDebugPrivilege	3584	SmartPDF.exe
Token: SeDebugPrivilege	5784	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	6780	4379956.exe
Token: SeDebugPrivilege	6164	5594086.exe
Token: SeDebugPrivilege	1500	8670401.exe
Token: SeDebugPrivilege	5396	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	1780	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
Token: SeDebugPrivilege	3716	LGf7Dh_5haPDN4crY_hGCC4M.exe
Token: SeDebugPrivilege	5876	services32.exe
Token: SeDebugPrivilege	4424	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	6664	5396538.exe
Token: SeDebugPrivilege	8988	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	5032	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	8248	3766018.exe
Token: SeDebugPrivilege	5004	4249756.exe
Token: SeDebugPrivilege	7784	3853591.exe
Token: SeTcbPrivilege	6608	svchost.exe
Token: SeTcbPrivilege	6608	svchost.exe
Token: SeTcbPrivilege	6608	svchost.exe
Token: SeTcbPrivilege	6608	svchost.exe
Token: SeTcbPrivilege	6608	svchost.exe
Token: SeTcbPrivilege	6608	svchost.exe
Token: SeDebugPrivilege	2212	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	572	dfadhTgeRQ2YNqA6LN7VKaND.exe
Token: SeDebugPrivilege	4904	V3kWg5hAnbI6Io6P0iviypK3.exe
Token: SeDebugPrivilege	6064	2204540.exe
Token: SeDebugPrivilege	8720	5964606.exe
Token: SeDebugPrivilege	2964	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	9096	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	5604	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	4608	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	680	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	2880	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	8960	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	1636	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	228	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	476	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	7760	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	6464	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	1536	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	6960	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	3324	h5jxHhKitFgx81LrvzPzZ_mi.exe
Token: SeDebugPrivilege	7412	wEzNj4RHYjtVPR9oDYR5v_c2.exe
Token: SeDebugPrivilege	8920	h5jxHhKitFgx81LrvzPzZ_mi.exe

Suspicious use of FindShellTrayWindow 16 IoCs

Processes:

BVoMx_fHQOJwEng3aOU2dT3Y.tmpstats.tmpmsedge.exetVZzfuDTPE9RzMTGT94DcAk7.tmpTra.exe.com8Jrxbt8BZTsIcHQ4WrXF_d4l.exeTra.exe.comTra.exe.com

pid	process
2568	BVoMx_fHQOJwEng3aOU2dT3Y.tmp
4064	stats.tmp
2780	msedge.exe
9168	tVZzfuDTPE9RzMTGT94DcAk7.tmp
8332	Tra.exe.com
8332	Tra.exe.com
8332	Tra.exe.com
3728	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
3728	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
3728	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
3108	Tra.exe.com
3108	Tra.exe.com
3108	Tra.exe.com
2844	Tra.exe.com
2844	Tra.exe.com
2844	Tra.exe.com

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

Tra.exe.com8Jrxbt8BZTsIcHQ4WrXF_d4l.exeTra.exe.comTra.exe.com

pid	process
8332	Tra.exe.com
8332	Tra.exe.com
8332	Tra.exe.com
3728	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
3728	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
3728	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
3108	Tra.exe.com
3108	Tra.exe.com
3108	Tra.exe.com
2844	Tra.exe.com
2844	Tra.exe.com
2844	Tra.exe.com

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 3564 wrote to memory of 1112	3564	Setup.exe	vfo107HGtIGH8IkSOABOKAu1.exe
PID 3564 wrote to memory of 1112	3564	Setup.exe	vfo107HGtIGH8IkSOABOKAu1.exe
PID 3564 wrote to memory of 1112	3564	Setup.exe	vfo107HGtIGH8IkSOABOKAu1.exe
PID 3564 wrote to memory of 1184	3564	Setup.exe	HcbPd3mmnHLsHqf8rJNVbbu2.exe
PID 3564 wrote to memory of 1184	3564	Setup.exe	HcbPd3mmnHLsHqf8rJNVbbu2.exe
PID 3564 wrote to memory of 1184	3564	Setup.exe	HcbPd3mmnHLsHqf8rJNVbbu2.exe
PID 3564 wrote to memory of 2488	3564	Setup.exe	UWFJm6dTX_pyGjfLcn9Gmq_u.exe
PID 3564 wrote to memory of 2488	3564	Setup.exe	UWFJm6dTX_pyGjfLcn9Gmq_u.exe
PID 3564 wrote to memory of 2488	3564	Setup.exe	UWFJm6dTX_pyGjfLcn9Gmq_u.exe
PID 3564 wrote to memory of 1676	3564	Setup.exe	di1B62jRZ3lJK4FH_65vYtnD.exe
PID 3564 wrote to memory of 1676	3564	Setup.exe	di1B62jRZ3lJK4FH_65vYtnD.exe
PID 3564 wrote to memory of 1676	3564	Setup.exe	di1B62jRZ3lJK4FH_65vYtnD.exe
PID 3564 wrote to memory of 5032	3564	Setup.exe	KcUYEO15ww0qhkEHNMkS2Ybg.exe
PID 3564 wrote to memory of 5032	3564	Setup.exe	KcUYEO15ww0qhkEHNMkS2Ybg.exe
PID 3564 wrote to memory of 5032	3564	Setup.exe	KcUYEO15ww0qhkEHNMkS2Ybg.exe
PID 3564 wrote to memory of 3904	3564	Setup.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 3564 wrote to memory of 3904	3564	Setup.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 3564 wrote to memory of 3904	3564	Setup.exe	wEzNj4RHYjtVPR9oDYR5v_c2.exe
PID 3564 wrote to memory of 4932	3564	Setup.exe	N_QOenS05Z6BgOENGg7vcXbi.exe
PID 3564 wrote to memory of 4932	3564	Setup.exe	N_QOenS05Z6BgOENGg7vcXbi.exe
PID 3564 wrote to memory of 4932	3564	Setup.exe	N_QOenS05Z6BgOENGg7vcXbi.exe
PID 3564 wrote to memory of 4540	3564	Setup.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3564 wrote to memory of 4540	3564	Setup.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3564 wrote to memory of 4540	3564	Setup.exe	8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
PID 3564 wrote to memory of 4544	3564	Setup.exe	8WuE_E2Anuiz3jSakPPUgElY.exe
PID 3564 wrote to memory of 4544	3564	Setup.exe	8WuE_E2Anuiz3jSakPPUgElY.exe
PID 3564 wrote to memory of 5044	3564	Setup.exe	fjo4nAaO2gvIKhsvTgHC1mEr.exe
PID 3564 wrote to memory of 5044	3564	Setup.exe	fjo4nAaO2gvIKhsvTgHC1mEr.exe
PID 3564 wrote to memory of 5044	3564	Setup.exe	fjo4nAaO2gvIKhsvTgHC1mEr.exe
PID 3564 wrote to memory of 4536	3564	Setup.exe	lnQ5wXdnTzqWKrLrsoNktHaP.exe
PID 3564 wrote to memory of 4536	3564	Setup.exe	lnQ5wXdnTzqWKrLrsoNktHaP.exe
PID 3564 wrote to memory of 4528	3564	Setup.exe	aRm5KdqY7g33grRYOKMWqjfu.exe
PID 3564 wrote to memory of 4528	3564	Setup.exe	aRm5KdqY7g33grRYOKMWqjfu.exe
PID 3564 wrote to memory of 4528	3564	Setup.exe	aRm5KdqY7g33grRYOKMWqjfu.exe
PID 3564 wrote to memory of 3544	3564	Setup.exe	83YXMwskFHfOxbgzO8AZO8lD.exe
PID 3564 wrote to memory of 3544	3564	Setup.exe	83YXMwskFHfOxbgzO8AZO8lD.exe
PID 3564 wrote to memory of 3544	3564	Setup.exe	83YXMwskFHfOxbgzO8AZO8lD.exe
PID 3564 wrote to memory of 2984	3564	Setup.exe	Cp2xJsrZET8GjWBoFEOl7RV4.exe
PID 3564 wrote to memory of 2984	3564	Setup.exe	Cp2xJsrZET8GjWBoFEOl7RV4.exe
PID 3564 wrote to memory of 2984	3564	Setup.exe	Cp2xJsrZET8GjWBoFEOl7RV4.exe
PID 3564 wrote to memory of 3888	3564	Setup.exe	avXopjlJVCYV9hnF1T5d1Zlk.exe
PID 3564 wrote to memory of 3888	3564	Setup.exe	avXopjlJVCYV9hnF1T5d1Zlk.exe
PID 3564 wrote to memory of 3888	3564	Setup.exe	avXopjlJVCYV9hnF1T5d1Zlk.exe
PID 3564 wrote to memory of 4808	3564	Setup.exe	EBzlFzw9fcVu3UrUqqxzRRn2.exe
PID 3564 wrote to memory of 4808	3564	Setup.exe	EBzlFzw9fcVu3UrUqqxzRRn2.exe
PID 3564 wrote to memory of 4808	3564	Setup.exe	EBzlFzw9fcVu3UrUqqxzRRn2.exe
PID 3564 wrote to memory of 2896	3564	Setup.exe	1dPrWtvS4zjaHeqViKgI927X.exe
PID 3564 wrote to memory of 2896	3564	Setup.exe	1dPrWtvS4zjaHeqViKgI927X.exe
PID 3564 wrote to memory of 2896	3564	Setup.exe	1dPrWtvS4zjaHeqViKgI927X.exe
PID 3564 wrote to memory of 1500	3564	Setup.exe	ylFuuRO65UDYhYtJH1iLXAW3.exe
PID 3564 wrote to memory of 1500	3564	Setup.exe	ylFuuRO65UDYhYtJH1iLXAW3.exe
PID 3564 wrote to memory of 1500	3564	Setup.exe	ylFuuRO65UDYhYtJH1iLXAW3.exe
PID 3564 wrote to memory of 1116	3564	Setup.exe	Q72q8lQfHW00w2ocsoclB9A6.exe
PID 3564 wrote to memory of 1116	3564	Setup.exe	Q72q8lQfHW00w2ocsoclB9A6.exe
PID 3564 wrote to memory of 1116	3564	Setup.exe	Q72q8lQfHW00w2ocsoclB9A6.exe
PID 3564 wrote to memory of 3704	3564	Setup.exe	bgyCNXIhUpksgKctPnpQB2rY.exe
PID 3564 wrote to memory of 3704	3564	Setup.exe	bgyCNXIhUpksgKctPnpQB2rY.exe
PID 3564 wrote to memory of 3096	3564	Setup.exe	BVoMx_fHQOJwEng3aOU2dT3Y.exe
PID 3564 wrote to memory of 3096	3564	Setup.exe	BVoMx_fHQOJwEng3aOU2dT3Y.exe
PID 3564 wrote to memory of 3096	3564	Setup.exe	BVoMx_fHQOJwEng3aOU2dT3Y.exe
PID 2164 wrote to memory of 2984	2164	WerFault.exe	Cp2xJsrZET8GjWBoFEOl7RV4.exe
PID 2164 wrote to memory of 2984	2164	WerFault.exe	Cp2xJsrZET8GjWBoFEOl7RV4.exe
PID 1880 wrote to memory of 1116	1880	WerFault.exe	Q72q8lQfHW00w2ocsoclB9A6.exe
PID 1880 wrote to memory of 1116	1880	WerFault.exe	Q72q8lQfHW00w2ocsoclB9A6.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\Documents\ylFuuRO65UDYhYtJH1iLXAW3.exe
  "C:\Users\Admin\Documents\ylFuuRO65UDYhYtJH1iLXAW3.exe"
  2⤵
  - Executes dropped EXE
  PID:1500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 272
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3344
- C:\Users\Admin\Documents\di1B62jRZ3lJK4FH_65vYtnD.exe
  "C:\Users\Admin\Documents\di1B62jRZ3lJK4FH_65vYtnD.exe"
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Users\Admin\Documents\EBzlFzw9fcVu3UrUqqxzRRn2.exe
  "C:\Users\Admin\Documents\EBzlFzw9fcVu3UrUqqxzRRn2.exe"
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Bf4YOJOO.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Bf4YOJOO.exe"
    3⤵
    - Executes dropped EXE
    PID:3424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 280
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\TRY4LfvW.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\TRY4LfvW.exe"
    3⤵
    PID:6604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 284
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      PID:2096
- C:\Users\Admin\Documents\avXopjlJVCYV9hnF1T5d1Zlk.exe
  "C:\Users\Admin\Documents\avXopjlJVCYV9hnF1T5d1Zlk.exe"
  2⤵
  - Executes dropped EXE
  PID:3888
- - C:\Users\Admin\Documents\avXopjlJVCYV9hnF1T5d1Zlk.exe
    "C:\Users\Admin\Documents\avXopjlJVCYV9hnF1T5d1Zlk.exe" -u
    3⤵
    - Executes dropped EXE
    PID:3120
- C:\Users\Admin\Documents\83YXMwskFHfOxbgzO8AZO8lD.exe
  "C:\Users\Admin\Documents\83YXMwskFHfOxbgzO8AZO8lD.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3544
- - C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe
    "C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4192
  - - C:\Users\Admin\Documents\YQKNIE81rcPOrZcq8om0_rMo.exe
      "C:\Users\Admin\Documents\YQKNIE81rcPOrZcq8om0_rMo.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2508
    - - C:\Users\Admin\AppData\Roaming\4674657.exe
        
        "C:\Users\Admin\AppData\Roaming\4674657.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5924
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5924 -s 2316
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3552
    - - C:\Users\Admin\AppData\Roaming\5852793.exe
        
        "C:\Users\Admin\AppData\Roaming\5852793.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:6012
    - - C:\Users\Admin\AppData\Roaming\8670401.exe
        
        "C:\Users\Admin\AppData\Roaming\8670401.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
    - - C:\Users\Admin\AppData\Roaming\3375273.exe
        
        "C:\Users\Admin\AppData\Roaming\3375273.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 2284
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:7720
  - - C:\Users\Admin\Documents\Tt_u_78vuUdZLT4jSPRlPQxU.exe
      "C:\Users\Admin\Documents\Tt_u_78vuUdZLT4jSPRlPQxU.exe"
      4⤵
      Executes dropped EXE
      PID:2824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 276
        5⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4952
- C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
  "C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3904
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Executes dropped EXE
    PID:4216
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:476
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Executes dropped EXE
    PID:1012
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Executes dropped EXE
    PID:5364
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5784
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5396
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4196
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 28
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:6752
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6464
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7104
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7184
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7996
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7532
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5812
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8096
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8336
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8872
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8680
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9188
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6080
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Suspicious use of AdjustPrivilegeToken
    PID:7760
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6356
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6640
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:1992
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4048
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9040
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4328
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6960
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8960
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:3736
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7232
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4172
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:3300
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7412
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6392
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7772
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8596
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5960
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8384
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7248
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5472
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7896
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4876
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4384
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5852
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:2568
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:8408
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5136
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4804
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8780
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9156
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7132
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8232
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:1392
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4468
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7176
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:4552
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7072
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8984
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:2020
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4720
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 28
      4⤵
      Program crash
      PID:9012
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6932
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8272
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:8100
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5276
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5996
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8628
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:1116
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:6524
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8908
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9776
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5256
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8640
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:7092
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4716
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5984
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10096
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:1544
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:3976
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10524
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11024
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10084
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8836
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10940
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10392
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11148
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:820
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10412
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5292
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11480
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:12072
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11476
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:992
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11332
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:12168
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10156
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:12244
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11948
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11936
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11760
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8996
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9348
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8572
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8816
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11796
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:1472
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7368
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10360
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:3144
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:2856
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8852
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10688 -s 28
      4⤵
      Program crash
      PID:9248
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:2788
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:2992
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10684
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9592
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:748
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5092
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9968
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10624
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:7528
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9636
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9012
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10176
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:12160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 12160 -s 28
      4⤵
      Program crash
      PID:9504
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8908
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11256
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9520
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:4872
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9284
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:1236
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10516
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11084
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6720
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6284
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11380
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:8488
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:10404
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:9328
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11772
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:1360
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:6860
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11312
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:11920
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:5072
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:3476
- - C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe
    3⤵
    PID:3716
- C:\Users\Admin\Documents\Cp2xJsrZET8GjWBoFEOl7RV4.exe
  "C:\Users\Admin\Documents\Cp2xJsrZET8GjWBoFEOl7RV4.exe"
  2⤵
  - Executes dropped EXE
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 296
    3⤵
    - Drops file in Windows directory
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- C:\Users\Admin\Documents\1dPrWtvS4zjaHeqViKgI927X.exe
  "C:\Users\Admin\Documents\1dPrWtvS4zjaHeqViKgI927X.exe"
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Users\Admin\Documents\N_QOenS05Z6BgOENGg7vcXbi.exe
  "C:\Users\Admin\Documents\N_QOenS05Z6BgOENGg7vcXbi.exe"
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Users\Admin\Documents\lnQ5wXdnTzqWKrLrsoNktHaP.exe
  "C:\Users\Admin\Documents\lnQ5wXdnTzqWKrLrsoNktHaP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- - C:\Users\Admin\AppData\Roaming\7237429.exe
    "C:\Users\Admin\AppData\Roaming\7237429.exe"
    3⤵
    PID:3180
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: SetClipboardViewer
      PID:5724
- - C:\Users\Admin\AppData\Roaming\2500164.exe
    "C:\Users\Admin\AppData\Roaming\2500164.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Users\Admin\AppData\Roaming\2107243.exe
    "C:\Users\Admin\AppData\Roaming\2107243.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:660
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 660 -s 2328
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:7236
- - C:\Users\Admin\AppData\Roaming\4341200.exe
    "C:\Users\Admin\AppData\Roaming\4341200.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2460
      4⤵
      Program crash
      PID:8140
- C:\Users\Admin\Documents\8WuE_E2Anuiz3jSakPPUgElY.exe
  "C:\Users\Admin\Documents\8WuE_E2Anuiz3jSakPPUgElY.exe"
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
  "C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4540
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Executes dropped EXE
    PID:1788
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Executes dropped EXE
    PID:2604
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Executes dropped EXE
    PID:1872
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Executes dropped EXE
    PID:5276
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Executes dropped EXE
    PID:5584
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Executes dropped EXE
    PID:6072
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Executes dropped EXE
    PID:1472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 28
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:664
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:2252
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:2248
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:6240
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:6876
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7160
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7980
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4512
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:1000
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8256
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8788
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8848
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:8140
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4592
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:6456
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8440
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4308
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9100
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3728
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9060
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:3700
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:1016
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7384
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:2184
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5156
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5648
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:1776
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4620
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7944
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:3500
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7324
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8724
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:3996
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5464
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:2756
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8548
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2032
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8648
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8344
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8812
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5856
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7404
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7064
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7628
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:400
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7000
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Enumerates connected drives
    PID:3356
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5380
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8808
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:1720
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:1344
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:1276
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5620
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8036
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:3544
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5708
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7844
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:4376
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:6460
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:6356
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7800
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7884
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4408
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5296
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9716
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9456
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10136
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10116
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7748
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9076
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:2220
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9244
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9892
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10652
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11192
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10992
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9512
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:1560
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10380
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7312
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:820
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:6604
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11628
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:12180
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11712
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11844
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11316
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:12228
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11552
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11764
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11696
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5928
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11092
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7920
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Loads dropped DLL
    PID:5176
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Drops file in Program Files directory
    PID:7496
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9620
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10212
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10556
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7528
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5952
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4624
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:9600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9600 -s 28
      4⤵
      Program crash
      PID:10388
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10776
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10464
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5056
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:6676
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11796
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5844
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8180
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:6372
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:12128
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:3868
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7680
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:2860
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7288
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10564
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7612
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11032
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:2612
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10008 -s 28
      4⤵
      Program crash
      PID:692
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    - Enumerates connected drives
    PID:4808
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4656
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10628
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4208
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 28
      4⤵
      Program crash
      PID:7332
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11504
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8084
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:2984
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:4192
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8664
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8624
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8588
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:7448
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:5628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 28
      4⤵
      Program crash
      PID:10988
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:11132
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:8340
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:10924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10924 -s 28
      4⤵
      Program crash
      PID:3652
- - C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe
    3⤵
    PID:1308
- C:\Users\Admin\Documents\aRm5KdqY7g33grRYOKMWqjfu.exe
  "C:\Users\Admin\Documents\aRm5KdqY7g33grRYOKMWqjfu.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4528
- C:\Users\Admin\Documents\fjo4nAaO2gvIKhsvTgHC1mEr.exe
  "C:\Users\Admin\Documents\fjo4nAaO2gvIKhsvTgHC1mEr.exe"
  2⤵
  - Executes dropped EXE
  PID:5044
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\fjo4nAaO2gvIKhsvTgHC1mEr.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\fjo4nAaO2gvIKhsvTgHC1mEr.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
    3⤵
    PID:3520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\fjo4nAaO2gvIKhsvTgHC1mEr.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\fjo4nAaO2gvIKhsvTgHC1mEr.exe" ) do taskkill -F /Im "%~nXN"
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE
        
        KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG
        5⤵
        Executes dropped EXE
        
        PID:2472
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
        6⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"
        7⤵
        
        PID:4400
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" .\p_ZPP.J p
        6⤵
        
        PID:5308
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F /Im "fjo4nAaO2gvIKhsvTgHC1mEr.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
- C:\Users\Admin\Documents\KcUYEO15ww0qhkEHNMkS2Ybg.exe
  "C:\Users\Admin\Documents\KcUYEO15ww0qhkEHNMkS2Ybg.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5032
- C:\Users\Admin\Documents\UWFJm6dTX_pyGjfLcn9Gmq_u.exe
  "C:\Users\Admin\Documents\UWFJm6dTX_pyGjfLcn9Gmq_u.exe"
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Users\Admin\Documents\vfo107HGtIGH8IkSOABOKAu1.exe
  "C:\Users\Admin\Documents\vfo107HGtIGH8IkSOABOKAu1.exe"
  2⤵
  - Executes dropped EXE
  PID:1112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 280
    3⤵
    - Program crash
    PID:2836
- C:\Users\Admin\Documents\HcbPd3mmnHLsHqf8rJNVbbu2.exe
  "C:\Users\Admin\Documents\HcbPd3mmnHLsHqf8rJNVbbu2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1184
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    - Executes dropped EXE
    PID:2624
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:4488
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\Users\Admin\Documents\Q72q8lQfHW00w2ocsoclB9A6.exe
  "C:\Users\Admin\Documents\Q72q8lQfHW00w2ocsoclB9A6.exe"
  2⤵
  - Executes dropped EXE
  PID:1116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 276
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2800
- C:\Users\Admin\Documents\bgyCNXIhUpksgKctPnpQB2rY.exe
  "C:\Users\Admin\Documents\bgyCNXIhUpksgKctPnpQB2rY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- - C:\Users\Admin\AppData\Roaming\3389790.exe
    "C:\Users\Admin\AppData\Roaming\3389790.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 5012 -s 2336
      4⤵
      Program crash
      PID:6608
- - C:\Users\Admin\AppData\Roaming\4951894.exe
    "C:\Users\Admin\AppData\Roaming\4951894.exe"
    3⤵
    - Executes dropped EXE
    PID:1172
- - C:\Users\Admin\AppData\Roaming\4201421.exe
    "C:\Users\Admin\AppData\Roaming\4201421.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- - C:\Users\Admin\AppData\Roaming\1636954.exe
    "C:\Users\Admin\AppData\Roaming\1636954.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\Users\Admin\Documents\BVoMx_fHQOJwEng3aOU2dT3Y.exe
  "C:\Users\Admin\Documents\BVoMx_fHQOJwEng3aOU2dT3Y.exe"
  2⤵
  - Executes dropped EXE
  PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2984 -ip 2984
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1116 -ip 1116
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1500 -ip 1500
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1112 -ip 1112
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1992

C:\Users\Admin\AppData\Local\Temp\is-UIMT4.tmp\BVoMx_fHQOJwEng3aOU2dT3Y.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UIMT4.tmp\BVoMx_fHQOJwEng3aOU2dT3Y.tmp" /SL5="$102CC,138429,56832,C:\Users\Admin\Documents\BVoMx_fHQOJwEng3aOU2dT3Y.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2568
- C:\Users\Admin\AppData\Local\Temp\is-7907Q.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-7907Q.tmp\Setup.exe" /Verysilent
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs7
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcae1746f8,0x7ffcae174708,0x7ffcae174718
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:6732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:6480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:7016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:7472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
      4⤵
      PID:7732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      PID:9064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 /prefetch:2
      4⤵
      PID:8560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2208,17619251058941001298,2520050460263035456,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
      4⤵
      PID:2424
- - C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5176
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
      4⤵
      PID:8560
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        5⤵
        Delays execution with timeout.exe
        
        PID:6024
- - C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"
    3⤵
    PID:4292
  - - C:\Users\Admin\AppData\Roaming\4379956.exe
      "C:\Users\Admin\AppData\Roaming\4379956.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6780
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6780 -s 2324
        5⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4640
  - - C:\Users\Admin\AppData\Roaming\1903063.exe
      "C:\Users\Admin\AppData\Roaming\1903063.exe"
      4⤵
      Suspicious behavior: SetClipboardViewer
      PID:7076
  - - C:\Users\Admin\AppData\Roaming\4249756.exe
      "C:\Users\Admin\AppData\Roaming\4249756.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5004
  - - C:\Users\Admin\AppData\Roaming\5594086.exe
      "C:\Users\Admin\AppData\Roaming\5594086.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6164 -s 2432
        5⤵
        Program crash
        
        PID:7836
- - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a
      4⤵
      PID:6336
- - C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    PID:5920
- - C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\tmp6E1C_tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp6E1C_tmp.exe"
      4⤵
      Adds Run key to start application
      PID:7544
    - - C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        5⤵
        
        PID:1224
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Pei.xll
        5⤵
        
        PID:8048
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        6⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        Tra.exe.com o
        7⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
        9⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
        10⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
        11⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        7⤵
        Runs ping.exe
        
        PID:5488
- - C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
    3⤵
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\is-N4FAB.tmp\stats.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-N4FAB.tmp\stats.tmp" /SL5="$2036A,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\is-BHGO0.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-BHGO0.tmp\Setup.exe" /Verysilent
        5⤵
        
        PID:7132
      - C:\Users\Admin\Documents\LGf7Dh_5haPDN4crY_hGCC4M.exe
        
        "C:\Users\Admin\Documents\LGf7Dh_5haPDN4crY_hGCC4M.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
        
        C:\Users\Admin\AppData\Roaming\3652655.exe
        
        "C:\Users\Admin\AppData\Roaming\3652655.exe"
        7⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:2052
        
        C:\Users\Admin\AppData\Roaming\6155964.exe
        
        "C:\Users\Admin\AppData\Roaming\6155964.exe"
        7⤵
        
        PID:5032
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5032 -s 2328
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:6864
        
        C:\Users\Admin\AppData\Roaming\2204540.exe
        
        "C:\Users\Admin\AppData\Roaming\2204540.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6064
        
        C:\Users\Admin\AppData\Roaming\3853591.exe
        
        "C:\Users\Admin\AppData\Roaming\3853591.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:7784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 2268
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4612
      - C:\Users\Admin\Documents\BJxk5qWmEc2m0zfM8HQfvLM_.exe
        
        "C:\Users\Admin\Documents\BJxk5qWmEc2m0zfM8HQfvLM_.exe"
        6⤵
        
        PID:6904
      - C:\Users\Admin\Documents\yDqbjYK1tt8I4_Uhml83830v.exe
        
        "C:\Users\Admin\Documents\yDqbjYK1tt8I4_Uhml83830v.exe"
        6⤵
        
        PID:6336
      - C:\Users\Admin\Documents\dfadhTgeRQ2YNqA6LN7VKaND.exe
        
        "C:\Users\Admin\Documents\dfadhTgeRQ2YNqA6LN7VKaND.exe"
        6⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
      - C:\Users\Admin\Documents\uqtpkZRT2j3AGAQqDlWrFod3.exe
        
        "C:\Users\Admin\Documents\uqtpkZRT2j3AGAQqDlWrFod3.exe"
        6⤵
        
        PID:4092
        
        C:\Users\Admin\Documents\uqtpkZRT2j3AGAQqDlWrFod3.exe
        
        "C:\Users\Admin\Documents\uqtpkZRT2j3AGAQqDlWrFod3.exe" -u
        7⤵
        
        PID:9084
      - C:\Users\Admin\Documents\kgNu7CKDx9vefqZ0_gkLF90K.exe
        
        "C:\Users\Admin\Documents\kgNu7CKDx9vefqZ0_gkLF90K.exe"
        6⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 240
        7⤵
        Program crash
        
        PID:884
      - C:\Users\Admin\Documents\_W4CjUZklbDrdxqWJIdSEC2M.exe
        
        "C:\Users\Admin\Documents\_W4CjUZklbDrdxqWJIdSEC2M.exe"
        6⤵
        Drops file in Program Files directory
        
        PID:6360
      - C:\Users\Admin\Documents\V3kWg5hAnbI6Io6P0iviypK3.exe
        
        "C:\Users\Admin\Documents\V3kWg5hAnbI6Io6P0iviypK3.exe"
        6⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:4904
      - C:\Users\Admin\Documents\do287uSGdDdfS0i0mGyvlQJ1.exe
        
        "C:\Users\Admin\Documents\do287uSGdDdfS0i0mGyvlQJ1.exe"
        6⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\Bf4YOJOO.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Bf4YOJOO.exe"
        7⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7184 -s 296
        8⤵
        Program crash
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\TRY4LfvW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\TRY4LfvW.exe"
        7⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 284
        8⤵
        Program crash
        Enumerates system info in registry
        
        PID:884
      - C:\Users\Admin\Documents\Vo0VFH1IM4VTt5tS2W9SE0oj.exe
        
        "C:\Users\Admin\Documents\Vo0VFH1IM4VTt5tS2W9SE0oj.exe"
        6⤵
        
        PID:5660
      - C:\Users\Admin\Documents\ZaXHv2MKQpnlfc21MuAHJLEz.exe
        
        "C:\Users\Admin\Documents\ZaXHv2MKQpnlfc21MuAHJLEz.exe"
        6⤵
        
        PID:7444
      - C:\Users\Admin\Documents\1jDEhSHn5waiHnRcpa6HzEEt.exe
        
        "C:\Users\Admin\Documents\1jDEhSHn5waiHnRcpa6HzEEt.exe"
        6⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Creates scheduled task(s)
        
        PID:8500
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:4168
      - C:\Users\Admin\Documents\dwriaMruyrmhciUhHSVq1bk8.exe
        
        "C:\Users\Admin\Documents\dwriaMruyrmhciUhHSVq1bk8.exe"
        6⤵
        
        PID:7296
      - C:\Users\Admin\Documents\jU1hLuWBACbWJyRacMyKwPHT.exe
        
        "C:\Users\Admin\Documents\jU1hLuWBACbWJyRacMyKwPHT.exe"
        6⤵
        
        PID:7468
      - C:\Users\Admin\Documents\03XW4XrIukOjob4jqgNsMoSm.exe
        
        "C:\Users\Admin\Documents\03XW4XrIukOjob4jqgNsMoSm.exe"
        6⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\03XW4XrIukOjob4jqgNsMoSm.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\03XW4XrIukOjob4jqgNsMoSm.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
        7⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\03XW4XrIukOjob4jqgNsMoSm.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\03XW4XrIukOjob4jqgNsMoSm.exe" ) do taskkill -F /Im "%~nXN"
        8⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F /Im "03XW4XrIukOjob4jqgNsMoSm.exe"
        9⤵
        Kills process with taskkill
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE
        
        KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG
        9⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
        10⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"
        11⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" .\p_ZPP.J p
        10⤵
        
        PID:6472
      - C:\Users\Admin\Documents\EQPEoKSbKO4mFR7N8AyETlg3.exe
        
        "C:\Users\Admin\Documents\EQPEoKSbKO4mFR7N8AyETlg3.exe"
        6⤵
        
        PID:5576
      - C:\Users\Admin\Documents\CuQsN4FEUJ23Sln0a5dkudAB.exe
        
        "C:\Users\Admin\Documents\CuQsN4FEUJ23Sln0a5dkudAB.exe"
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Roaming\5396538.exe
        
        "C:\Users\Admin\AppData\Roaming\5396538.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6664
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6664 -s 2320
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:6156
        
        C:\Users\Admin\AppData\Roaming\8694641.exe
        
        "C:\Users\Admin\AppData\Roaming\8694641.exe"
        7⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:1052
        
        C:\Users\Admin\AppData\Roaming\5964606.exe
        
        "C:\Users\Admin\AppData\Roaming\5964606.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8720
        
        C:\Users\Admin\AppData\Roaming\3766018.exe
        
        "C:\Users\Admin\AppData\Roaming\3766018.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8248 -s 2432
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:7932
      - C:\Users\Admin\Documents\vnIUnTjsoEJYdB3Lpgi8fOez.exe
        
        "C:\Users\Admin\Documents\vnIUnTjsoEJYdB3Lpgi8fOez.exe"
        6⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7264 -s 240
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:6476
      - C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        "C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe"
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Suspicious use of SetThreadContext
        
        PID:8008
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7776 -s 28
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:9072
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5604
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:680
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8920
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:7836
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:2572
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:2520
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1128
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:628
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9200 -s 28
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3112
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Enumerates system info in registry
        
        PID:5072
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:3000
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1832
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:9096
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8988
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1436
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 28
        8⤵
        Program crash
        
        PID:1176
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:812
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6464
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:2508
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10756
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1532
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11784
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11292
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:12216
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11656
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12244 -s 28
        8⤵
        Program crash
        
        PID:6680
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 28
        8⤵
        Program crash
        
        PID:7840
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1176
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7068
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10504
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1884
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:2440
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:11452
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:1388
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        
        C:\Users\Admin\Documents\h5jxHhKitFgx81LrvzPzZ_mi.exe
        7⤵
        
        PID:8600
      - C:\Users\Admin\Documents\tVZzfuDTPE9RzMTGT94DcAk7.exe
        
        "C:\Users\Admin\Documents\tVZzfuDTPE9RzMTGT94DcAk7.exe"
        6⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\is-RUOB0.tmp\tVZzfuDTPE9RzMTGT94DcAk7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-RUOB0.tmp\tVZzfuDTPE9RzMTGT94DcAk7.tmp" /SL5="$20206,138429,56832,C:\Users\Admin\Documents\tVZzfuDTPE9RzMTGT94DcAk7.exe"
        7⤵
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\is-CIVNS.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-CIVNS.tmp\Setup.exe" /Verysilent
        8⤵
        Drops file in Program Files directory
        
        PID:3564
- - C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\services32.exe"' & exit
      4⤵
      PID:5432
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\services32.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:8064
  - - C:\Users\Admin\services32.exe
      "C:\Users\Admin\services32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5876
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\services32.exe"' & exit
        5⤵
        
        PID:8320
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\services32.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:8828
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        5⤵
        
        PID:9176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2488 -ip 2488
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4932 -ip 4932
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2896 -ip 2896
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1676 -ip 1676
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2824 -ip 2824
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5448

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:6092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 452
    3⤵
    - Program crash
    PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6092 -ip 6092
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5196

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1472 -ip 1472
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4196 -ip 4196
1⤵
PID:6524

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 800 -p 660 -ip 660
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6572

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 5012 -ip 5012
1⤵
PID:6952

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:6884
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Loads dropped DLL
  PID:6952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4364 -ip 4364
1⤵
PID:7760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1808 -ip 1808
1⤵
PID:8008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6952 -ip 6952
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 664 -p 5924 -ip 5924
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5576 -ip 5576
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6336 -ip 6336
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 8096 -ip 8096
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6904 -ip 6904
1⤵
PID:8500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5388 -ip 5388
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 7444 -ip 7444
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 7264 -ip 7264
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 7636 -ip 7636
1⤵
PID:6684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7296 -ip 7296
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5660 -ip 5660
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7776 -ip 7776
1⤵
PID:680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 516 -p 6780 -ip 6780
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5092

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:5848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 452
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:8400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5848 -ip 5848
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6164 -ip 6164
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8624

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 696 -p 6664 -ip 6664
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8112

C:\Program Files\Windows Defender\mpcmdrun.exe
"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
1⤵
PID:9100

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 748 -p 5032 -ip 5032
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 7784 -ip 7784
1⤵
PID:8100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 8248 -ip 8248
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3424 -ip 3424
1⤵
PID:8408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 7184 -ip 7184
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6604 -ip 6604
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 9200 -ip 9200
1⤵
PID:7092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5384 -ip 5384
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5780 -ip 5780
1⤵
PID:7316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5912 -ip 5912
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 12244 -ip 12244
1⤵
PID:7304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3496 -ip 3496
1⤵
PID:10236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 9600 -ip 9600
1⤵
PID:8968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 10688 -ip 10688
1⤵
PID:10844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 12160 -ip 12160
1⤵
PID:6544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 10008 -ip 10008
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4252 -ip 4252
1⤵
PID:9376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5628 -ip 5628
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 10924 -ip 10924
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\cutm3.exe

MD5
07e143efd03815a3b8c8b90e7e5776f0

SHA1
077314efef70cef8f43eeba7f1b8ba0e5e5dedc9

SHA256
32967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149

SHA512
79ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6

Download Submit
C:\Program Files (x86)\Company\NewProduct\cutm3.exe

MD5
07e143efd03815a3b8c8b90e7e5776f0

SHA1
077314efef70cef8f43eeba7f1b8ba0e5e5dedc9

SHA256
32967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149

SHA512
79ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6

Download Submit
C:\Program Files (x86)\Company\NewProduct\inst001.exe

MD5
23bcdc132d1f2aaf8d248b6a5bd21801

SHA1
2153acec77f4a57c621a3e38d523eb6df9b29134

SHA256
a7cb6d861c75f36c32cb5a304b0d8d84b5bc0bedd7da2eb942e4d67288f7123b

SHA512
d9684eab46e5431bc69b70154bbef7a3126f0719a80792f120a3a436e6f4f23cf1229d4b4293c1aff4202ab748144ce19dbc4c39f74f631e1b6f9336259f02db

Download Submit
C:\Program Files (x86)\Company\NewProduct\inst001.exe

MD5
23bcdc132d1f2aaf8d248b6a5bd21801

SHA1
2153acec77f4a57c621a3e38d523eb6df9b29134

SHA256
a7cb6d861c75f36c32cb5a304b0d8d84b5bc0bedd7da2eb942e4d67288f7123b

SHA512
d9684eab46e5431bc69b70154bbef7a3126f0719a80792f120a3a436e6f4f23cf1229d4b4293c1aff4202ab748144ce19dbc4c39f74f631e1b6f9336259f02db

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
68737ab1a037878a37f0b3e114edaaf8

SHA1
0ba735d99c77cb69937f8fcf89c6a9e3bc495512

SHA256
7bf16a22ac10e1dc50dc302c7d1c196dff361ee5c8e830ddb0cec90b548b483a

SHA512
f30fa001c604fe4aee324fc4af5b784feae262a62983bd2364721f83ad2522b714c0286b97569b927da5741339d8a0633cbd6abcae3e45f943d5f4ae9168b271

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe

MD5
68737ab1a037878a37f0b3e114edaaf8

SHA1
0ba735d99c77cb69937f8fcf89c6a9e3bc495512

SHA256
7bf16a22ac10e1dc50dc302c7d1c196dff361ee5c8e830ddb0cec90b548b483a

SHA512
f30fa001c604fe4aee324fc4af5b784feae262a62983bd2364721f83ad2522b714c0286b97569b927da5741339d8a0633cbd6abcae3e45f943d5f4ae9168b271

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Bf4YOJOO.exe

MD5
807cbab58d86bb675f3ba5e803bd583a

SHA1
5692ce9e1e505e921aa347255b326d8447c93fcf

SHA256
f5edda5a080b1e2e5b87f39f58b80c97c775c8a06cd7c0cdfc6c4db657d186bd

SHA512
a8f9cd02210210ff422b3c45ce9a7aaecb3c2b6193d706b81beb75d3b33c75b4cef9ce5f94eefb244f6af93b57ae0777af6c3de2775038810ba507fd9d232dd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Bf4YOJOO.exe

MD5
807cbab58d86bb675f3ba5e803bd583a

SHA1
5692ce9e1e505e921aa347255b326d8447c93fcf

SHA256
f5edda5a080b1e2e5b87f39f58b80c97c775c8a06cd7c0cdfc6c4db657d186bd

SHA512
a8f9cd02210210ff422b3c45ce9a7aaecb3c2b6193d706b81beb75d3b33c75b4cef9ce5f94eefb244f6af93b57ae0777af6c3de2775038810ba507fd9d232dd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7907Q.tmp\itdownload.dll

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7907Q.tmp\itdownload.dll

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UIMT4.tmp\BVoMx_fHQOJwEng3aOU2dT3Y.tmp

MD5
ffcf263a020aa7794015af0edee5df0b

SHA1
bce1eb5f0efb2c83f416b1782ea07c776666fdab

SHA256
1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

SHA512
49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

Download Submit
C:\Users\Admin\AppData\Roaming\2107243.exe

MD5
ba06d4e9654cd3d0276ae41200596c08

SHA1
91e112d1d41d08c82b7d31dfb5b15fd6ab25b6c1

SHA256
6c1268974939ca16453fb620116c91674ee2c1d128f011c52802b2a1119a8486

SHA512
9d2aa37f3b24acc2c3277c6af0946208040299d2ab17ebdfe263d59d073039bf9eed2d30b5dac3bd57bddce7ab238adc5f7767c7c8f1d1e9c63fcf4f7e34e5ec

Download Submit
C:\Users\Admin\AppData\Roaming\2107243.exe

MD5
ba06d4e9654cd3d0276ae41200596c08

SHA1
91e112d1d41d08c82b7d31dfb5b15fd6ab25b6c1

SHA256
6c1268974939ca16453fb620116c91674ee2c1d128f011c52802b2a1119a8486

SHA512
9d2aa37f3b24acc2c3277c6af0946208040299d2ab17ebdfe263d59d073039bf9eed2d30b5dac3bd57bddce7ab238adc5f7767c7c8f1d1e9c63fcf4f7e34e5ec

Download Submit
C:\Users\Admin\AppData\Roaming\2500164.exe

MD5
3bd774b285f57b3f1734783d991ff320

SHA1
8f4f3c3b4618582b48638fbc7b93cc608d237078

SHA256
245de2752e889a1c0f0948866de85253616391a9a3cd7812d45d8171e4525320

SHA512
14dbb5080781c496fd56cd4bc594713ce659f782b849fbc2c90e638a9fee50cf49218e19bcb455345a8b9a5a343fafe3ccebaddfb323ce0c2c907a44b338e919

Download Submit
C:\Users\Admin\AppData\Roaming\3389790.exe

MD5
9430946b0dad19081ef8eacb8a613317

SHA1
d68aba89dff181a7dcee43b778fdd9755c5c922b

SHA256
3ca866772fbea73f8dc8aef49cb356a7b612608ce5b72376f3d49c214b3c8409

SHA512
981a7d1add5e887fe518d6a79ee77e93150b850fabff525845795efbe8f88210b64eb2259e95acb74d73e28a672a4ba5569f639b52b5461358096ed098350391

Download Submit
C:\Users\Admin\AppData\Roaming\3389790.exe

MD5
9430946b0dad19081ef8eacb8a613317

SHA1
d68aba89dff181a7dcee43b778fdd9755c5c922b

SHA256
3ca866772fbea73f8dc8aef49cb356a7b612608ce5b72376f3d49c214b3c8409

SHA512
981a7d1add5e887fe518d6a79ee77e93150b850fabff525845795efbe8f88210b64eb2259e95acb74d73e28a672a4ba5569f639b52b5461358096ed098350391

Download Submit
C:\Users\Admin\AppData\Roaming\4951894.exe

MD5
b9295c5e9138ccf15d67771f3726c778

SHA1
40cd9d94e9913a52877f09f340a5c2604030409c

SHA256
8c4a2330010cdb34faf9f565943736d0bb9d21eb96a67ccc20c246cfe13e6292

SHA512
4e1d7e74be77d151b79024db20f3427c53ddf0557bbccd71b93750514462b5d2d2130948c668b05e66cf4098a56ad34c75ec7d1bd2e21e1c0bda01f7f4345f08

Download Submit
C:\Users\Admin\AppData\Roaming\4951894.exe

MD5
b9295c5e9138ccf15d67771f3726c778

SHA1
40cd9d94e9913a52877f09f340a5c2604030409c

SHA256
8c4a2330010cdb34faf9f565943736d0bb9d21eb96a67ccc20c246cfe13e6292

SHA512
4e1d7e74be77d151b79024db20f3427c53ddf0557bbccd71b93750514462b5d2d2130948c668b05e66cf4098a56ad34c75ec7d1bd2e21e1c0bda01f7f4345f08

Download Submit
C:\Users\Admin\AppData\Roaming\7237429.exe

MD5
b9295c5e9138ccf15d67771f3726c778

SHA1
40cd9d94e9913a52877f09f340a5c2604030409c

SHA256
8c4a2330010cdb34faf9f565943736d0bb9d21eb96a67ccc20c246cfe13e6292

SHA512
4e1d7e74be77d151b79024db20f3427c53ddf0557bbccd71b93750514462b5d2d2130948c668b05e66cf4098a56ad34c75ec7d1bd2e21e1c0bda01f7f4345f08

Download Submit
C:\Users\Admin\AppData\Roaming\7237429.exe

MD5
b9295c5e9138ccf15d67771f3726c778

SHA1
40cd9d94e9913a52877f09f340a5c2604030409c

SHA256
8c4a2330010cdb34faf9f565943736d0bb9d21eb96a67ccc20c246cfe13e6292

SHA512
4e1d7e74be77d151b79024db20f3427c53ddf0557bbccd71b93750514462b5d2d2130948c668b05e66cf4098a56ad34c75ec7d1bd2e21e1c0bda01f7f4345f08

Download Submit
C:\Users\Admin\Documents\1dPrWtvS4zjaHeqViKgI927X.exe

MD5
41d446391b562853b97173d373f9f8a5

SHA1
511c45ea3fbc050d210bf1faa8bed6f7d78fe91d

SHA256
9cbaafcc5fabe81105cbe09a869c1576dcb8c09c53386a6426ebead635502a67

SHA512
ac853fce59c068ddf5a49c88060f22b086a7f8fb325208b4bf76701627e8349fe7a7e8b43826f3a302055d170452e84456d7ae55a37b8218047c7dd509b43222

Download Submit
C:\Users\Admin\Documents\1dPrWtvS4zjaHeqViKgI927X.exe

MD5
41d446391b562853b97173d373f9f8a5

SHA1
511c45ea3fbc050d210bf1faa8bed6f7d78fe91d

SHA256
9cbaafcc5fabe81105cbe09a869c1576dcb8c09c53386a6426ebead635502a67

SHA512
ac853fce59c068ddf5a49c88060f22b086a7f8fb325208b4bf76701627e8349fe7a7e8b43826f3a302055d170452e84456d7ae55a37b8218047c7dd509b43222

Download Submit
C:\Users\Admin\Documents\83YXMwskFHfOxbgzO8AZO8lD.exe

MD5
abeea23c95c98bc3cbc6d9d4508a0a2f

SHA1
b9b202c2e2da2073b4e332a7401159118581d10c

SHA256
df7734cbb1baf26783f02249ac1b725286ae3709233cb3e78955cb6873597e6d

SHA512
6fb725f1e067382a2ff6e153f9a3f02fb9d277248cf1b06c0541feef3919d8813f18f54b25899d9d7f6e0651fcfeec7d98fee9300c404c8e04c0606712261d9f

Download Submit
C:\Users\Admin\Documents\83YXMwskFHfOxbgzO8AZO8lD.exe

MD5
abeea23c95c98bc3cbc6d9d4508a0a2f

SHA1
b9b202c2e2da2073b4e332a7401159118581d10c

SHA256
df7734cbb1baf26783f02249ac1b725286ae3709233cb3e78955cb6873597e6d

SHA512
6fb725f1e067382a2ff6e153f9a3f02fb9d277248cf1b06c0541feef3919d8813f18f54b25899d9d7f6e0651fcfeec7d98fee9300c404c8e04c0606712261d9f

Download Submit
C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe

MD5
e20eadf0f3063e0a73ca8569cd7c3c1b

SHA1
995b8fecebb1ff10f9f6571c73d1ea49d5722477

SHA256
81f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494

SHA512
d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef

Download Submit
C:\Users\Admin\Documents\8Jrxbt8BZTsIcHQ4WrXF_d4l.exe

MD5
e20eadf0f3063e0a73ca8569cd7c3c1b

SHA1
995b8fecebb1ff10f9f6571c73d1ea49d5722477

SHA256
81f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494

SHA512
d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef

Download Submit
C:\Users\Admin\Documents\8WuE_E2Anuiz3jSakPPUgElY.exe

MD5
07e143efd03815a3b8c8b90e7e5776f0

SHA1
077314efef70cef8f43eeba7f1b8ba0e5e5dedc9

SHA256
32967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149

SHA512
79ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6

Download Submit
C:\Users\Admin\Documents\8WuE_E2Anuiz3jSakPPUgElY.exe

MD5
07e143efd03815a3b8c8b90e7e5776f0

SHA1
077314efef70cef8f43eeba7f1b8ba0e5e5dedc9

SHA256
32967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149

SHA512
79ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6

Download Submit
C:\Users\Admin\Documents\BVoMx_fHQOJwEng3aOU2dT3Y.exe

MD5
4c91ebf5b18e08cf75fe9d7b567d4093

SHA1
f76f07af066f31f39e7723ee0a841a752767c23c

SHA256
26658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721

SHA512
cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3

Download Submit
C:\Users\Admin\Documents\BVoMx_fHQOJwEng3aOU2dT3Y.exe

MD5
4c91ebf5b18e08cf75fe9d7b567d4093

SHA1
f76f07af066f31f39e7723ee0a841a752767c23c

SHA256
26658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721

SHA512
cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3

Download Submit
C:\Users\Admin\Documents\Cp2xJsrZET8GjWBoFEOl7RV4.exe

MD5
823c77048c3f7be011e4d93d4dc2ef61

SHA1
3332f8fa4d32cfe9a10208b76dc2dcae72d17d50

SHA256
466509b591288569f8f011c920d17c5b07a2e61d9c774780123e064a26a1106a

SHA512
f151054e8b540e472aa0dcd66071e8693aaf67808f2bdbd65cac82c89f4556105524ba5281cdd9c4396f28538a30894d15db1e2cd9a6c2d61b0491e86d967bd0

Download Submit
C:\Users\Admin\Documents\Cp2xJsrZET8GjWBoFEOl7RV4.exe

MD5
823c77048c3f7be011e4d93d4dc2ef61

SHA1
3332f8fa4d32cfe9a10208b76dc2dcae72d17d50

SHA256
466509b591288569f8f011c920d17c5b07a2e61d9c774780123e064a26a1106a

SHA512
f151054e8b540e472aa0dcd66071e8693aaf67808f2bdbd65cac82c89f4556105524ba5281cdd9c4396f28538a30894d15db1e2cd9a6c2d61b0491e86d967bd0

Download Submit
C:\Users\Admin\Documents\EBzlFzw9fcVu3UrUqqxzRRn2.exe

MD5
fea6cce1b2e197cfd1fe8c91a006b098

SHA1
10e9b8b62a5f586101efeb362aca96ab8bd48b1e

SHA256
33900222ede7379c3b7b9a25b14370cc1d4e6cff50ce5b382e7abd5d196230a9

SHA512
df5e6d511b72e8a75bbff8a962f696bea82a61b9eb892102080a1912f3517bc1efd0459ce6f2d48a07261e31839eebd1e63ccd6b58d3bb94fe857640e456fb48

Download Submit
C:\Users\Admin\Documents\EBzlFzw9fcVu3UrUqqxzRRn2.exe

MD5
fea6cce1b2e197cfd1fe8c91a006b098

SHA1
10e9b8b62a5f586101efeb362aca96ab8bd48b1e

SHA256
33900222ede7379c3b7b9a25b14370cc1d4e6cff50ce5b382e7abd5d196230a9

SHA512
df5e6d511b72e8a75bbff8a962f696bea82a61b9eb892102080a1912f3517bc1efd0459ce6f2d48a07261e31839eebd1e63ccd6b58d3bb94fe857640e456fb48

Download Submit
C:\Users\Admin\Documents\HcbPd3mmnHLsHqf8rJNVbbu2.exe

MD5
e0ef2cfe575206c8a60ddba16c3be2f5

SHA1
2f86c600a2d7be4e36a7e23e94283fc38dd5b166

SHA256
dd38ee7be4658da5bd9cec0830fe7528d8d31ac62922519e5a503a6ec1ea84a7

SHA512
d2f0bd0878d1f9dc34d314b2dff919eae98166d3cb161154648e77f05ae9edb2c71b3fc1700fde12d377de38dacc2598d0ccc6d990160a75c5b9fee734ed068d

Download Submit
C:\Users\Admin\Documents\HcbPd3mmnHLsHqf8rJNVbbu2.exe

MD5
e0ef2cfe575206c8a60ddba16c3be2f5

SHA1
2f86c600a2d7be4e36a7e23e94283fc38dd5b166

SHA256
dd38ee7be4658da5bd9cec0830fe7528d8d31ac62922519e5a503a6ec1ea84a7

SHA512
d2f0bd0878d1f9dc34d314b2dff919eae98166d3cb161154648e77f05ae9edb2c71b3fc1700fde12d377de38dacc2598d0ccc6d990160a75c5b9fee734ed068d

Download Submit
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe

MD5
543ed8a17f16ce5b16b7c33702111dbf

SHA1
8a15f59cbc26b424cea2da8c8ca21fd1b468dc83

SHA256
b54dffe48f5ddc423d5f292363b29d5143e6f0f54120aea3208e067faff45457

SHA512
1d2068576cbe68ceec5a0cedda70e666fd50595f2c5ccad90631640d5371cb5107d128e1da2f84ad67dbcb909161688a0a0f3010a2bf7305af9ec97b44590358

Download Submit
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe

MD5
543ed8a17f16ce5b16b7c33702111dbf

SHA1
8a15f59cbc26b424cea2da8c8ca21fd1b468dc83

SHA256
b54dffe48f5ddc423d5f292363b29d5143e6f0f54120aea3208e067faff45457

SHA512
1d2068576cbe68ceec5a0cedda70e666fd50595f2c5ccad90631640d5371cb5107d128e1da2f84ad67dbcb909161688a0a0f3010a2bf7305af9ec97b44590358

Download Submit
C:\Users\Admin\Documents\KcUYEO15ww0qhkEHNMkS2Ybg.exe

MD5
5b4214fc265338a586eff675d1788501

SHA1
c67992c5e94b93f26d35f66962b041b07773ad88

SHA256
326f7ee9fda4f77be13c17bd65d619d46685b6fa5e54b412f4ba3571766bb7f1

SHA512
ee68178a16e85449e44806d3b5d11b7f36dceb74e93fe807c9f2c84e2e3eb0a36ce81555480ccbdbe226031a4909f1a857ee695a20b45cfd67f854c0ca380268

Download Submit
C:\Users\Admin\Documents\KcUYEO15ww0qhkEHNMkS2Ybg.exe

MD5
5b4214fc265338a586eff675d1788501

SHA1
c67992c5e94b93f26d35f66962b041b07773ad88

SHA256
326f7ee9fda4f77be13c17bd65d619d46685b6fa5e54b412f4ba3571766bb7f1

SHA512
ee68178a16e85449e44806d3b5d11b7f36dceb74e93fe807c9f2c84e2e3eb0a36ce81555480ccbdbe226031a4909f1a857ee695a20b45cfd67f854c0ca380268

Download Submit
C:\Users\Admin\Documents\N_QOenS05Z6BgOENGg7vcXbi.exe

MD5
d4b1e27b51dc3047544f19139dce37db

SHA1
efadb5d0e1ecba9ca1450eb7cfba3b4ae2ddfbf1

SHA256
6991ad4ba31e6336019960291df81ff545850ff9110b73bb57271b51ce7d6cd0

SHA512
58a65ff706712cd3991db429c2d4fc760d76c880aeb8a8dcf0c73981b6a0cee4f385f0e8ee1ce512f07532e105d2dd765871ebccd39025c1b491f159e0d17b9c

Download Submit
C:\Users\Admin\Documents\N_QOenS05Z6BgOENGg7vcXbi.exe

MD5
d4b1e27b51dc3047544f19139dce37db

SHA1
efadb5d0e1ecba9ca1450eb7cfba3b4ae2ddfbf1

SHA256
6991ad4ba31e6336019960291df81ff545850ff9110b73bb57271b51ce7d6cd0

SHA512
58a65ff706712cd3991db429c2d4fc760d76c880aeb8a8dcf0c73981b6a0cee4f385f0e8ee1ce512f07532e105d2dd765871ebccd39025c1b491f159e0d17b9c

Download Submit
C:\Users\Admin\Documents\Q72q8lQfHW00w2ocsoclB9A6.exe

MD5
0db231b7f88a5e504be112169b2db23c

SHA1
2f9b57cb508f1c1975bc6d81dc7206b028712f5c

SHA256
e4af9ad87285cbb3fa39686ac9ba1cd95b7ad4162c9d80208b4e037f26fd1142

SHA512
96a2d54bace8debc3a1a28123e1ab8bd766c8ea168a8debd4acef903a1009697ae0a8b517fb46498c41c32e7b8f9c58fbfd41b586e9e385f24ef376cbb219683

Download Submit
C:\Users\Admin\Documents\Q72q8lQfHW00w2ocsoclB9A6.exe

MD5
0db231b7f88a5e504be112169b2db23c

SHA1
2f9b57cb508f1c1975bc6d81dc7206b028712f5c

SHA256
e4af9ad87285cbb3fa39686ac9ba1cd95b7ad4162c9d80208b4e037f26fd1142

SHA512
96a2d54bace8debc3a1a28123e1ab8bd766c8ea168a8debd4acef903a1009697ae0a8b517fb46498c41c32e7b8f9c58fbfd41b586e9e385f24ef376cbb219683

Download Submit
C:\Users\Admin\Documents\UWFJm6dTX_pyGjfLcn9Gmq_u.exe

MD5
9f7ffe93e5dc8a48aafea53d1aa9f19c

SHA1
3ba62d6b6c4910a62cd9f21ea9db6f102a8786ce

SHA256
aa6af1494f0cc82afb1210aa5cbec5dcff97e925efbf7754b85c13d575a97331

SHA512
707ee40c34aedf50aac34c9d50cbc0cbb47dc04ab1c57ed43d37dc84c13c874494bc4781b2d7c11299c4346d2fcc71e24cb6a00eb9e2118107fc18ced4737a00

Download Submit
C:\Users\Admin\Documents\UWFJm6dTX_pyGjfLcn9Gmq_u.exe

MD5
9f7ffe93e5dc8a48aafea53d1aa9f19c

SHA1
3ba62d6b6c4910a62cd9f21ea9db6f102a8786ce

SHA256
aa6af1494f0cc82afb1210aa5cbec5dcff97e925efbf7754b85c13d575a97331

SHA512
707ee40c34aedf50aac34c9d50cbc0cbb47dc04ab1c57ed43d37dc84c13c874494bc4781b2d7c11299c4346d2fcc71e24cb6a00eb9e2118107fc18ced4737a00

Download Submit
C:\Users\Admin\Documents\aRm5KdqY7g33grRYOKMWqjfu.exe

MD5
3a5607baa5bb4afb138e73a37d858be5

SHA1
f87de54c680bb5b11bfe905c5e759cf54407d382

SHA256
2d59841b370bb7ee6d786b3413d8ea3a9f32cd9bb70d9d03a613eea2f48757e8

SHA512
354751b04ec934a4a2c1013b3e5b63d0ec8afddfd57d332a9203600e424404323b537c8bdbb03d9ea9169ea133b07cdbdef674c4aa10e73edcdc41c141f78561

Download Submit
C:\Users\Admin\Documents\aRm5KdqY7g33grRYOKMWqjfu.exe

MD5
3a5607baa5bb4afb138e73a37d858be5

SHA1
f87de54c680bb5b11bfe905c5e759cf54407d382

SHA256
2d59841b370bb7ee6d786b3413d8ea3a9f32cd9bb70d9d03a613eea2f48757e8

SHA512
354751b04ec934a4a2c1013b3e5b63d0ec8afddfd57d332a9203600e424404323b537c8bdbb03d9ea9169ea133b07cdbdef674c4aa10e73edcdc41c141f78561

Download Submit
C:\Users\Admin\Documents\avXopjlJVCYV9hnF1T5d1Zlk.exe

MD5
7411bd9a32735dfdeee38ee1f6629a7f

SHA1
5ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0

SHA256
18af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511

SHA512
806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb

Download Submit
C:\Users\Admin\Documents\avXopjlJVCYV9hnF1T5d1Zlk.exe

MD5
7411bd9a32735dfdeee38ee1f6629a7f

SHA1
5ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0

SHA256
18af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511

SHA512
806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb

Download Submit
C:\Users\Admin\Documents\avXopjlJVCYV9hnF1T5d1Zlk.exe

MD5
7411bd9a32735dfdeee38ee1f6629a7f

SHA1
5ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0

SHA256
18af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511

SHA512
806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb

Download Submit
C:\Users\Admin\Documents\bgyCNXIhUpksgKctPnpQB2rY.exe

MD5
8816bc1ddb91b48c35722cb8bdc67b34

SHA1
c0a64707d605ad2d4a2efc9f9d81425b4f272f93

SHA256
3c32618275afe05815eb28375526b10d4d049cc8b6d7c8d207fd1dc490edaec2

SHA512
c73fa40a8d8451c6c99cc74b440f4234f66c4898f3d0632460894e9531bafb26128bbccf9636e74321eb342cdb216a85f67030bf24b8affdc2323f27ed71ec83

Download Submit
C:\Users\Admin\Documents\bgyCNXIhUpksgKctPnpQB2rY.exe

MD5
8816bc1ddb91b48c35722cb8bdc67b34

SHA1
c0a64707d605ad2d4a2efc9f9d81425b4f272f93

SHA256
3c32618275afe05815eb28375526b10d4d049cc8b6d7c8d207fd1dc490edaec2

SHA512
c73fa40a8d8451c6c99cc74b440f4234f66c4898f3d0632460894e9531bafb26128bbccf9636e74321eb342cdb216a85f67030bf24b8affdc2323f27ed71ec83

Download Submit
C:\Users\Admin\Documents\di1B62jRZ3lJK4FH_65vYtnD.exe

MD5
30b21677cf7a267da2ef6daff813d054

SHA1
96e85b3a93eee8411bedec902cc30c7f378966c6

SHA256
98b5264d43dd36905b4383d8851a97d54fd985713885f6a17edf0b10b6737172

SHA512
0fbf3300f49bae958888629e96aad695a8b914644d295341e4ef8d3728b7cc77ed9f36d789fa09ba93b08d78c71dd8e4c26aa87204680516f0a9477936dc2c7f

Download Submit
C:\Users\Admin\Documents\di1B62jRZ3lJK4FH_65vYtnD.exe

MD5
30b21677cf7a267da2ef6daff813d054

SHA1
96e85b3a93eee8411bedec902cc30c7f378966c6

SHA256
98b5264d43dd36905b4383d8851a97d54fd985713885f6a17edf0b10b6737172

SHA512
0fbf3300f49bae958888629e96aad695a8b914644d295341e4ef8d3728b7cc77ed9f36d789fa09ba93b08d78c71dd8e4c26aa87204680516f0a9477936dc2c7f

Download Submit
C:\Users\Admin\Documents\fjo4nAaO2gvIKhsvTgHC1mEr.exe

MD5
f448dc6cef9ef44bb1a801940346978c

SHA1
5938e68f3d6570bc98b4b1db92359be0aaf1e0d1

SHA256
220851257d5feacfef6a9cd9a3a46e8d6935199611f7a93387c740c543789bfe

SHA512
4a518bf0d873e1a7d3796b6acb731ef69285346e5699dc39365f6fac14193f5fb34b02a6bed7b8b909a09fdfe1919af1f26495e14d1c21b7273b449bb928c426

Download Submit
C:\Users\Admin\Documents\lnQ5wXdnTzqWKrLrsoNktHaP.exe

MD5
82847b456708d7b247a771b31ce45c29

SHA1
cd2ffdf128c4856ec81e17414bb5a44cdf592f64

SHA256
5804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a

SHA512
c2318dc1a2caa256296c0f73690bb00de46bff9ee38f7a3e8f54d37e62e0cae33981217301d5188b4b6403e538fd30d5a61b6c242f58d89a05f7a59225be11f4

Download Submit
C:\Users\Admin\Documents\lnQ5wXdnTzqWKrLrsoNktHaP.exe

MD5
82847b456708d7b247a771b31ce45c29

SHA1
cd2ffdf128c4856ec81e17414bb5a44cdf592f64

SHA256
5804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a

SHA512
c2318dc1a2caa256296c0f73690bb00de46bff9ee38f7a3e8f54d37e62e0cae33981217301d5188b4b6403e538fd30d5a61b6c242f58d89a05f7a59225be11f4

Download Submit
C:\Users\Admin\Documents\vfo107HGtIGH8IkSOABOKAu1.exe

MD5
df4af06566b11749aeccd17f1d0801f5

SHA1
ae2d5280d92c8a8a1c74e3e1816aeae58f88c0df

SHA256
c8c136d959b8815ef99e16640525758e0ed9a5596275f056735752b351ae5972

SHA512
2bdee0b8032dcbea44b924328a17b806c73167d3ff10b3391595aef0022a519ae2582ac3081b744175a95b295d256eea7b9618155d8da5db6fd99191b6cc413c

Download Submit
C:\Users\Admin\Documents\vfo107HGtIGH8IkSOABOKAu1.exe

MD5
df4af06566b11749aeccd17f1d0801f5

SHA1
ae2d5280d92c8a8a1c74e3e1816aeae58f88c0df

SHA256
c8c136d959b8815ef99e16640525758e0ed9a5596275f056735752b351ae5972

SHA512
2bdee0b8032dcbea44b924328a17b806c73167d3ff10b3391595aef0022a519ae2582ac3081b744175a95b295d256eea7b9618155d8da5db6fd99191b6cc413c

Download Submit
C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe

MD5
f8e06127587d7f6fbf8732db00f4659f

SHA1
4be879b7e2f90a2194852acfb532809acbc603e9

SHA256
dd97eae143c908e3c23af132a0abbeda0f19f6c658dbb10ab0a7e64093ca92de

SHA512
262bf2302dcb2f84e172b2eeb5b2b0a37b582a99694cbe5ae24b8d7a932b3d1d34f88e1f0d64207d64c5897781b8836e721b6632f259b9d06c6a3dc975611f16

Download Submit
C:\Users\Admin\Documents\wEzNj4RHYjtVPR9oDYR5v_c2.exe

MD5
f8e06127587d7f6fbf8732db00f4659f

SHA1
4be879b7e2f90a2194852acfb532809acbc603e9

SHA256
dd97eae143c908e3c23af132a0abbeda0f19f6c658dbb10ab0a7e64093ca92de

SHA512
262bf2302dcb2f84e172b2eeb5b2b0a37b582a99694cbe5ae24b8d7a932b3d1d34f88e1f0d64207d64c5897781b8836e721b6632f259b9d06c6a3dc975611f16

Download Submit
C:\Users\Admin\Documents\ylFuuRO65UDYhYtJH1iLXAW3.exe

MD5
32aaa600cfa3f939c88e1387410e295b

SHA1
b4b41a1733bb69a157127307eba173307fb41f78

SHA256
2197f0b8ea5b4675ce7e1b0393c51491fa83ec33a36fbea464bde63e2c0e35be

SHA512
e811a1340e4f1866bf39338cdd3efdbfd6ef70928b65b02f5fd91c7ac556faa484a276f92d041329cb63d5836b729318058de74685343dcc51b185e809e3b4fa

Download Submit
C:\Users\Admin\Documents\ylFuuRO65UDYhYtJH1iLXAW3.exe

MD5
32aaa600cfa3f939c88e1387410e295b

SHA1
b4b41a1733bb69a157127307eba173307fb41f78

SHA256
2197f0b8ea5b4675ce7e1b0393c51491fa83ec33a36fbea464bde63e2c0e35be

SHA512
e811a1340e4f1866bf39338cdd3efdbfd6ef70928b65b02f5fd91c7ac556faa484a276f92d041329cb63d5836b729318058de74685343dcc51b185e809e3b4fa

Download Submit
memory/476-414-0x0000000000000000-mapping.dmp

Download
memory/476-469-0x0000000005810000-0x0000000005E28000-memory.dmp

Filesize
6.1MB

Download
memory/660-291-0x0000000000000000-mapping.dmp

Download
memory/660-301-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/660-315-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/660-390-0x000000001B450000-0x000000001B452000-memory.dmp

Filesize
8KB

Download
memory/660-345-0x0000000000EC0000-0x0000000000EF2000-memory.dmp

Filesize
200KB

Download
memory/1012-506-0x0000000005160000-0x0000000005778000-memory.dmp

Filesize
6.1MB

Download
memory/1012-475-0x0000000000000000-mapping.dmp

Download
memory/1112-202-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Filesize
572KB

Download
memory/1112-147-0x0000000000000000-mapping.dmp

Download
memory/1116-217-0x0000000004750000-0x0000000005076000-memory.dmp

Filesize
9.1MB

Download
memory/1116-165-0x0000000000000000-mapping.dmp

Download
memory/1172-443-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/1172-312-0x0000000000000000-mapping.dmp

Download
memory/1184-148-0x0000000000000000-mapping.dmp

Download
memory/1500-164-0x0000000000000000-mapping.dmp

Download
memory/1500-542-0x0000000000000000-mapping.dmp

Download
memory/1500-204-0x0000000002280000-0x00000000022AF000-memory.dmp

Filesize
188KB

Download
memory/1676-257-0x0000000000890000-0x000000000091E000-memory.dmp

Filesize
568KB

Download
memory/1676-150-0x0000000000000000-mapping.dmp

Download
memory/1788-340-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1788-339-0x0000000000000000-mapping.dmp

Download
memory/1788-357-0x0000000004FD0000-0x00000000055E8000-memory.dmp

Filesize
6.1MB

Download
memory/1808-349-0x0000000000000000-mapping.dmp

Download
memory/1808-376-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/1872-502-0x0000000005260000-0x0000000005878000-memory.dmp

Filesize
6.1MB

Download
memory/1872-462-0x0000000000000000-mapping.dmp

Download
memory/2472-370-0x0000000000000000-mapping.dmp

Download
memory/2488-149-0x0000000000000000-mapping.dmp

Download
memory/2488-254-0x0000000002CE0000-0x0000000002D0F000-memory.dmp

Filesize
188KB

Download
memory/2508-398-0x0000000000000000-mapping.dmp

Download
memory/2508-479-0x000000001B500000-0x000000001B502000-memory.dmp

Filesize
8KB

Download
memory/2568-303-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/2568-318-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download
memory/2568-334-0x0000000005B50000-0x0000000005B51000-memory.dmp

Filesize
4KB

Download
memory/2568-260-0x00000000031C0000-0x00000000031FC000-memory.dmp

Filesize
240KB

Download
memory/2568-327-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/2568-335-0x0000000005B60000-0x0000000005B61000-memory.dmp

Filesize
4KB

Download
memory/2568-289-0x0000000005A70000-0x0000000005A71000-memory.dmp

Filesize
4KB

Download
memory/2568-249-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2568-333-0x0000000005B40000-0x0000000005B41000-memory.dmp

Filesize
4KB

Download
memory/2568-292-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/2568-297-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Filesize
4KB

Download
memory/2568-325-0x0000000005B10000-0x0000000005B11000-memory.dmp

Filesize
4KB

Download
memory/2568-310-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/2568-293-0x0000000005A90000-0x0000000005A91000-memory.dmp

Filesize
4KB

Download
memory/2568-314-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/2568-331-0x0000000005B30000-0x0000000005B31000-memory.dmp

Filesize
4KB

Download
memory/2568-300-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Filesize
4KB

Download
memory/2568-281-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/2568-278-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/2568-307-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download
memory/2568-234-0x0000000000000000-mapping.dmp

Download
memory/2604-391-0x0000000000000000-mapping.dmp

Download
memory/2604-463-0x00000000058B0000-0x0000000005EC8000-memory.dmp

Filesize
6.1MB

Download
memory/2624-231-0x0000000000000000-mapping.dmp

Download
memory/2624-243-0x0000000000D20000-0x0000000000D30000-memory.dmp

Filesize
64KB

Download
memory/2624-245-0x0000000000D40000-0x0000000000D52000-memory.dmp

Filesize
72KB

Download
memory/2824-402-0x0000000000000000-mapping.dmp

Download
memory/2880-382-0x0000000000000000-mapping.dmp

Download
memory/2880-440-0x0000000004E40000-0x0000000005458000-memory.dmp

Filesize
6.1MB

Download
memory/2896-163-0x0000000000000000-mapping.dmp

Download
memory/2896-256-0x0000000002D00000-0x0000000002D4A000-memory.dmp

Filesize
296KB

Download
memory/2984-214-0x0000000002370000-0x00000000023A0000-memory.dmp

Filesize
192KB

Download
memory/2984-160-0x0000000000000000-mapping.dmp

Download
memory/3096-228-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3096-221-0x0000000000000000-mapping.dmp

Download
memory/3120-242-0x0000000000000000-mapping.dmp

Download
memory/3180-328-0x0000000001660000-0x0000000001661000-memory.dmp

Filesize
4KB

Download
memory/3180-302-0x0000000000000000-mapping.dmp

Download
memory/3180-313-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/3424-261-0x0000000000000000-mapping.dmp

Download
memory/3544-159-0x0000000000000000-mapping.dmp

Download
memory/3564-146-0x00000000043F0000-0x000000000452F000-memory.dmp

Filesize
1.2MB

Download
memory/3704-220-0x0000000000BE0000-0x0000000000BF6000-memory.dmp

Filesize
88KB

Download
memory/3704-229-0x000000001B190000-0x000000001B192000-memory.dmp

Filesize
8KB

Download
memory/3704-166-0x0000000000000000-mapping.dmp

Download
memory/3704-201-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/3888-161-0x0000000000000000-mapping.dmp

Download
memory/3904-232-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/3904-215-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/3904-238-0x0000000005880000-0x00000000058F6000-memory.dmp

Filesize
472KB

Download
memory/3904-152-0x0000000000000000-mapping.dmp

Download
memory/3904-225-0x0000000005900000-0x0000000005901000-memory.dmp

Filesize
4KB

Download
memory/4004-337-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/4004-434-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/4004-341-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/4004-317-0x0000000000000000-mapping.dmp

Download
memory/4116-401-0x0000000000000000-mapping.dmp

Download
memory/4120-262-0x0000000000000000-mapping.dmp

Download
memory/4120-273-0x00000000007C0000-0x00000000007C3000-memory.dmp

Filesize
12KB

Download
memory/4188-474-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/4188-324-0x0000000000000000-mapping.dmp

Download
memory/4192-268-0x0000000000000000-mapping.dmp

Download
memory/4192-347-0x0000000003C00000-0x0000000003D3F000-memory.dmp

Filesize
1.2MB

Download
memory/4292-649-0x000000001B580000-0x000000001B582000-memory.dmp

Filesize
8KB

Download
memory/4364-343-0x0000000000000000-mapping.dmp

Download
memory/4364-374-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/4400-388-0x0000000000000000-mapping.dmp

Download
memory/4488-251-0x0000000000000000-mapping.dmp

Download
memory/4528-276-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download
memory/4528-283-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/4528-282-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/4528-158-0x0000000000000000-mapping.dmp

Download
memory/4528-279-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/4528-320-0x0000000005C30000-0x0000000005C31000-memory.dmp

Filesize
4KB

Download
memory/4528-270-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/4528-296-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

Filesize
4KB

Download
memory/4528-267-0x0000000005E20000-0x0000000005E21000-memory.dmp

Filesize
4KB

Download
memory/4528-285-0x00000000066D0000-0x00000000066D1000-memory.dmp

Filesize
4KB

Download
memory/4528-248-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/4536-157-0x0000000000000000-mapping.dmp

Download
memory/4536-203-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/4536-230-0x000000001AF10000-0x000000001AF12000-memory.dmp

Filesize
8KB

Download
memory/4536-222-0x0000000000840000-0x0000000000858000-memory.dmp

Filesize
96KB

Download
memory/4540-216-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4540-154-0x0000000000000000-mapping.dmp

Download
memory/4540-239-0x0000000004B80000-0x0000000004BF6000-memory.dmp

Filesize
472KB

Download
memory/4544-155-0x0000000000000000-mapping.dmp

Download
memory/4808-162-0x0000000000000000-mapping.dmp

Download
memory/4932-255-0x0000000002DD0000-0x0000000002EA3000-memory.dmp

Filesize
844KB

Download
memory/4932-153-0x0000000000000000-mapping.dmp

Download
memory/4948-271-0x0000000000000000-mapping.dmp

Download
memory/4952-275-0x0000000000000000-mapping.dmp

Download
memory/5012-344-0x0000000000930000-0x0000000000962000-memory.dmp

Filesize
200KB

Download
memory/5012-330-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/5012-299-0x0000000000000000-mapping.dmp

Download
memory/5012-393-0x000000001AEC0000-0x000000001AEC2000-memory.dmp

Filesize
8KB

Download
memory/5012-311-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/5032-244-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/5032-287-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/5032-151-0x0000000000000000-mapping.dmp

Download
memory/5044-156-0x0000000000000000-mapping.dmp

Download
memory/5100-377-0x0000000000000000-mapping.dmp

Download
memory/5112-288-0x0000000000000000-mapping.dmp

Download
memory/5308-483-0x0000000000000000-mapping.dmp

Download
memory/5340-488-0x0000000000000000-mapping.dmp

Download
memory/5364-511-0x0000000000000000-mapping.dmp

Download
memory/5364-552-0x0000000005150000-0x0000000005768000-memory.dmp

Filesize
6.1MB

Download
memory/5388-601-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/5388-556-0x0000000000000000-mapping.dmp

Download
memory/5396-594-0x0000000000000000-mapping.dmp

Download
memory/5396-630-0x0000000005600000-0x0000000005C18000-memory.dmp

Filesize
6.1MB

Download
memory/5584-524-0x0000000000000000-mapping.dmp

Download
memory/5584-568-0x0000000004E40000-0x0000000005458000-memory.dmp

Filesize
6.1MB

Download
memory/5724-512-0x0000000000000000-mapping.dmp

Download
memory/5724-571-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/5784-543-0x0000000000000000-mapping.dmp

Download
memory/5784-576-0x0000000005750000-0x0000000005D68000-memory.dmp

Filesize
6.1MB

Download
memory/5920-645-0x00000000007C0000-0x00000000007C3000-memory.dmp

Filesize
12KB

Download
memory/5924-580-0x000000001B4D0000-0x000000001B4D2000-memory.dmp

Filesize
8KB

Download
memory/5924-523-0x0000000000000000-mapping.dmp

Download
memory/6012-603-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/6012-531-0x0000000000000000-mapping.dmp

Download
memory/6072-574-0x0000000000000000-mapping.dmp

Download
memory/6072-607-0x00000000053D0000-0x00000000059E8000-memory.dmp

Filesize
6.1MB

Download
memory/6092-533-0x0000000000000000-mapping.dmp

Download