cerber | hxxps://goo[.]su/5WBEji

Resubmissions

10-03-2024 06:47

240310-hkqc9aef53 9

10-03-2024 06:41

10-03-2024 06:40

10-03-2024 06:37

10-03-2024 06:31

Analysis

max time kernel
252s
max time network
259s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://goo.su/5WBEji

Score

10^/10

cerber evasion ransomware spyware stealer upx

Malware Config

Signatures

Cerber 60 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	pid	Process
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		1932	taskkill.exe
		7772	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		7500	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		6212	taskkill.exe
		4932	taskkill.exe
		5712	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		5756	taskkill.exe
		5136	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		8136	taskkill.exe
		5984	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		8016	taskkill.exe
		6748	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		3696	taskkill.exe
		7796	taskkill.exe
		8164	taskkill.exe
		7644	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		7232	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		6796	taskkill.exe
		7980	taskkill.exe
		432	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		7884	taskkill.exe
		2152	taskkill.exe
		5168	taskkill.exe
		3224	taskkill.exe
		3240	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		6956	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
		7968	taskkill.exe
		3444	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		tool.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 64 IoCs

pid	Process
7640	batbox.exe
6048	colorecho-vc10-x86_64.exe
7320	GetInput.exe
6872	Volumeid64.exe
6476	ОСНОВА 1.exe
2428	colorecho-vc10-x86_64.exe
5632	batbox.exe
3136	batbox.exe
6468	GetInput.exe
6456	ОСНОВА 1.exe
8028	colorecho-vc10-x86_64.exe
7200	batbox.exe
5760	batbox.exe
7732	GetInput.exe
6492	apex.exe
2424	extd.exe
7392	lgsvcl.exe
6172	ОСНОВА 2.exe
4516	extd.exe
2392	extd.exe
1640	extd.exe
6600	load.exe
5640	tool.exe
7668	tool.exe
4988	tool.exe
1600	tool.exe
4672	tool.exe
7468	tool.exe
7184	tool.exe
6960	tool.exe
4568	tool.exe
7428	tool.exe
3172	tool.exe
3364	tool.exe
2720	valorant_cleaner.exe
6552	tool.exe
1888	tool.exe
6944	tool.exe
7244	tool.exe
7056	mac.exe
6472	struct.exe
7916	lgsvcl.exe
6848	public.exe
6300	os_cleaner_two.exe
7288	os_cleaner_one.exe
7900	extd.exe
5884	extd.exe
6188	lgsvcl.exe
1156	extd.exe
6440	extd.exe
6796	load.exe
184	tool.exe
3380	tool.exe
7948	tool.exe
5004	tool.exe
4552	tool.exe
7508	tool.exe
808	tool.exe
4248	tool.exe
3720	tool.exe
2796	tool.exe
7880	tool.exe
6916	tool.exe
5828	tool.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2424-522-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2424-523-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/4516-559-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/2392-563-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/1640-564-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/files/0x000300000001d9ee-583.dat	upx
behavioral1/memory/7900-594-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/5884-596-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/1156-599-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/1156-600-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/6440-601-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/6440-602-0x0000000140000000-0x00000001400D8000-memory.dmp	upx
behavioral1/memory/1392-606-0x0000000140000000-0x00000001400D8000-memory.dmp	upx

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7320	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
4640	timeout.exe
6216	timeout.exe
4496	timeout.exe
8020	timeout.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	os_cleaner_one.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	os_cleaner_one.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	os_cleaner_one.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "35198458-4d790dc3-5"	os_cleaner_one.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	os_cleaner_one.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	os_cleaner_one.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	os_cleaner_one.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
7888	vssadmin.exe

Kills process with taskkill 29 IoCs

evasion

pid	Process
7644	taskkill.exe
5756	taskkill.exe
5712	taskkill.exe
4932	taskkill.exe
3224	taskkill.exe
3696	taskkill.exe
3444	taskkill.exe
6796	taskkill.exe
7796	taskkill.exe
5168	taskkill.exe
6212	taskkill.exe
8016	taskkill.exe
3240	taskkill.exe
7968	taskkill.exe
7884	taskkill.exe
7980	taskkill.exe
6748	taskkill.exe
5984	taskkill.exe
5136	taskkill.exe
2152	taskkill.exe
7772	taskkill.exe
1932	taskkill.exe
432	taskkill.exe
8136	taskkill.exe
6956	taskkill.exe
1092	taskkill.exe
7232	taskkill.exe
8164	taskkill.exe
7500	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Migration\IE Installed Date = 1b2b94bb8a03d9c5	os_cleaner_one.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133545259569399285"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	chrome.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
6888	PING.EXE
6752	PING.EXE

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
5020	chrome.exe
5020	chrome.exe
8172	taskmgr.exe
8172	taskmgr.exe
7288	os_cleaner_one.exe
7288	os_cleaner_one.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe

Suspicious behavior: LoadsDriver 32 IoCs

pid	Process
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe
8172	taskmgr.exe

Suspicious use of SetWindowsHookEx 50 IoCs

pid	Process
6476	ОСНОВА 1.exe
6456	ОСНОВА 1.exe
6492	apex.exe
6172	ОСНОВА 2.exe
4516	extd.exe
2392	extd.exe
1640	extd.exe
6600	load.exe
5640	tool.exe
7668	tool.exe
4988	tool.exe
1600	tool.exe
4672	tool.exe
7468	tool.exe
7184	tool.exe
6960	tool.exe
4568	tool.exe
7428	tool.exe
3172	tool.exe
3364	tool.exe
6552	tool.exe
1888	tool.exe
6944	tool.exe
7244	tool.exe
7056	mac.exe
6472	struct.exe
6300	os_cleaner_two.exe
7288	os_cleaner_one.exe
7900	extd.exe
1156	extd.exe
6440	extd.exe
6796	load.exe
184	tool.exe
3380	tool.exe
7948	tool.exe
5004	tool.exe
4552	tool.exe
7508	tool.exe
808	tool.exe
4248	tool.exe
3720	tool.exe
2796	tool.exe
7880	tool.exe
6916	tool.exe
5828	tool.exe
7652	tool.exe
828	tool.exe
4988	tool.exe
1392	extd.exe
6396	apex.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2768	4556	chrome.exe	87
PID 4556 wrote to memory of 2768	4556	chrome.exe	87
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 4680	4556	chrome.exe	90
PID 4556 wrote to memory of 2332	4556	chrome.exe	91
PID 4556 wrote to memory of 2332	4556	chrome.exe	91
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92
PID 4556 wrote to memory of 1680	4556	chrome.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://goo.su/5WBEji
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb92b9758,0x7ffcb92b9768,0x7ffcb92b9778
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4692 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5272 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5620 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=6092 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4852 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=6112 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5760 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6472 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6592 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6672 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6676 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6840 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6856 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6872 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6888 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6904 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6928 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=8080 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=7840 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=8420 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=8444 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=8460 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=8468 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=9060 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=9200 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=9352 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=9512 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=9520 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=9792 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=9796 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=9964 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=10216 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=10360 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=10516 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8804 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=8012 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=9560 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=9360 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=8276 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=10840 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=8320 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=11020 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=11416 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=11516 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=11012 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=9228 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=11552 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=11708 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:7824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9840 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:8
  2⤵
  PID:6624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=11548 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:1
  2⤵
  PID:6340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=948 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:8
  2⤵
  PID:8148
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ZelenkaBannedBoys.rar"
  2⤵
  PID:8156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 --field-trial-handle=1872,i,4401530379356950457,7426956055917680635,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4196

C:\Users\Admin\Desktop\ZelenkaBannedBoys\batbox.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\batbox.exe"
1⤵
- Executes dropped EXE
PID:7640

C:\Users\Admin\Desktop\ZelenkaBannedBoys\colorecho-vc10-x86_64.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\colorecho-vc10-x86_64.exe"
1⤵
- Executes dropped EXE
PID:6048

C:\Users\Admin\Desktop\ZelenkaBannedBoys\GetInput.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\GetInput.exe"
1⤵
- Executes dropped EXE
PID:7320

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Volumeid64.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Volumeid64.exe"
1⤵
- Executes dropped EXE
PID:6872

C:\Users\Admin\Desktop\ZelenkaBannedBoys\ОСНОВА 1.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\ОСНОВА 1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6476
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\939.tmp\93A.tmp\93B.bat "C:\Users\Admin\Desktop\ZelenkaBannedBoys\ОСНОВА 1.exe""
  2⤵
  PID:5132
- - C:\Windows\system32\mode.com
    mode 80,20
    3⤵
    PID:6692
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:6888
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\colorecho-vc10-x86_64.exe
    colorecho-vc10-x86_64.exe " Monotone" 1
    3⤵
    - Executes dropped EXE
    PID:2428
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\batbox.exe
    batbox /c 0xf0 /g 21 17 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /g 21 16 /a 32 /d " " /a 32 /g 21 15 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /c 0x07
    3⤵
    - Executes dropped EXE
    PID:5632
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\batbox.exe
    Batbox /g 23 16 /c 0xf0 /d " Enter " /c 0x07
    3⤵
    - Executes dropped EXE
    PID:3136
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\GetInput.exe
    GetInput /M 21 15 39 17 /H 70 70
    3⤵
    - Executes dropped EXE
    PID:6468

C:\Users\Admin\Desktop\ZelenkaBannedBoys\ОСНОВА 1.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\ОСНОВА 1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6456
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2145.tmp\2146.tmp\2147.bat "C:\Users\Admin\Desktop\ZelenkaBannedBoys\ОСНОВА 1.exe""
  2⤵
  PID:6484
- - C:\Windows\system32\mode.com
    mode 80,20
    3⤵
    PID:2028
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:6752
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\colorecho-vc10-x86_64.exe
    colorecho-vc10-x86_64.exe " Monotone" 1
    3⤵
    - Executes dropped EXE
    PID:8028
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\batbox.exe
    batbox /c 0xf0 /g 21 17 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /g 21 16 /a 32 /d " " /a 32 /g 21 15 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /c 0x07
    3⤵
    - Executes dropped EXE
    PID:7200
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\batbox.exe
    Batbox /g 23 16 /c 0xf0 /d " Enter " /c 0x07
    3⤵
    - Executes dropped EXE
    PID:5760
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\GetInput.exe
    GetInput /M 21 15 39 17 /H 70 70
    3⤵
    - Executes dropped EXE
    PID:7732

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\apex.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\apex.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6492
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\34FC.tmp\34FD.tmp\34FE.bat "C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\apex.exe""
  2⤵
  PID:6496
- - C:\Windows\system32\timeout.exe
    timeout /t 02
    3⤵
    - Delays execution with timeout.exe
    PID:8020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im smartscreen.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:7796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:5756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im dnf.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:7232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im DNF.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:4932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im CrossProxy.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:8136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im tensafe_1.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:6956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im TenSafe_1.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:1932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im tensafe_2.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:3224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im tencentdl.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:3696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im TenioDL.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:7980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im uishell.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:3444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BackgroundDownloader.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:6748
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im conime.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:5984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im QQDL.EXE
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:5168
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im qqlogin.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:6212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im dnfchina.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:5136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im dnfchinatest.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:6796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im dnf.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:8016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im txplatform.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:8164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im TXPlatform.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:432
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginWebHelperService.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:2152
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Origin.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:3240
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginClientService.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:5712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginER.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:7968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginThinSetupInternal.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:7644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OriginLegacyCLI.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:7772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Agent.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:7884
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Client.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:7500
- - C:\Windows\system32\sc.exe
    Sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:7320
- - C:\Windows\system32\timeout.exe
    timeout /t 02
    3⤵
    - Delays execution with timeout.exe
    PID:4640

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\extd.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\extd.exe"
1⤵
- Executes dropped EXE
PID:2424

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\lgsvcl.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\lgsvcl.exe"
1⤵
- Executes dropped EXE
PID:7392

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\ОСНОВА 2.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\ОСНОВА 2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6172
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4DC3.tmp\4DC4.tmp\4DC5.bat "C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\ОСНОВА 2.exe""
  2⤵
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\4DC3.tmp\4DC4.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\4DC3.tmp\4DC4.tmp\extd.exe "/getconsoletitle" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\4DC3.tmp\4DC4.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\4DC3.tmp\4DC4.tmp\extd.exe "/resizewindow" "C:\Users\Admin\Desktop\ZelenkaBannedBoys\?????? 2\?????? 2.exe" "0" "0" "1129" "520" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\4DC3.tmp\4DC4.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\4DC3.tmp\4DC4.tmp\extd.exe "/center" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1640
- - C:\Users\Admin\AppData\Roaming\dump\load.exe
    "load.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6600
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\515D.tmp\515E.tmp\515F.bat C:\Users\Admin\AppData\Roaming\dump\load.exe"
      4⤵
      PID:2512
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SM "System manufacturer"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5640
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SP "System Product Name"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7668
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SV "System Version"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SS "System Serial Number"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SU "AUTO"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SK "SKU"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7468
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SF "To be filled by O.E.M."
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7184
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /BS 221751522927704
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6960
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /BT "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4568
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /BLC "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7428
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CM "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3172
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CV "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3364
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CS "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6552
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CA "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CSK "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6944
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /PSN 285321923922216
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7244
- - C:\Users\Admin\AppData\Roaming\dump\mac.exe
    "mac.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:7056
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\61C8.tmp\61C9.tmp\61CA.bat C:\Users\Admin\AppData\Roaming\dump\mac.exe"
      4⤵
      PID:7592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
        5⤵
        
        PID:7604
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        6⤵
        
        PID:6444
      - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        6⤵
        
        PID:2912
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
        5⤵
        
        PID:6608
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
        5⤵
        
        PID:2428
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
        5⤵
        
        PID:5632
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 9EBA649FA44A /f
        5⤵
        
        PID:2704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
        5⤵
        
        PID:7580
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        6⤵
        
        PID:8152
      - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        6⤵
        
        PID:4396
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
        5⤵
        
        PID:7520
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
        5⤵
        
        PID:2028
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
        5⤵
        
        PID:6760
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
        5⤵
        
        PID:7228

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\valorant_cleaner.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\valorant_cleaner.exe"
1⤵
- Executes dropped EXE
PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:7740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /s /q C:\Users\%username%\AppData\Local\VALORANT
  2⤵
  PID:5200

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\struct.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\struct.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6472
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\63AD.tmp\63AE.tmp\63AF.bat "C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\struct.exe""
  2⤵
  PID:7712
- - C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\lgsvcl.exe
    lgsvcl.exe -prv 25 -scv 4 -drvn edrv -map C:\Windows\Fonts\4138.sys
    3⤵
    - Executes dropped EXE
    PID:7916
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:6216

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\public.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\public.exe"
1⤵
- Executes dropped EXE
PID:6848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 0a
  2⤵
  PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /s /q C:\Users\%username%\AppData\Local\VALORANT
  2⤵
  PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /s /q C:\Users\%username%\AppData\Local\Riot Games
  2⤵
  PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /s /q C:\ProgramData\Riot Games
  2⤵
  PID:7628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /s /q C:\Users\%username%\AppData\Local\Riot Games
  2⤵
  PID:6788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ExplorerHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Riot Game valorant.live
  2⤵
  PID:7520
- - C:\Windows\system32\reg.exe
    reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ExplorerHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Riot Game valorant.live
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\system(_xor_\CurrentControlSet\Services\vgk\Security /f
  2⤵
  PID:7736
- - C:\Windows\system32\reg.exe
    reg delete HKEY_LOCAL_MACHINE\system(_xor_\CurrentControlSet\Services\vgk\Security /f
    3⤵
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\system(_xor_\CurrentControlSet\Services\vgc\Security /f
  2⤵
  PID:7708
- - C:\Windows\system32\reg.exe
    reg delete HKEY_LOCAL_MACHINE\system(_xor_\CurrentControlSet\Services\vgc\Security /f
    3⤵
    PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Riot Vangard /f
  2⤵
  PID:5752
- - C:\Windows\system32\reg.exe
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Riot Vangard /f
    3⤵
    PID:7056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\VALORANT - Win64 - Shipping.ex /f
  2⤵
  PID:6856
- - C:\Windows\system32\reg.exe
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\VALORANT - Win64 - Shipping.ex /f
    3⤵
    PID:7396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist /f
  2⤵
  PID:424
- - C:\Windows\system32\reg.exe
    reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist /f
    3⤵
    PID:6504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKEY_CLASSES_ROOT\riotclient /f
  2⤵
  PID:1896
- - C:\Windows\system32\reg.exe
    reg delete HKEY_CLASSES_ROOT\riotclient /f
    3⤵
    PID:8184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\Users\%username%\AppData\Local\VALORANT
  2⤵
  PID:6172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\Riot Games
  2⤵
  PID:8004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\ProgramData\Riot Games
  2⤵
  PID:7196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\ProgramData\Application Data\Riot Games
  2⤵
  PID:6620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\Program Files\Riot Vangard
  2⤵
  PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\Program Files\Riot Games
  2⤵
  PID:7572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\Documents and Settings\All Users\Riot Games
  2⤵
  PID:8148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Riot Games
  2⤵
  PID:6424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RMDIR /S /Q C:\Users\%username%\Local Settings\Riot Games
  2⤵
  PID:4072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games\VALORANT.lnk
  2⤵
  PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Riot Games\VALORANT\live\Manifest_NonFSFiles_Win64.txt /f /q
  2⤵
  PID:6260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Riot Games\VALORANT\live\Engine\Binaries\ThirdParty\CEF3\Win64\icdtl.dat /f /q
  2⤵
  PID:4008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Riot Games\Riot Client\X\natives_blob.bin /f /q
  2⤵
  PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Riot Games\Riot Client\X\icdtl.dat /f /q
  2⤵
  PID:7348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Riot Games\Riot Client\X\Plgins\plgin - manifest.json /f /q
  2⤵
  PID:7388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /s /q C:\Windows\vgkbootstats.dat
  2⤵
  PID:2004

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\os_cleaner_two.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\os_cleaner_two.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6300
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\714B.bat "C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\os_cleaner_two.exe""
  2⤵
  PID:6956
- - C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe "/getconsoletitle" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:7900
- - C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe "/resizewindow" "C:\Users\Admin\Desktop\ZelenkaBannedBoys\?????? 2\os_cleaner_two.exe" "0" "0" "1129" "520" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe "/center" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6440
- - C:\Users\Admin\AppData\Roaming\dump\load.exe
    "load.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6796
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ACEB.tmp\ACEC.tmp\ACED.bat C:\Users\Admin\AppData\Roaming\dump\load.exe"
      4⤵
      PID:1220
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SM "System manufacturer"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:184
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SP "System Product Name"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3380
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SV "System Version"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7948
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SS "System Serial Number"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SU "AUTO"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4552
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SK "SKU"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7508
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /SF "To be filled by O.E.M."
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:808
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /BS 222531104730460
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4248
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /BT "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /BLC "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CM "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7880
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CV "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6916
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CS "Default string"
        5⤵
        Cerber
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5828
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CA "Default string"
        5⤵
        Cerber
        Suspicious use of SetWindowsHookEx
        
        PID:7652
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /CSK "Default string"
        5⤵
        Cerber
        Suspicious use of SetWindowsHookEx
        
        PID:828
    - - C:\Users\Admin\AppData\Roaming\dump\tool.exe
        
        tool.exe /PSN 16227464518153
        5⤵
        Cerber
        Suspicious use of SetWindowsHookEx
        
        PID:4988
- - C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe "" "" "" "" "" "" "" "" ""
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1392

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\os_cleaner_one.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\os_cleaner_one.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:7288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet
  2⤵
  PID:7844
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:7888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop winmgmt /Y
  2⤵
  PID:2428
- - C:\Windows\system32\net.exe
    net stop winmgmt /Y
    3⤵
    PID:7852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop winmgmt /Y
      4⤵
      PID:8140

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\extd.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\extd.exe"
1⤵
- Executes dropped EXE
PID:5884

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\lgsvcl.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\lgsvcl.exe"
1⤵
- Executes dropped EXE
PID:6188

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:8172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5824

C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\apex.exe
"C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\apex.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6396
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\390E.tmp\390F.tmp\3910.bat "C:\Users\Admin\Desktop\ZelenkaBannedBoys\Мануал 2\apex.exe""
  2⤵
  PID:7920
- - C:\Windows\system32\timeout.exe
    timeout /t 02
    3⤵
    - Delays execution with timeout.exe
    PID:4496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im smartscreen.exe
    3⤵
    - Kills process with taskkill
    PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
7f652922f004ed965b78a444360adb45

SHA1
c681cba7ca5514905f53cab070f45fcc549b8efe

SHA256
e888caafef4d1107a5ed6749cb7520e7f7eacb2b0f2cbac9f8ba4882167200a2

SHA512
f9f79f1360f01ded2ade45a14af8755f9d76d02bc82eb643bee7d1ddc196b6502047a34878e90706878e15ed25ba85b3e32cf0325e93f9a90038e429b87ec294

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
dd44b0b039223dc6d1f6a9ada551e813

SHA1
93d4b2f1cb19408b02f4c87f7beb0274ec3f0d25

SHA256
6d3d3b8475faaf630cce29303f7a843cb96226c135d835a8af534341c4a1577c

SHA512
7bad49da3cee6bfb255482c6e84576cba81619d72182b268187ed7a4dff80725c17c37b3ff399edaf4839ff53514eecd1a4abaf1c8aad87a5b5db72f9471e527

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
15KB

MD5
ef978b9e9ae9ec5e7bfe543a6df93f26

SHA1
36057096b520c4c752321acb99b6933d1d00428b

SHA256
ffb65f0efa477aca2a2413a8b091756ba0483168970067a961ced163af156eae

SHA512
b0fddb70612827a855510240c85f8589814c35141ceb5ed3e0e9b9bec50d490099df4d2cbb760df23b7a2cbc501354bd0ede4d1447cd1d57d5b85c6987f0cd29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
20KB

MD5
fcc2b6bc6c6303905b024fd8684a43f3

SHA1
2b962167b1389192f94c7ede8dc0a2c415d47e4f

SHA256
3cbb2ee30e76334329ef32c6b744138bbb6bffcdd25d82c7e40c030eb5923cf8

SHA512
9976b3856ccfbf9d3c9af701924cf80b49f7eec1693bacac43b7bf3be5253c7585f86cca4855dfed6f9ac72b66f50100eb7c1ec31cd137fe762df68d6c8dee6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a8a1ddc7cf4c5b413c025b777cd43a74

SHA1
344d10fa53d179a0e14916f9db42c41195d5d380

SHA256
e2ff4151457671172c4c55aa3c2c46c1ee54e14652e6b3851a08b2307fc6339e

SHA512
55f2158c02c05701e8458a029fc95a44fd00fb3e29cb5b97a2078d9ee017039620e6fa26e94e9a0ff0eb5094909d03d38563b0edd8e517dd62fb829085b98179

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
871B

MD5
1f89d2c4808b658676bc129bbdab0c0b

SHA1
6236b27820ffb4598d74b7f65726f5e2f64c61db

SHA256
8686d62d7cc603dbe8649f94814945222a9e7aa412095415afc55e3fc6d00f30

SHA512
194fa75b4b4960a1c30d4b000adb5a4ebc504e6febc6245f3f9f4847b85862e4f6ced5d38d854c770187889f7eeecabc376019dc88b439c78bbeff8eb39d63c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
0ee343cdede5f3bb6b96220fb13fc1d6

SHA1
9c589da8125ce689540b999868dc233887446db3

SHA256
acdc7d757da33fdb48a7f055b66fdc35d2b89babba33adb0628ee9f589582d6a

SHA512
23de90916294e59c8f0a5f47332eba403e491f58b171e1800e3d6d551cb90740ad4c15b7020a45672e81dd4e45e8dd7d224f6327e99f9e41ef28453e1f753000

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
09f80538dcda11af8feaba34f1adc401

SHA1
3528cafd387355c667922a07d638406eda59942c

SHA256
cb2091dfef35ee9ba3df242727f56d3a729fbaed65e4e97eeb0a717ad996b926

SHA512
0198933558b7881d0825be9d0a246dc44a244164114133cd64ef157489f3b40eaaddd46901c2dd181e0ade02abb8a8cdebfd8b88e3c037e264b78b6e7df93466

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
6a1ec660d508f40824ab0a13ade03466

SHA1
bcd46d4a0e8615e7351dd780d46f75eb450f66d2

SHA256
adef9b3e23065de13d2285a798a8ed4ac0c7ff305755587794e4e679359c15eb

SHA512
8f36389dc821b0cdef5b46a30c11aa0407d319d46d6c100119b3f9660612cc2ed2ac407f7528ebe59de0251b7fef8825c247503803bc5dcf4119b28b987a5dc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c2ff6661ff4e8a53d021646a3ba9dd1b

SHA1
f1fd451793977ca30cfd84426f5e86979b9a2990

SHA256
e1b4617ccca54d109a50bf4f8aca7c3cd89a9daf034ae0e07647feedc457b911

SHA512
4ed79e86ad41707311bee4e840579c333a3b5e3a85a550e73120737e70353aa188e1ce29e2e363df6c07983f5236847cc727b7d6d0a6f2ec95c7e0153f4e58e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
20ca9d6d500da6f859f3f51cc67f7042

SHA1
759aee7e398aa39eae8798bde85b9ffa7f0e77dd

SHA256
2cd1016554a5d3bb4bc4fd1deaa193a392517eabd928f26b871aaa6ba3eeae9d

SHA512
4ebba7c93cf21586be89fcad370f07105d56909a47742f519b6bc03166e85192def30644c7901c455f8a045f2be13114b103338baadae04f4d77296ce4f23c9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
0d4147a7959c323224ac7fe6b6e239a7

SHA1
8950df4c549a6704dacfce35c05d16095216020b

SHA256
5b7e7ccf87a87c28ad3903ef0035af18acd7bd00678e05e9814428bf03c8ed3d

SHA512
c5ecce10fb49b664bfef6f74ce8a4bb613e286173e58d6588569dcfe0f2fa84b07b5878312c53a54e171373523677eddce230e1c3144c79c634164b53109c70a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7cb9c1b76571e45415ff6bd1dde55513

SHA1
0ae5c183282793fd77611040da277e3c05312ed0

SHA256
ea86811127aabcb780a08117465e38db49c568c359b58bfb7b63e31477b4992d

SHA512
8cecb11c571a01ea121e5a4f0c148e30b74ed5c3875798c9fa1a0f3b3bfe3c1367d7277f098cacfce031d43d1f10e10fd9f7487f6b07d6073d08f4d7b2761d48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d20bc69e716a93afbd47af536a0a34d5

SHA1
86a0a8d1605d114efb2563b9f78cba4700d389bd

SHA256
07a8b13d3f6cf8c797cf2adeb0082e57935592850dc562b0d80e2fb81f085406

SHA512
b3f8c6a27964607b987338d4754cb8fc288dd2e886a3b52431af723619b9866035a02d86c230938c573cb40e3314fe767e57aa866beb1ad958b161330bc0bcfd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4217b1855fdea36b21975861817c4308

SHA1
f8253a10114ab6241f857cd5b7b52d7f90f0f388

SHA256
787f5095684b8a29e9815567f54597f64d0c0451bd1df1956dd0914a0e4240b7

SHA512
f27efe546d9bd3d6fe256df612000321b9400664bec232b4197c752200b87a62d946b8528e5a43309cda2945064c9f976e2e8d8b521b13e8b4afa66a0fd1276f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
84c5e2d5e6bcdbd2116b5bcb5f8ad0bf

SHA1
3953b4871249566816019bcccfa2c69e722e6b9f

SHA256
1d2a8f9e91ab4c0c2f3719bc46dabdfb551366cbce337379daa4ab8be2cd681b

SHA512
6371ba2efc9b04576d52a91326858acb2faad3b7854bfeaa18bc60e40ebe2929fd3c852dc9ea392defe9bb86e0395755f6dc653dca506ad7786f78e29524ba1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f35bc1dd-eaea-4508-95c1-fc6f031f9d19.tmp

Filesize
6KB

MD5
89b2d369cb1e10f0bfb4b6dbffe78099

SHA1
1bb41131520336bd70cad7a411bb9b146e6f5b19

SHA256
eed415daae44bd66f07a48ba0e08a58e977eb2deb6b118b43022133f6e8b2126

SHA512
77e8ea8ea5c9a4f6499b19d51cc81301809c8eed3cb394559fc5858d384a42eb427e54490cc47e6be40758af1f19c33bf05ddab6c0610cfa2d407596b3041079

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
0d7a2a1cd3c4fe2b6e90cda654b5debd

SHA1
b523cbfd48ba6c6e1f8279ef0c6d9804976d2e93

SHA256
0c16e1d8ace415895254a18841a4bed7a84388c29dbd5ada50112903b6578218

SHA512
fd30c40f58433b6dfc373d678b30016f6c87cd961fe7d91c7d1940fc99b5ccaaf450881d7fe140882b90f7568efe004761f00e31ddefe90054ecf4efbea74c4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
ab2461b4143e463abff55ef26e8bc295

SHA1
27f9db2a2763c9f80aea8cc2f1dfa4300b7ff926

SHA256
a95daec3b81bdca5403be7bdf3c3177fce0f69689f43bfb43561d0cd65d10348

SHA512
e597c932836a74a8c6d15dae6a067d5767f703b1c9932871e9e71843deedcf6c11dd627f0a21a02e98c909dbf443d2df688d0fec8864b1643d1730a16d294cc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
117KB

MD5
b8898fdca3bd35a112dd6b53b1a8d89b

SHA1
abc4804a16e86b137a19f7f9711af2bdd26a4273

SHA256
17ac059322fc24afed40062cd1bfa8ca0340e918defea0948424c44edaa086f1

SHA512
2b6ca0dc0562e1122062d342bf556ff64d38128e357353fd0f85a962874fab0e191b64e7987f1ecd9593d78ea116419c2684dc4be7ecc8b14b9dca6095484400

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5966a0.TMP

Filesize
110KB

MD5
06fe9dd66e1078af188fe5d127d39475

SHA1
1740d9efa9301283151d6cf1e85f16930cdc4525

SHA256
8a0b3a96522fb4833bf5346dce69f7dbba51f97dd0761bb517e6f4c087843439

SHA512
3801e176f684099924da4e377c719df54dd2112241b0018ea7854064ab060a014b5f83f64f24ad97ea2586d1bb7c811e990e669181f7e3f49f4192c8fb78f2a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7149.tmp\714A.tmp\extd.exe

Filesize
326KB

MD5
c14ce13ab09b4829f67a879d735a10a1

SHA1
537e1ce843f07ce629699ef5742c42ee2f06e9b6

SHA256
ef2699ba677fcdb8a3b70a711a59a5892d8439e108e3ac4d27a7f946c4d01a4a

SHA512
c1cf8eb4a5ca6539e5d2608c2085e7804ca77b7244aa7bfa7e1dde30cb88b9a4e6bb9e3d80304b7d8825355eab63d05e6425fa8267a9d20ac5f1998bed05fa38

Download Submit
C:\Users\Admin\AppData\Roaming\dump\load.exe

Filesize
89KB

MD5
5700cabc6bf4e6aea2f3535fe34f14e2

SHA1
9b0bd296120b99060c88fb5f870f8da1e046d640

SHA256
18c0da701463f2f99e5b8c91d2aa6315b4538960fe883a6bfb519f623fc2696b

SHA512
8db7bcf3e6babbcd2d122d55b6eb17136392ce7951cfbec550b1e8ea2d08348ffdaea37666be0e9df3889867907180c3bfa95ffbe8a307a94b147cc397bead5b

Download Submit
C:\Users\Admin\AppData\Roaming\dump\tool.exe

Filesize
453KB

MD5
b696823b80d01a67c1e25355fdaa8bab

SHA1
932d2cd264daa771e93b094de870feb4ec0e1d93

SHA256
4ef86ce5877adc7f861b79da511ca2cbc7b454d6acc33e4a3ccbf21092fe6d94

SHA512
7eadf67c666152002a8d168e6beea36f3f7a7b2c57c313461dea1ba8cb0590fe0d6f6c2c0b4cd147e3ff2429fb99de8e84f3a036c8c7dbf5012d1346e4aff65f

Download Submit
C:\Users\Admin\Desktop\ZelenkaBannedBoys\GetInput.exe

Filesize
3KB

MD5
2ba62ae6f88b11d0e262af35d8db8ca9

SHA1
69d4ccb476cfebdf572134fead42a12750580e4b

SHA256
3f5c64717a0092ae214154a730e96e2e56921be2e3f1121a3e98b1ba84627665

SHA512
a984212245e401b68872623437a512898a00d71cca7d7b0aa6733663020cae92d50ce1ae3abafbd811542a77e72c8b6a5755492c07d6ddeb2642d908142c2ccb

Download Submit
C:\Users\Admin\Desktop\ZelenkaBannedBoys\batbox.exe

Filesize
1KB

MD5
cb4a44baa20ad26bf74615a7fc515a84

SHA1
2581868c3d560e2b200d4f21d83271430167b377

SHA256
9553bc17fa0fd08e026c1865812b3388e3d5495a5394bbf671e5a8f21c79989a

SHA512
d19e6d0ccd89e52efdd2363185564cf83fcf3a37b55659dd1fd8b6574cf45b6147989b2c7b1e8029ce8136aa7ff74900494c1a30bbb65b96d9880ab7f77b6140

Download Submit
C:\Users\Admin\Desktop\ZelenkaBannedBoys\colorecho-vc10-x86_64.exe

Filesize
129KB

MD5
e2f377052409beeebf852803734e007a

SHA1
4d5e977acc59912bd451edae77ad58d977ed086b

SHA256
76fe5f9cef2c3a5c4f765d4c45167f4cf26cc6d469031f0d195d96724e9d82a8

SHA512
d88d3319a32ec3a8475fae03c74b1a5d7d8e92f3f5ffa1bc3326779d7d39e0bd18928a511be1ac965fb1c2e2da1cf0935fea38bbf847f54033887c62b6c842d7

Download Submit
C:\Users\Admin\Downloads\ZelenkaBannedBoys.rar

Filesize
4.9MB

MD5
66a15fdab2c09291a4b1476245e91624

SHA1
2601e82ecb973367e277b7b7d594f21305ce571f

SHA256
051a2e282cde2244700e5ed59ceb30fa7db2214a313e946caaacefebb226df6a

SHA512
93448ffe12a15c9c10c600706107fcb2d29ba6b7f83dcd8dc736d480e0ec8068616e64bd94eb85e398dfb4b5afec9b2d5ad42172ee90d9485d50e3e4a7043f68

Download Submit
C:\Users\Admin\Downloads\ZelenkaBannedBoys.rar

Filesize
7.5MB

MD5
058aa472434397ff5e009d7df8fa584f

SHA1
5916fb8a25898edc900d2a7ec0c4121acb17d9a3

SHA256
ff560ce25404e1ac515cee26d1a4bee1484fc40ac89f34cc5ac9b61b328051b4

SHA512
4b5ac0dda9bb8174e00bd99834acc858766ce73213e39c7911a6c07a9310ca7d5eba2c510a4576c6a95accc84037fdfb58433c4342d9b2d41b36370a1739422d

Download Submit
memory/1156-600-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/1156-599-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/1392-606-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/1640-564-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2392-563-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2424-522-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/2424-523-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/3136-517-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4516-559-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/5632-516-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/5760-520-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/5884-596-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/6440-601-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/6440-602-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/7200-519-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/7640-509-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/7640-511-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/7900-594-0x0000000140000000-0x00000001400D8000-memory.dmp

Filesize
864KB

Download
memory/8172-617-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-618-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-619-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-623-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-624-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-625-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-627-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-626-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-628-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download
memory/8172-629-0x0000020818490000-0x0000020818491000-memory.dmp

Filesize
4KB

Download