glupteba | 3d93d1e45579a47c3a3425fd16319c5a004396a2d98b7cf170ed009dad29c247

Analysis

max time kernel
95s
max time network
160s
platform
windows10_x64
resource
win10v20210408
submitted
09-08-2021 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

666b2557bae9f06363a55e64fe992f17.exe
Size

6.6MB
MD5

666b2557bae9f06363a55e64fe992f17
SHA1

affc2a67755549665a57d51c3c8767992ff20557
SHA256

3d93d1e45579a47c3a3425fd16319c5a004396a2d98b7cf170ed009dad29c247
SHA512

b7a392dc16c54ed5c064211c97e43d476cdd9a735990bb223e88e220b59ea45d5d23327a7282b5c1cdaed05b6c8f4680359bbbf83cc44be3c47f6d689d5ba572

Malware Config

Extracted

Family

smokeloader

Version

2020

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32

Extracted

Family

vidar

Version

39.4

Botnet

706

https://sergeevih43.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

Cana

176.111.174.254:56328

Extracted

Family

redline

Botnet

DomAni2

flestriche.xyz:80

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4676-513-0x0000000005140000-0x0000000005A66000-memory.dmp	family_glupteba
behavioral2/memory/4676-524-0x0000000000400000-0x000000000309A000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXerundll32.exerundll32.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	4724	rUNdlL32.eXe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7008	4104	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7708	4104	rundll32.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4332-289-0x0000000006150000-0x000000000616B000-memory.dmp	family_redline
behavioral2/memory/4332-294-0x0000000008E20000-0x0000000008E39000-memory.dmp	family_redline
behavioral2/memory/4992-311-0x0000000000417E3A-mapping.dmp	family_redline
behavioral2/memory/4992-309-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/4992-319-0x0000000005050000-0x0000000005656000-memory.dmp	family_redline
behavioral2/memory/5076-507-0x0000000000418E52-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Install.exe	family_socelars
C:\Users\Admin\AppData\Local\Temp\Install.exe	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

Processes:

WerFault.exeWerFault.exe

description pid process target process

PID 5160 created 4144 5160 WerFault.exe jobiea_2.exe
PID 5524 created 2976 5524 WerFault.exe jobiea_1.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

description	pid	process	target process
PID 5160 created 4144	5160	WerFault.exe	jobiea_2.exe
PID 5524 created 2976	5524	WerFault.exe	jobiea_1.exe

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2976-264-0x0000000004910000-0x00000000049AD000-memory.dmp	family_vidar
behavioral2/memory/2976-274-0x0000000000400000-0x0000000004424000-memory.dmp	family_vidar

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libstdc++-6.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 39 IoCs

Processes:

Files.exeFile.exeFolder.exejg3_3uag.exeInstall.exeInfo.exepub2.exeKRSetp.exeInstallation.exeInstallations.exeFolder.exesetup_installer.exesetup_install.exejobiea_1.exejobiea_6.exejobiea_7.exejobiea_2.exejobiea_3.exejobiea_4.exejobiea_5.exejobiea_8.exejfiag3g_gg.exejobiea_7.exejfiag3g_gg.exettEUVchbDvpe9BoEAmDsXvwf.exe5TV1Lwgkd0GPOH7X296YfzcS.exeWrK0AX6z_c7puhjhW5CHyeLn.exeHMMVxxH6veX5lvaZs5gM34Z5.exeCnYQ7p_jHkrHh4hSqx0naCEQ.exe4VnAQtP5hZjomAnLLO8RgLvy.exefvi6XYkrxCf36J1LidptbX1T.exeTINRKAgDfn4C4ZLppguZdH6r.exeIZtrSXvUKnbZIdlYAXAnQ0ch.exeTFYa8n4rkCtuwFBa3ybWAEhG.exeXECPi1sJhEN2TqsvudxboNQp.exesD0VAMA9DVQAWmZccrdIVWER.exeKqK3ki9il89LyK0w9t6H5tP3.exej4x1dv1AteQuF67vAkr2vkDz.exehultuusECzhdb2td8Q48aELI.exe

pid	process
3136	Files.exe
3836	File.exe
3416	Folder.exe
184	jg3_3uag.exe
4112	Install.exe
4156	Info.exe
4188	pub2.exe
4244	KRSetp.exe
4300	Installation.exe
4452	Installations.exe
4484	Folder.exe
4680	setup_installer.exe
4888	setup_install.exe
2976	jobiea_1.exe
4756	jobiea_6.exe
4248	jobiea_7.exe
4144	jobiea_2.exe
4596	jobiea_3.exe
4612	jobiea_4.exe
5004	jobiea_5.exe
4332	jobiea_8.exe
5244	jfiag3g_gg.exe
4992	jobiea_7.exe
5880	jfiag3g_gg.exe
4900	ttEUVchbDvpe9BoEAmDsXvwf.exe
4216	5TV1Lwgkd0GPOH7X296YfzcS.exe
5652	WrK0AX6z_c7puhjhW5CHyeLn.exe
5484	HMMVxxH6veX5lvaZs5gM34Z5.exe
4976	CnYQ7p_jHkrHh4hSqx0naCEQ.exe
60	4VnAQtP5hZjomAnLLO8RgLvy.exe
3644	fvi6XYkrxCf36J1LidptbX1T.exe
3912	TINRKAgDfn4C4ZLppguZdH6r.exe
4100	IZtrSXvUKnbZIdlYAXAnQ0ch.exe
4680	TFYa8n4rkCtuwFBa3ybWAEhG.exe
2216	XECPi1sJhEN2TqsvudxboNQp.exe
996	sD0VAMA9DVQAWmZccrdIVWER.exe
4192	KqK3ki9il89LyK0w9t6H5tP3.exe
4676	j4x1dv1AteQuF67vAkr2vkDz.exe
5216	hultuusECzhdb2td8Q48aELI.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe	vmprotect
behavioral2/memory/184-133-0x0000000000400000-0x0000000000651000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

666b2557bae9f06363a55e64fe992f17.exeInstallation.exeFiles.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	666b2557bae9f06363a55e64fe992f17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Installation.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Files.exe

Loads dropped DLL 9 IoCs

Processes:

pub2.exerundll32.exesetup_install.exehultuusECzhdb2td8Q48aELI.exe

pid	process
4188	pub2.exe
4876	rundll32.exe
4888	setup_install.exe
4888	setup_install.exe
4888	setup_install.exe
4888	setup_install.exe
4888	setup_install.exe
4888	setup_install.exe
5216	hultuusECzhdb2td8Q48aELI.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

jg3_3uag.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg3_3uag.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

264 ipinfo.io
277 ipinfo.io
303 ipinfo.io
14 ipinfo.io
15 ipinfo.io
44 ipinfo.io
45 ip-api.com

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg3_3uag.exe

flow	ioc
264	ipinfo.io
277	ipinfo.io
303	ipinfo.io
14	ipinfo.io
15	ipinfo.io
44	ipinfo.io
45	ip-api.com

Drops file in System32 directory 4 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent C2E05F31448A8955	svchost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

svchost.exejobiea_7.exeuDdy8aMXXpaN46Wn55rZYd5a.exe

description	pid	process	target process
PID 568 set thread context of 5112	568	svchost.exe	svchost.exe
PID 4248 set thread context of 4992	4248	jobiea_7.exe	jobiea_7.exe
PID 568 set thread context of 4184	568	svchost.exe	svchost.exe
PID 4900 set thread context of 5076	4900	uDdy8aMXXpaN46Wn55rZYd5a.exe	ttEUVchbDvpe9BoEAmDsXvwf.exe

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe	autoit_exe

Drops file in Program Files directory 64 IoCs

Processes:

hultuusECzhdb2td8Q48aELI.exefvi6XYkrxCf36J1LidptbX1T.exe

description	ioc	process
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\dailymotion.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	fvi6XYkrxCf36J1LidptbX1T.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	fvi6XYkrxCf36J1LidptbX1T.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\mobile.css	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\meta\art\01_googleimage.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\modules\dkjson.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\Audio-48.png	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libwav_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\cli.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\modules\host.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libvc1_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.xml	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\meta\art\00_musicbrainz.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libdvdnav_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\mosaic_window.html	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libcdda_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libau_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\libvlccore.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\meta\art\02_frenchtv.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\twitch.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\luac.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\modules\common.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\rockbox_fm_presets.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libftp_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_window.html	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\README.txt	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\d3d11\libdirect3d11_filters_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libmpc_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libnoseek_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\librawvid_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\data_load.exe	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\vlm_export.html	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libidummy_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libsdp_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libwin_hotkeys_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libsmf_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	fvi6XYkrxCf36J1LidptbX1T.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\browse_window.html	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\offset_window.html	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.json	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist_jstree.xml	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\koreus.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\gui\libqt_plugin.dll	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\jamendo.luac	hultuusECzhdb2td8Q48aELI.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libaiff_plugin.dll	hultuusECzhdb2td8Q48aELI.exe

Drops file in Windows directory 3 IoCs

Processes:

WerFault.exeMicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 20 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5160	4144	WerFault.exe	jobiea_2.exe
5524	2976	WerFault.exe	jobiea_1.exe
4508	60	WerFault.exe	4VnAQtP5hZjomAnLLO8RgLvy.exe
5688	60	WerFault.exe	4VnAQtP5hZjomAnLLO8RgLvy.exe
5024	60	WerFault.exe	4VnAQtP5hZjomAnLLO8RgLvy.exe
916	60	WerFault.exe	4VnAQtP5hZjomAnLLO8RgLvy.exe
1616	60	WerFault.exe	4VnAQtP5hZjomAnLLO8RgLvy.exe
4672	3800	WerFault.exe	WrK0AX6z_c7puhjhW5CHyeLn.exe
6864	6432	WerFault.exe	io2ZiQvfn9hLAOXOSIqAKanl.exe
6972	1560	WerFault.exe	SCxqGru1JmIDEW06x5AYAQF6.exe
7116	1560	WerFault.exe	SCxqGru1JmIDEW06x5AYAQF6.exe
6164	1560	WerFault.exe	SCxqGru1JmIDEW06x5AYAQF6.exe
6264	1560	WerFault.exe	SCxqGru1JmIDEW06x5AYAQF6.exe
6392	60	WerFault.exe	4VnAQtP5hZjomAnLLO8RgLvy.exe
6904	60	WerFault.exe	4VnAQtP5hZjomAnLLO8RgLvy.exe
6960	1560	WerFault.exe	SCxqGru1JmIDEW06x5AYAQF6.exe
6568	5484	WerFault.exe	HMMVxxH6veX5lvaZs5gM34Z5.exe
4892	1560	WerFault.exe	SCxqGru1JmIDEW06x5AYAQF6.exe
7868	1560	WerFault.exe	SCxqGru1JmIDEW06x5AYAQF6.exe
7920	7676	WerFault.exe	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

pub2.exeTFYa8n4rkCtuwFBa3ybWAEhG.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TFYa8n4rkCtuwFBa3ybWAEhG.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TFYa8n4rkCtuwFBa3ybWAEhG.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	TFYa8n4rkCtuwFBa3ybWAEhG.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3948 taskkill.exe

pid	process
3948	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exebrowser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies data under HKEY_USERS 16 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exerundll32.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\650478DC7424C37C\2 = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1ee517dce18cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "30"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\7289246C77593EBF	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = e0bef441148dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c63e01d8e18cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{0ED7566F-2772-48E2-B277-747D827B3B30} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = a069bcece18cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0f441ddee18cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000476ca8e5ef35c5507d35f411d82347473f935e7b1091d7668cb35ec152f862fe1426093740a7cefb52004e63e5617bc4d0f9007a5efd92b5428f8bed49045c3fa02177f0985525f18814ef652ec42f4ea6f1097a13b63dd66c84e634eec5cc51fdfdff5fc36153917012020a306c13d8331a3b5d2adcf6f945323b7df45ba90de75a79620eea902599985426f8784393db136615328ffbb04439f7e55be711ae0ed9106dd80fc9bd7a48815df60a05d6b07edaf87fef52ef263931abc0870d29001834a733f207e25ec006fcee41f24f6afab822041cc6e9d0d1a89ffd5c2fc26eb8e814e4b1981393a15489153d528c922641e74a363fb9e5a3ba31148723fa8759dfd22e6e681b398c414c6c1ee0c90ba4c355685d19d8e24e34002b26c5cc819b365fdf47fe2ec61f8a9e8303eb1b4e136dca29b1bb67d472c603c75ac83be81e34f5035e76d97afca51cc90e83e0a812589136529049efaf23439f43ca2bd98289f689d1d2c33cc193620b5ebd87164378990f607d09f7a5b71b46020f915468d6673bc26b41ba0f055b4513c7a1194594357cfb159104854677108c1a9c600f9b52e52b	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Install.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Install.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	302	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	307	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	276	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	281	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pub2.exerundll32.exesvchost.exeWerFault.exe

pid	process
4188	pub2.exe
4188	pub2.exe
4876	rundll32.exe
4876	rundll32.exe
568	svchost.exe
568	svchost.exe
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
5160	WerFault.exe
2996
2996
5160	WerFault.exe
5160	WerFault.exe
2996
2996
2996
2996
2996
2996
2996
2996
2996

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

pub2.exeMicrosoftEdgeCP.exe

pid process

4188 pub2.exe
5892 MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MicrosoftEdge.exeInstall.exeKRSetp.exerundll32.exesvchost.exejobiea_5.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4072	MicrosoftEdge.exe
Token: SeDebugPrivilege	4072	MicrosoftEdge.exe
Token: SeDebugPrivilege	4072	MicrosoftEdge.exe
Token: SeDebugPrivilege	4072	MicrosoftEdge.exe
Token: SeCreateTokenPrivilege	4112	Install.exe
Token: SeAssignPrimaryTokenPrivilege	4112	Install.exe
Token: SeLockMemoryPrivilege	4112	Install.exe
Token: SeIncreaseQuotaPrivilege	4112	Install.exe
Token: SeMachineAccountPrivilege	4112	Install.exe
Token: SeTcbPrivilege	4112	Install.exe
Token: SeSecurityPrivilege	4112	Install.exe
Token: SeTakeOwnershipPrivilege	4112	Install.exe
Token: SeLoadDriverPrivilege	4112	Install.exe
Token: SeSystemProfilePrivilege	4112	Install.exe
Token: SeSystemtimePrivilege	4112	Install.exe
Token: SeProfSingleProcessPrivilege	4112	Install.exe
Token: SeIncBasePriorityPrivilege	4112	Install.exe
Token: SeCreatePagefilePrivilege	4112	Install.exe
Token: SeCreatePermanentPrivilege	4112	Install.exe
Token: SeBackupPrivilege	4112	Install.exe
Token: SeRestorePrivilege	4112	Install.exe
Token: SeShutdownPrivilege	4112	Install.exe
Token: SeDebugPrivilege	4112	Install.exe
Token: SeAuditPrivilege	4112	Install.exe
Token: SeSystemEnvironmentPrivilege	4112	Install.exe
Token: SeChangeNotifyPrivilege	4112	Install.exe
Token: SeRemoteShutdownPrivilege	4112	Install.exe
Token: SeUndockPrivilege	4112	Install.exe
Token: SeSyncAgentPrivilege	4112	Install.exe
Token: SeEnableDelegationPrivilege	4112	Install.exe
Token: SeManageVolumePrivilege	4112	Install.exe
Token: SeImpersonatePrivilege	4112	Install.exe
Token: SeCreateGlobalPrivilege	4112	Install.exe
Token: 31	4112	Install.exe
Token: 32	4112	Install.exe
Token: 33	4112	Install.exe
Token: 34	4112	Install.exe
Token: 35	4112	Install.exe
Token: SeDebugPrivilege	4244	KRSetp.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	568	svchost.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	5004	jobiea_5.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeDebugPrivilege	4876	rundll32.exe
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeRestorePrivilege	5160	WerFault.exe
Token: SeBackupPrivilege	5160	WerFault.exe

Suspicious use of FindShellTrayWindow 23 IoCs

Processes:

File.exe

pid	process
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
2996
2996

Suspicious use of SendNotifyMessage 21 IoCs

Processes:

File.exe

pid	process
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe
3836	File.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

MicrosoftEdge.exeInfo.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeHMMVxxH6veX5lvaZs5gM34Z5.exefvi6XYkrxCf36J1LidptbX1T.exe4VnAQtP5hZjomAnLLO8RgLvy.exeTFYa8n4rkCtuwFBa3ybWAEhG.exeXECPi1sJhEN2TqsvudxboNQp.exej4x1dv1AteQuF67vAkr2vkDz.exehultuusECzhdb2td8Q48aELI.exeKqK3ki9il89LyK0w9t6H5tP3.exe

pid	process
4072	MicrosoftEdge.exe
4156	Info.exe
4644	MicrosoftEdgeCP.exe
5420	MicrosoftEdge.exe
5892	MicrosoftEdgeCP.exe
5892	MicrosoftEdgeCP.exe
5484	HMMVxxH6veX5lvaZs5gM34Z5.exe
3644	fvi6XYkrxCf36J1LidptbX1T.exe
60	4VnAQtP5hZjomAnLLO8RgLvy.exe
4680	TFYa8n4rkCtuwFBa3ybWAEhG.exe
2216	XECPi1sJhEN2TqsvudxboNQp.exe
4676	j4x1dv1AteQuF67vAkr2vkDz.exe
5216	hultuusECzhdb2td8Q48aELI.exe
4192	KqK3ki9il89LyK0w9t6H5tP3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

666b2557bae9f06363a55e64fe992f17.exeFiles.exeInstallation.exeFolder.exeInstallations.exerUNdlL32.eXesetup_installer.exerundll32.exesvchost.exeInstall.exesetup_install.execmd.exe

description	pid	process	target process
PID 628 wrote to memory of 3136	628	666b2557bae9f06363a55e64fe992f17.exe	Files.exe
PID 628 wrote to memory of 3136	628	666b2557bae9f06363a55e64fe992f17.exe	Files.exe
PID 628 wrote to memory of 3136	628	666b2557bae9f06363a55e64fe992f17.exe	Files.exe
PID 3136 wrote to memory of 3836	3136	Files.exe	File.exe
PID 3136 wrote to memory of 3836	3136	Files.exe	File.exe
PID 3136 wrote to memory of 3836	3136	Files.exe	File.exe
PID 628 wrote to memory of 3416	628	666b2557bae9f06363a55e64fe992f17.exe	Folder.exe
PID 628 wrote to memory of 3416	628	666b2557bae9f06363a55e64fe992f17.exe	Folder.exe
PID 628 wrote to memory of 3416	628	666b2557bae9f06363a55e64fe992f17.exe	Folder.exe
PID 628 wrote to memory of 184	628	666b2557bae9f06363a55e64fe992f17.exe	jg3_3uag.exe
PID 628 wrote to memory of 184	628	666b2557bae9f06363a55e64fe992f17.exe	jg3_3uag.exe
PID 628 wrote to memory of 184	628	666b2557bae9f06363a55e64fe992f17.exe	jg3_3uag.exe
PID 628 wrote to memory of 4112	628	666b2557bae9f06363a55e64fe992f17.exe	Install.exe
PID 628 wrote to memory of 4112	628	666b2557bae9f06363a55e64fe992f17.exe	Install.exe
PID 628 wrote to memory of 4112	628	666b2557bae9f06363a55e64fe992f17.exe	Install.exe
PID 628 wrote to memory of 4156	628	666b2557bae9f06363a55e64fe992f17.exe	Info.exe
PID 628 wrote to memory of 4156	628	666b2557bae9f06363a55e64fe992f17.exe	Info.exe
PID 628 wrote to memory of 4156	628	666b2557bae9f06363a55e64fe992f17.exe	Info.exe
PID 628 wrote to memory of 4188	628	666b2557bae9f06363a55e64fe992f17.exe	pub2.exe
PID 628 wrote to memory of 4188	628	666b2557bae9f06363a55e64fe992f17.exe	pub2.exe
PID 628 wrote to memory of 4188	628	666b2557bae9f06363a55e64fe992f17.exe	pub2.exe
PID 628 wrote to memory of 4244	628	666b2557bae9f06363a55e64fe992f17.exe	KRSetp.exe
PID 628 wrote to memory of 4244	628	666b2557bae9f06363a55e64fe992f17.exe	KRSetp.exe
PID 628 wrote to memory of 4300	628	666b2557bae9f06363a55e64fe992f17.exe	Installation.exe
PID 628 wrote to memory of 4300	628	666b2557bae9f06363a55e64fe992f17.exe	Installation.exe
PID 628 wrote to memory of 4300	628	666b2557bae9f06363a55e64fe992f17.exe	Installation.exe
PID 4300 wrote to memory of 4452	4300	Installation.exe	Installations.exe
PID 4300 wrote to memory of 4452	4300	Installation.exe	Installations.exe
PID 4300 wrote to memory of 4452	4300	Installation.exe	Installations.exe
PID 3416 wrote to memory of 4484	3416	Folder.exe	Folder.exe
PID 3416 wrote to memory of 4484	3416	Folder.exe	Folder.exe
PID 3416 wrote to memory of 4484	3416	Folder.exe	Folder.exe
PID 4452 wrote to memory of 4680	4452	Installations.exe	setup_installer.exe
PID 4452 wrote to memory of 4680	4452	Installations.exe	setup_installer.exe
PID 4452 wrote to memory of 4680	4452	Installations.exe	setup_installer.exe
PID 4840 wrote to memory of 4876	4840	rUNdlL32.eXe	rundll32.exe
PID 4840 wrote to memory of 4876	4840	rUNdlL32.eXe	rundll32.exe
PID 4840 wrote to memory of 4876	4840	rUNdlL32.eXe	rundll32.exe
PID 4680 wrote to memory of 4888	4680	setup_installer.exe	setup_install.exe
PID 4680 wrote to memory of 4888	4680	setup_installer.exe	setup_install.exe
PID 4680 wrote to memory of 4888	4680	setup_installer.exe	setup_install.exe
PID 4876 wrote to memory of 568	4876	rundll32.exe	svchost.exe
PID 568 wrote to memory of 5112	568	svchost.exe	svchost.exe
PID 568 wrote to memory of 5112	568	svchost.exe	svchost.exe
PID 4876 wrote to memory of 2788	4876	rundll32.exe	svchost.exe
PID 4112 wrote to memory of 2880	4112	Install.exe	cmd.exe
PID 4112 wrote to memory of 2880	4112	Install.exe	cmd.exe
PID 4112 wrote to memory of 2880	4112	Install.exe	cmd.exe
PID 568 wrote to memory of 5112	568	svchost.exe	svchost.exe
PID 4888 wrote to memory of 4308	4888	setup_install.exe	cmd.exe
PID 4888 wrote to memory of 4308	4888	setup_install.exe	cmd.exe
PID 4888 wrote to memory of 4308	4888	setup_install.exe	cmd.exe
PID 4888 wrote to memory of 3744	4888	setup_install.exe	cmd.exe
PID 4888 wrote to memory of 3744	4888	setup_install.exe	cmd.exe
PID 4888 wrote to memory of 3744	4888	setup_install.exe	cmd.exe
PID 4876 wrote to memory of 68	4876	rundll32.exe	svchost.exe
PID 4888 wrote to memory of 4104	4888	setup_install.exe	cmd.exe
PID 4888 wrote to memory of 4104	4888	setup_install.exe	cmd.exe
PID 4888 wrote to memory of 4104	4888	setup_install.exe	cmd.exe
PID 4308 wrote to memory of 2976	4308	cmd.exe	jobiea_1.exe
PID 4308 wrote to memory of 2976	4308	cmd.exe	jobiea_1.exe
PID 4308 wrote to memory of 2976	4308	cmd.exe	jobiea_1.exe
PID 4888 wrote to memory of 4220	4888	setup_install.exe	cmd.exe
PID 4888 wrote to memory of 4220	4888	setup_install.exe	cmd.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1212

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1204

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1076

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:596

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Users\Admin\AppData\Local\Temp\666b2557bae9f06363a55e64fe992f17.exe
"C:\Users\Admin\AppData\Local\Temp\666b2557bae9f06363a55e64fe992f17.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:628

C:\Users\Admin\AppData\Local\Temp\Files.exe
"C:\Users\Admin\AppData\Local\Temp\Files.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3136

C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3836

C:\Users\Admin\AppData\Local\Temp\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\Folder.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416

C:\Users\Admin\AppData\Local\Temp\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
3⤵
- Executes dropped EXE
PID:4484

C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
"C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:184

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
PID:2880

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
4⤵
- Kills process with taskkill
PID:3948

C:\Users\Admin\AppData\Local\Temp\Info.exe
"C:\Users\Admin\AppData\Local\Temp\Info.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4156

C:\Users\Admin\Documents\WrK0AX6z_c7puhjhW5CHyeLn.exe
"C:\Users\Admin\Documents\WrK0AX6z_c7puhjhW5CHyeLn.exe"
3⤵
- Executes dropped EXE
PID:5652

C:\Users\Admin\Documents\WrK0AX6z_c7puhjhW5CHyeLn.exe
C:\Users\Admin\Documents\WrK0AX6z_c7puhjhW5CHyeLn.exe
4⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 24
5⤵
- Program crash
PID:4672

C:\Users\Admin\Documents\5TV1Lwgkd0GPOH7X296YfzcS.exe
"C:\Users\Admin\Documents\5TV1Lwgkd0GPOH7X296YfzcS.exe"
3⤵
- Executes dropped EXE
PID:4216

C:\Users\Admin\Documents\ttEUVchbDvpe9BoEAmDsXvwf.exe
"C:\Users\Admin\Documents\ttEUVchbDvpe9BoEAmDsXvwf.exe"
3⤵
- Executes dropped EXE
PID:4900

C:\Users\Admin\Documents\ttEUVchbDvpe9BoEAmDsXvwf.exe
C:\Users\Admin\Documents\ttEUVchbDvpe9BoEAmDsXvwf.exe
4⤵
PID:5076

C:\Users\Admin\Documents\HMMVxxH6veX5lvaZs5gM34Z5.exe
"C:\Users\Admin\Documents\HMMVxxH6veX5lvaZs5gM34Z5.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5484

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:6348

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:6992

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:6956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5484 -s 1500
4⤵
- Program crash
PID:6568

C:\Users\Admin\Documents\CnYQ7p_jHkrHh4hSqx0naCEQ.exe
"C:\Users\Admin\Documents\CnYQ7p_jHkrHh4hSqx0naCEQ.exe"
3⤵
- Executes dropped EXE
PID:4976

C:\Users\Admin\AppData\Roaming\3531407.exe
"C:\Users\Admin\AppData\Roaming\3531407.exe"
4⤵
PID:4672

C:\Users\Admin\AppData\Roaming\5566121.exe
"C:\Users\Admin\AppData\Roaming\5566121.exe"
4⤵
PID:4708

C:\Users\Admin\Documents\fvi6XYkrxCf36J1LidptbX1T.exe
"C:\Users\Admin\Documents\fvi6XYkrxCf36J1LidptbX1T.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3644

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
4⤵
PID:5112

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:7416

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
PID:7744

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:7684

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
PID:2100

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:988

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
PID:8164

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
4⤵
PID:4960

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
4⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:6736

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:996

C:\Users\Admin\Documents\4VnAQtP5hZjomAnLLO8RgLvy.exe
"C:\Users\Admin\Documents\4VnAQtP5hZjomAnLLO8RgLvy.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 660
4⤵
- Program crash
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 672
4⤵
- Program crash
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 780
4⤵
- Program crash
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 816
4⤵
- Program crash
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 1068
4⤵
- Program crash
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 1252
4⤵
- Program crash
PID:6392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 1340
4⤵
- Program crash
PID:6904

C:\Users\Admin\Documents\IZtrSXvUKnbZIdlYAXAnQ0ch.exe
"C:\Users\Admin\Documents\IZtrSXvUKnbZIdlYAXAnQ0ch.exe"
3⤵
- Executes dropped EXE
PID:4100

C:\Users\Admin\Documents\TINRKAgDfn4C4ZLppguZdH6r.exe
"C:\Users\Admin\Documents\TINRKAgDfn4C4ZLppguZdH6r.exe"
3⤵
- Executes dropped EXE
PID:3912

C:\Users\Admin\Documents\TFYa8n4rkCtuwFBa3ybWAEhG.exe
"C:\Users\Admin\Documents\TFYa8n4rkCtuwFBa3ybWAEhG.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Users\Admin\Documents\sD0VAMA9DVQAWmZccrdIVWER.exe
"C:\Users\Admin\Documents\sD0VAMA9DVQAWmZccrdIVWER.exe"
3⤵
- Executes dropped EXE
PID:996

C:\Users\Admin\AppData\Roaming\6682473.exe
"C:\Users\Admin\AppData\Roaming\6682473.exe"
4⤵
PID:620

C:\Users\Admin\AppData\Roaming\5092885.exe
"C:\Users\Admin\AppData\Roaming\5092885.exe"
4⤵
PID:4376

C:\Users\Admin\Documents\XECPi1sJhEN2TqsvudxboNQp.exe
"C:\Users\Admin\Documents\XECPi1sJhEN2TqsvudxboNQp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2216

C:\Users\Admin\Documents\KqK3ki9il89LyK0w9t6H5tP3.exe
"C:\Users\Admin\Documents\KqK3ki9il89LyK0w9t6H5tP3.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Users\Admin\Documents\KqK3ki9il89LyK0w9t6H5tP3.exe
"C:\Users\Admin\Documents\KqK3ki9il89LyK0w9t6H5tP3.exe" -q
4⤵
PID:4128

C:\Users\Admin\Documents\j4x1dv1AteQuF67vAkr2vkDz.exe
"C:\Users\Admin\Documents\j4x1dv1AteQuF67vAkr2vkDz.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Users\Admin\Documents\hultuusECzhdb2td8Q48aELI.exe
"C:\Users\Admin\Documents\hultuusECzhdb2td8Q48aELI.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5216

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf2931.tmp\tempfile.ps1"
4⤵
PID:5096

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf2931.tmp\tempfile.ps1"
4⤵
PID:7200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf2931.tmp\tempfile.ps1"
4⤵
PID:7808

C:\Users\Admin\Documents\gB4XX4bi_kGEczfzz8kPAZZ8.exe
"C:\Users\Admin\Documents\gB4XX4bi_kGEczfzz8kPAZZ8.exe"
3⤵
PID:4292

C:\Users\Admin\AppData\Local\Temp\is-5TM07.tmp\gB4XX4bi_kGEczfzz8kPAZZ8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5TM07.tmp\gB4XX4bi_kGEczfzz8kPAZZ8.tmp" /SL5="$501F6,138429,56832,C:\Users\Admin\Documents\gB4XX4bi_kGEczfzz8kPAZZ8.exe"
4⤵
PID:4684

C:\Users\Admin\AppData\Local\Temp\is-TNUU8.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-TNUU8.tmp\Setup.exe" /Verysilent
5⤵
PID:4832

C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"
6⤵
PID:7780

C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"
6⤵
PID:7836

C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
6⤵
PID:7940

C:\Users\Admin\AppData\Local\Temp\note8876.exe
"C:\Users\Admin\AppData\Local\Temp\note8876.exe" end
7⤵
PID:7860

C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
6⤵
PID:7884

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:6696

C:\Users\Admin\AppData\Local\Temp\pub2.exe
"C:\Users\Admin\AppData\Local\Temp\pub2.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4188

C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Users\Admin\AppData\Local\Temp\Installation.exe
"C:\Users\Admin\AppData\Local\Temp\Installation.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4300

C:\Users\Admin\AppData\Local\Temp\RarSFX1\Installations.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Installations.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c jobiea_2.exe
6⤵
PID:3744

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_2.exe
jobiea_2.exe
7⤵
- Executes dropped EXE
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 488
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c jobiea_7.exe
6⤵
PID:2300

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.exe
jobiea_7.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c jobiea_8.exe
6⤵
PID:4700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c jobiea_6.exe
6⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c jobiea_5.exe
6⤵
PID:4124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c jobiea_4.exe
6⤵
PID:4220

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c jobiea_3.exe
6⤵
PID:4104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c jobiea_1.exe
6⤵
- Suspicious use of WriteProcessMemory
PID:4308

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4184

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4072

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2216

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4840

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_1.exe
jobiea_1.exe
1⤵
- Executes dropped EXE
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 928
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5524

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_6.exe
jobiea_6.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Users\Admin\Documents\hGwQyPB6PnEzfc8c8WCIh9zS.exe
"C:\Users\Admin\Documents\hGwQyPB6PnEzfc8c8WCIh9zS.exe"
2⤵
PID:3628

C:\Users\Admin\Documents\SCxqGru1JmIDEW06x5AYAQF6.exe
"C:\Users\Admin\Documents\SCxqGru1JmIDEW06x5AYAQF6.exe"
2⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 660
3⤵
- Program crash
PID:6972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 676
3⤵
- Program crash
PID:7116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 636
3⤵
- Program crash
PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 640
3⤵
- Program crash
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 1148
3⤵
- Program crash
PID:6960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 1316
3⤵
- Program crash
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 1280
3⤵
- Program crash
PID:7868

C:\Users\Admin\Documents\kS7d059hIP1bK6DDoNfKuoI4.exe
"C:\Users\Admin\Documents\kS7d059hIP1bK6DDoNfKuoI4.exe"
2⤵
PID:5388

C:\Users\Admin\Documents\io2ZiQvfn9hLAOXOSIqAKanl.exe
"C:\Users\Admin\Documents\io2ZiQvfn9hLAOXOSIqAKanl.exe"
2⤵
PID:5144

C:\Users\Admin\Documents\io2ZiQvfn9hLAOXOSIqAKanl.exe
C:\Users\Admin\Documents\io2ZiQvfn9hLAOXOSIqAKanl.exe
3⤵
PID:6432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 24
4⤵
- Program crash
PID:6864

C:\Users\Admin\Documents\shbOQfT6MJZADtVosTs7Vvpz.exe
"C:\Users\Admin\Documents\shbOQfT6MJZADtVosTs7Vvpz.exe"
2⤵
PID:4060

C:\Users\Admin\Documents\shbOQfT6MJZADtVosTs7Vvpz.exe
"C:\Users\Admin\Documents\shbOQfT6MJZADtVosTs7Vvpz.exe" -q
3⤵
PID:4112

C:\Users\Admin\Documents\jzXvaLdX8j5F333TnZGkjBUs.exe
"C:\Users\Admin\Documents\jzXvaLdX8j5F333TnZGkjBUs.exe"
2⤵
PID:3768

C:\Users\Admin\AppData\Roaming\6736999.exe
"C:\Users\Admin\AppData\Roaming\6736999.exe"
3⤵
PID:6352

C:\Users\Admin\AppData\Roaming\2846732.exe
"C:\Users\Admin\AppData\Roaming\2846732.exe"
3⤵
PID:7340

C:\Users\Admin\Documents\ALIdO6qFG3uRG7MoTWMoCeFn.exe
"C:\Users\Admin\Documents\ALIdO6qFG3uRG7MoTWMoCeFn.exe"
2⤵
PID:3992

C:\Users\Admin\Documents\yAPR8N1kfN64mEGucOwiRmKe.exe
"C:\Users\Admin\Documents\yAPR8N1kfN64mEGucOwiRmKe.exe"
2⤵
PID:4340

C:\Users\Admin\Documents\sHhg9aKeADG1sCm70m6_GAhL.exe
"C:\Users\Admin\Documents\sHhg9aKeADG1sCm70m6_GAhL.exe"
2⤵
PID:5232

C:\Users\Admin\Documents\uDdy8aMXXpaN46Wn55rZYd5a.exe
"C:\Users\Admin\Documents\uDdy8aMXXpaN46Wn55rZYd5a.exe"
2⤵
- Suspicious use of SetThreadContext
PID:4900

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:4400

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:6824

C:\Users\Admin\Documents\SuwprT8LMurhDmhXvE_V5_LO.exe
"C:\Users\Admin\Documents\SuwprT8LMurhDmhXvE_V5_LO.exe"
2⤵
PID:2832

C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe
"C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe"
2⤵
PID:4768

C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe
C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe
3⤵
PID:3800

C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe
C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe
3⤵
PID:7184

C:\Users\Admin\Documents\WKsl0dodX8IR6zqUpCElfeBN.exe
"C:\Users\Admin\Documents\WKsl0dodX8IR6zqUpCElfeBN.exe"
2⤵
PID:5408

C:\Users\Admin\AppData\Roaming\6736999.exe
"C:\Users\Admin\AppData\Roaming\6736999.exe"
3⤵
PID:4724

C:\Users\Admin\AppData\Roaming\5297836.exe
"C:\Users\Admin\AppData\Roaming\5297836.exe"
3⤵
PID:1136

C:\Users\Admin\Documents\szZ_4V94TlvhKcUtK8oFUgEJ.exe
"C:\Users\Admin\Documents\szZ_4V94TlvhKcUtK8oFUgEJ.exe"
2⤵
PID:6496

C:\Users\Admin\Documents\0_zftHgkmfeWCs8ynLnFtTId.exe
"C:\Users\Admin\Documents\0_zftHgkmfeWCs8ynLnFtTId.exe"
2⤵
PID:572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszA5E3.tmp\tempfile.ps1"
3⤵
PID:7148

C:\Users\Admin\Documents\iRliB9MCJQPmvHIZ2bLhhb7A.exe
"C:\Users\Admin\Documents\iRliB9MCJQPmvHIZ2bLhhb7A.exe"
2⤵
PID:6168

C:\Users\Admin\AppData\Local\Temp\is-6VGT7.tmp\iRliB9MCJQPmvHIZ2bLhhb7A.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6VGT7.tmp\iRliB9MCJQPmvHIZ2bLhhb7A.tmp" /SL5="$40372,138429,56832,C:\Users\Admin\Documents\iRliB9MCJQPmvHIZ2bLhhb7A.exe"
3⤵
PID:6272

C:\Users\Admin\AppData\Local\Temp\is-C41MJ.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-C41MJ.tmp\Setup.exe" /Verysilent
4⤵
PID:8176

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_5.exe
jobiea_5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_8.exe
jobiea_8.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_4.exe
jobiea_4.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:5244

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:5880

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_3.exe
jobiea_3.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.exe
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5420

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5472

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5600

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5892

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5736

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:1192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5376

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:7676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 624
3⤵
- Program crash
PID:7920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
b2a6b0c933fd8fb421318d4080c20262

SHA1
245cefa2b343acc531898fcca13c78e836ddf281

SHA256
85e669932e66b977adbee034a3d9af1e8872174e25b9df2c698869545179ea0e

SHA512
fb279fb87b493c4453994dae3feeb870222ccf931dc10e93ae372ed851451f9691e2c1ce5460a4e948b68523a346a655c5ea40cc089f559f3248757777d46013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
ab7c942b61a01c9652c16d318283206a

SHA1
8f6e89a9080cc1586a52e7729190f022b31b13c1

SHA256
59b216716d6cb1d2971864785218eb6cd60248cf24a62a63c5633be6e0e04b25

SHA512
c1c07d2e8c48860b2fabcee7f37c6c210d4284d9610a8b788a05de9e397618763a4cad52d5e41fb5858c380d6659102fe5e609bf2fb0d80e6411101d4492902f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
924f06f0be11515b1bec2486d564bc83

SHA1
c74c0655888f6a2a2f895c4803036f7144705775

SHA256
0d128570ef2c61b298de2400cba9825140068ac230cd2a8aebb0a4135110e5ab

SHA512
551e1ce75199975acf88da4eebf443fc7ff16e2d9808eaa4b469bb5539c8cf56fcb42bc0ee2fdf77b4e970faeaaf713edac96e552810568a5159c75f7a07a3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
07e5d09f3a694bd79dbebe7597fb4846

SHA1
42f195794062cd7a45fc6dafa5239edef87f4a90

SHA256
981a69f902c4de108b4552d6d2c197114d79b412fba886abc8e846bd07dbd382

SHA512
842c24c8cf34cff4e6fc572ae1ac37e4d8a61900d6d0d474f7519611a93a57e0e8377611343042035834c079b5811b7cfd50714d4acd2322b483ac39a2642121

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_1.exe
MD5
dd5f6d433f6e89c232d56c88a61392bd

SHA1
2582fc1d123384bd7e2a07638bb37fcd3d79ca9a

SHA256
0db8aeda5003da3a7a88699ece04556f0f6b1d1400514d4cb374c88ddb8ec63d

SHA512
a513f488566540091a031db709d3cfbefdb3668ed5b849ec45dbc9371d45aa25f9489c0990dd25c1f14b92cfcd25dd06b1126aef5ba4051f3f1a0c49b8af2d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_1.txt
MD5
dd5f6d433f6e89c232d56c88a61392bd

SHA1
2582fc1d123384bd7e2a07638bb37fcd3d79ca9a

SHA256
0db8aeda5003da3a7a88699ece04556f0f6b1d1400514d4cb374c88ddb8ec63d

SHA512
a513f488566540091a031db709d3cfbefdb3668ed5b849ec45dbc9371d45aa25f9489c0990dd25c1f14b92cfcd25dd06b1126aef5ba4051f3f1a0c49b8af2d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_2.exe
MD5
0d8ebc2a16581f7b514a1699550ed552

SHA1
72f226e8efc041d998384a120f8e45d22c0f4218

SHA256
c638b1a56525b01c7a73366fc7c8d0c2b29353a31c4fcf3a7b7037e52caf4f28

SHA512
2e95e4df0a97bc9ea341b93383b3ea4b68db4259ac53da9a29ec80bc00894c5c82a32d4cbb7927ae1808103e6b7491e0a18f406b02363a47a45a0de463b51f72

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_2.txt
MD5
0d8ebc2a16581f7b514a1699550ed552

SHA1
72f226e8efc041d998384a120f8e45d22c0f4218

SHA256
c638b1a56525b01c7a73366fc7c8d0c2b29353a31c4fcf3a7b7037e52caf4f28

SHA512
2e95e4df0a97bc9ea341b93383b3ea4b68db4259ac53da9a29ec80bc00894c5c82a32d4cbb7927ae1808103e6b7491e0a18f406b02363a47a45a0de463b51f72

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_3.exe
MD5
6e487aa1b2d2b9ef05073c11572925f2

SHA1
b2b58a554b75029cd8bdf5ffd012611b1bfe430b

SHA256
77eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597

SHA512
b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_3.txt
MD5
6e487aa1b2d2b9ef05073c11572925f2

SHA1
b2b58a554b75029cd8bdf5ffd012611b1bfe430b

SHA256
77eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597

SHA512
b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_4.exe
MD5
5668cb771643274ba2c375ec6403c266

SHA1
dd78b03428b99368906fe62fc46aaaf1db07a8b9

SHA256
d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

SHA512
135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_4.txt
MD5
5668cb771643274ba2c375ec6403c266

SHA1
dd78b03428b99368906fe62fc46aaaf1db07a8b9

SHA256
d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

SHA512
135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_5.exe
MD5
a2a580db98baafe88982912d06befa64

SHA1
dce4f7af68efca42ac7732870b05f5055846f0f3

SHA256
18310737141e60462bb77bc7e1cd3024fa3308c96f0e2dd37a71b995c72f3a09

SHA512
c4a4887659212674112c4eb40baf2bf227a4b04a9b2c140ea142cc2a47a1cd73c4a0fe6c7cf285f521dd912ef635ae2925ac11bfa9eddbf014493d71e029756b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_5.txt
MD5
a2a580db98baafe88982912d06befa64

SHA1
dce4f7af68efca42ac7732870b05f5055846f0f3

SHA256
18310737141e60462bb77bc7e1cd3024fa3308c96f0e2dd37a71b995c72f3a09

SHA512
c4a4887659212674112c4eb40baf2bf227a4b04a9b2c140ea142cc2a47a1cd73c4a0fe6c7cf285f521dd912ef635ae2925ac11bfa9eddbf014493d71e029756b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_6.exe
MD5
9065c4e9a648b1be7c03db9b25bfcf2a

SHA1
6ee58f69e199bbc1c7653a4e8621dd583ec6ac61

SHA256
8bd28ed722c7ce293f0a9ce3644e595965e448354ec231cfca25f887605c6f47

SHA512
ad09b354bb85f7534102da2e35ebd4dd5b5c35809e8726968f96170726abd997927e5aa8bc1390571152552361fa139fe04c7a9830b94e627541cc1fd51a329d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_6.txt
MD5
9065c4e9a648b1be7c03db9b25bfcf2a

SHA1
6ee58f69e199bbc1c7653a4e8621dd583ec6ac61

SHA256
8bd28ed722c7ce293f0a9ce3644e595965e448354ec231cfca25f887605c6f47

SHA512
ad09b354bb85f7534102da2e35ebd4dd5b5c35809e8726968f96170726abd997927e5aa8bc1390571152552361fa139fe04c7a9830b94e627541cc1fd51a329d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.exe
MD5
4668a7d4b9f6b8f672fc9292dd4744c1

SHA1
0de41192524e78fd816256fd166845b7ca0b0a92

SHA256
f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db

SHA512
f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.txt
MD5
4668a7d4b9f6b8f672fc9292dd4744c1

SHA1
0de41192524e78fd816256fd166845b7ca0b0a92

SHA256
f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db

SHA512
f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_8.exe
MD5
69fc838583e8b440224db92056131e86

SHA1
a9939288bff48a284b8a6639a3cf99d3ffe65bf2

SHA256
f3b6310267708b944d216b6076b68f97111b5230db97a37d84fe759c441295f6

SHA512
b4ee74a25607eaac2910eda1953bef56d010ea4bda5d17e8d61f4d34c3ca0301ab2465f41a9644c03fdf7183910953dbbf8da51c7f02f6da5463ff7355080a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_8.txt
MD5
69fc838583e8b440224db92056131e86

SHA1
a9939288bff48a284b8a6639a3cf99d3ffe65bf2

SHA256
f3b6310267708b944d216b6076b68f97111b5230db97a37d84fe759c441295f6

SHA512
b4ee74a25607eaac2910eda1953bef56d010ea4bda5d17e8d61f4d34c3ca0301ab2465f41a9644c03fdf7183910953dbbf8da51c7f02f6da5463ff7355080a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe
MD5
55ab593b5eb8ec1e1fd06be8730df3d7

SHA1
dc15bde4ba775b9839472735c0ec13577aa2bf79

SHA256
020463cd59e09900861e72453b1b1516ea628532b7441192c07272f8356d1179

SHA512
bec85c4f9f201785d13faf6dbe6267c0a685e4c1272046d5aa231304b6ed7b80ce25e6e6d7f807ede53880bce311a0902e06518c897605b6dc4a27b77a39749f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe
MD5
55ab593b5eb8ec1e1fd06be8730df3d7

SHA1
dc15bde4ba775b9839472735c0ec13577aa2bf79

SHA256
020463cd59e09900861e72453b1b1516ea628532b7441192c07272f8356d1179

SHA512
bec85c4f9f201785d13faf6dbe6267c0a685e4c1272046d5aa231304b6ed7b80ce25e6e6d7f807ede53880bce311a0902e06518c897605b6dc4a27b77a39749f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files.exe
MD5
47cd23007e0a8cf522c380f10d3be548

SHA1
f302b0397aacce44658f6f7b53d074509d755d8a

SHA256
bf2a431dc29c4c9d3dd7bfe7d1be3c9ed8925767882ac7b21573a0ee4e3f41b3

SHA512
2bbee20d410d179495f493014f736f49495d6aed33326a629d953774f99442c81d7382b7207f852911b5b903b28179eaa4b1e8717be24e6a27d3c30175dbac87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files.exe
MD5
47cd23007e0a8cf522c380f10d3be548

SHA1
f302b0397aacce44658f6f7b53d074509d755d8a

SHA256
bf2a431dc29c4c9d3dd7bfe7d1be3c9ed8925767882ac7b21573a0ee4e3f41b3

SHA512
2bbee20d410d179495f493014f736f49495d6aed33326a629d953774f99442c81d7382b7207f852911b5b903b28179eaa4b1e8717be24e6a27d3c30175dbac87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folder.exe
MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folder.exe
MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folder.exe
MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Info.exe
MD5
92acb4017f38a7ee6c5d2f6ef0d32af2

SHA1
1b932faf564f18ccc63e5dabff5c705ac30a61b8

SHA256
2459694049abfe227ddcf5b4d813fe3ae8e1e9066de5228acf20c958d425c2e1

SHA512
d385b2857d934628e1df3ef493b3a33e2a042c5974d9c153c126a86a28fc61bcc02db0a0791c225378994737a16cd35b74f217600d4b837cda779200c9faeb73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Info.exe
MD5
92acb4017f38a7ee6c5d2f6ef0d32af2

SHA1
1b932faf564f18ccc63e5dabff5c705ac30a61b8

SHA256
2459694049abfe227ddcf5b4d813fe3ae8e1e9066de5228acf20c958d425c2e1

SHA512
d385b2857d934628e1df3ef493b3a33e2a042c5974d9c153c126a86a28fc61bcc02db0a0791c225378994737a16cd35b74f217600d4b837cda779200c9faeb73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe
MD5
6db938b22272369c0c2f1589fae2218f

SHA1
8279d75d704aaf9346e8f86df5aa1f2e8a734bb9

SHA256
a3f4061d3d60ae5a3ee4a168f1bec3790e1927f77184915a821d1eade478677e

SHA512
a83cae75c7d9f98e4841f1517ec6ea867731f3f3c52a2f12c372be01c7da0a53d458eadfc61309a906ed63c48ca80194ddf52a084044a20e8a2bd3679e492c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe
MD5
6db938b22272369c0c2f1589fae2218f

SHA1
8279d75d704aaf9346e8f86df5aa1f2e8a734bb9

SHA256
a3f4061d3d60ae5a3ee4a168f1bec3790e1927f77184915a821d1eade478677e

SHA512
a83cae75c7d9f98e4841f1517ec6ea867731f3f3c52a2f12c372be01c7da0a53d458eadfc61309a906ed63c48ca80194ddf52a084044a20e8a2bd3679e492c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Installation.exe
MD5
388d7fcda38028b69216261fce678fd5

SHA1
6a62a5060438a6e70d5271ac83ee255c372fd1ba

SHA256
bbcaa9da67933eb2039d79ad2419099dafdc5f4370170cbcd028c07afd7b6b8f

SHA512
e27d1dfdd04cf21cfa8f748515a5eb91d7a40db879661de4fde17d3b9de3786a611265b9196eac67c482375f16370dc9674d716e6de8df36fd0f92bf34441bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Installation.exe
MD5
388d7fcda38028b69216261fce678fd5

SHA1
6a62a5060438a6e70d5271ac83ee255c372fd1ba

SHA256
bbcaa9da67933eb2039d79ad2419099dafdc5f4370170cbcd028c07afd7b6b8f

SHA512
e27d1dfdd04cf21cfa8f748515a5eb91d7a40db879661de4fde17d3b9de3786a611265b9196eac67c482375f16370dc9674d716e6de8df36fd0f92bf34441bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
17ca6d3d631e127a68546893deb72e25

SHA1
ffaeea06da0a817c9152db826d65384d8eb9c724

SHA256
2b3bebb4ebf3389810eaecb6b7f0c8f8ed55b7d7b7777b3ffd5f974f4ad63143

SHA512
de25aabadab675c262fc7717df3f8ca6a7da9d7566a7a994ea04acf4207ce059a70421f3818a153396a9bbc13a98beaef334b93ab06b139f4ca163e350b19825

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
17ca6d3d631e127a68546893deb72e25

SHA1
ffaeea06da0a817c9152db826d65384d8eb9c724

SHA256
2b3bebb4ebf3389810eaecb6b7f0c8f8ed55b7d7b7777b3ffd5f974f4ad63143

SHA512
de25aabadab675c262fc7717df3f8ca6a7da9d7566a7a994ea04acf4207ce059a70421f3818a153396a9bbc13a98beaef334b93ab06b139f4ca163e350b19825

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
MD5
954264f2ba5b24bbeecb293be714832c

SHA1
fde3ad6e6d8ab951b002c7ca17e867bf3c1d9ba0

SHA256
db5906a6a58c5f7e8991fb5c3a7201843142844650eb5b89bdf89094aba9e96c

SHA512
8fb15e5888d713e10df04b64c0a24250547a978eac9a7b25d653c343f01afc204fa661937a76644a2dcd3f5b65225450d3aaecb67014125a50722df21467ee53

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
MD5
954264f2ba5b24bbeecb293be714832c

SHA1
fde3ad6e6d8ab951b002c7ca17e867bf3c1d9ba0

SHA256
db5906a6a58c5f7e8991fb5c3a7201843142844650eb5b89bdf89094aba9e96c

SHA512
8fb15e5888d713e10df04b64c0a24250547a978eac9a7b25d653c343f01afc204fa661937a76644a2dcd3f5b65225450d3aaecb67014125a50722df21467ee53

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Installations.exe
MD5
128a8139deaf665018019b61025c099f

SHA1
c2954ffeda92e1d4bad2a416afb8386ffd8fe828

SHA256
e10f5bc4cb6610bd2aee334a581f2a9872b16c830bdce2f67ffe3cf57bf0b065

SHA512
eb6bf322f941776245cebac5e26dd6721a1517eac0fac12b9e05466c17f1e1ffcdb6eda63365287b99d39fd30642a84bc120e95f2c19f7656d3c75c3d0772bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Installations.exe
MD5
128a8139deaf665018019b61025c099f

SHA1
c2954ffeda92e1d4bad2a416afb8386ffd8fe828

SHA256
e10f5bc4cb6610bd2aee334a581f2a9872b16c830bdce2f67ffe3cf57bf0b065

SHA512
eb6bf322f941776245cebac5e26dd6721a1517eac0fac12b9e05466c17f1e1ffcdb6eda63365287b99d39fd30642a84bc120e95f2c19f7656d3c75c3d0772bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat
MD5
403a3ca597d4c6ccbc10efe5b1c3f936

SHA1
9414113836782991eedfb66adef25f477a2eeb18

SHA256
3c2e0510af3d7096b3154434803a763b930e486d74f7ec1fd0b6beca295cf75c

SHA512
a8abd3094bb151829da2122b98fd0c013ba81db40b688e1abfc6745c5e27fe570c011a9e1c77ed364db9c68b7f83df392e4558cdc35af620deb2b2fc473b99c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat
MD5
13abe7637d904829fbb37ecda44a1670

SHA1
de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f

SHA256
7a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6

SHA512
6e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
MD5
f6fa4c09ce76fd0ce97d147751023a58

SHA1
9778955cdf7af23e4e31bfe94d06747c3a4a4511

SHA256
bf95bc109f6d9577ccc4fefdc9c9ffcb3b5f4bf53ea0751044255bd7bffa5d78

SHA512
41435375bcd2a61611b8bd83393220f6215110427656bf803d2d4e8385665d6953c28d14b8788d530bc24c8f3a022d2c4d94ca2ac5c48e39c2d9411e4bc947a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
MD5
f6fa4c09ce76fd0ce97d147751023a58

SHA1
9778955cdf7af23e4e31bfe94d06747c3a4a4511

SHA256
bf95bc109f6d9577ccc4fefdc9c9ffcb3b5f4bf53ea0751044255bd7bffa5d78

SHA512
41435375bcd2a61611b8bd83393220f6215110427656bf803d2d4e8385665d6953c28d14b8788d530bc24c8f3a022d2c4d94ca2ac5c48e39c2d9411e4bc947a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pub2.exe
MD5
7c096137b7aeac8c060e1ca112426939

SHA1
16f10b11fa26f820f28c3a3d5a65d3351be76f0c

SHA256
8ff01ff179e77e6d9c475d50b5fb9999f508f346224c594c742297026a715df8

SHA512
c0a0586f3d0096cabd0c18a4f064d1cfba00cfcda600893eab58e5cdb6ea9a260111d23734dca62015d5a91ac4d98b44696718c0c3245b9052a492fcc4182b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pub2.exe
MD5
7c096137b7aeac8c060e1ca112426939

SHA1
16f10b11fa26f820f28c3a3d5a65d3351be76f0c

SHA256
8ff01ff179e77e6d9c475d50b5fb9999f508f346224c594c742297026a715df8

SHA512
c0a0586f3d0096cabd0c18a4f064d1cfba00cfcda600893eab58e5cdb6ea9a260111d23734dca62015d5a91ac4d98b44696718c0c3245b9052a492fcc4182b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
MD5
0ad600b00aa2381172fefcadfd558f94

SHA1
d761bd0ea41910dd981919c2e520b04b3e23b443

SHA256
f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215

SHA512
92d4561b6793b20293de88bedd36ad4d3c74492b5926efd61588e83f8be8c863a9309596b63ca0591829929f45196f08f14e718163ed1c00e93b04ef844c6ea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
MD5
0ad600b00aa2381172fefcadfd558f94

SHA1
d761bd0ea41910dd981919c2e520b04b3e23b443

SHA256
f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215

SHA512
92d4561b6793b20293de88bedd36ad4d3c74492b5926efd61588e83f8be8c863a9309596b63ca0591829929f45196f08f14e718163ed1c00e93b04ef844c6ea6

Download Submit
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
\Users\Admin\AppData\Local\Temp\CC4F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
memory/60-443-0x0000000000000000-mapping.dmp

Download
memory/60-497-0x0000000002C80000-0x0000000002DCA000-memory.dmp

Filesize
1.3MB

Download
memory/60-500-0x0000000000400000-0x0000000002C80000-memory.dmp

Filesize
40.5MB

Download
memory/68-246-0x000001E321F00000-0x000001E321F71000-memory.dmp

Filesize
452KB

Download
memory/184-342-0x0000000004B70000-0x0000000004B78000-memory.dmp

Filesize
32KB

Download
memory/184-343-0x0000000006CA0000-0x0000000006CA8000-memory.dmp

Filesize
32KB

Download
memory/184-345-0x0000000006CA0000-0x0000000006CA8000-memory.dmp

Filesize
32KB

Download
memory/184-133-0x0000000000400000-0x0000000000651000-memory.dmp

Filesize
2.3MB

Download
memory/184-344-0x0000000004AC0000-0x0000000004AC8000-memory.dmp

Filesize
32KB

Download
memory/184-341-0x0000000004820000-0x0000000004828000-memory.dmp

Filesize
32KB

Download
memory/184-126-0x0000000000000000-mapping.dmp

Download
memory/184-348-0x0000000003470000-0x00000000034D0000-memory.dmp

Filesize
384KB

Download
memory/184-347-0x0000000006CA0000-0x0000000006CA8000-memory.dmp

Filesize
32KB

Download
memory/184-346-0x0000000004AC0000-0x0000000004AC8000-memory.dmp

Filesize
32KB

Download
memory/400-215-0x0000000000000000-mapping.dmp

Download
memory/568-241-0x00000260750A0000-0x0000026075111000-memory.dmp

Filesize
452KB

Download
memory/568-237-0x0000026074FE0000-0x000002607502C000-memory.dmp

Filesize
304KB

Download
memory/596-261-0x0000019047C60000-0x0000019047CD1000-memory.dmp

Filesize
452KB

Download
memory/996-499-0x000000001B9D0000-0x000000001B9D2000-memory.dmp

Filesize
8KB

Download
memory/996-454-0x0000000000000000-mapping.dmp

Download
memory/1076-245-0x000001F319E70000-0x000001F319EE1000-memory.dmp

Filesize
452KB

Download
memory/1204-280-0x00000168EFD60000-0x00000168EFDD1000-memory.dmp

Filesize
452KB

Download
memory/1212-270-0x000001F680D40000-0x000001F680DB1000-memory.dmp

Filesize
452KB

Download
memory/1404-284-0x00000252C4950000-0x00000252C49C1000-memory.dmp

Filesize
452KB

Download
memory/1560-557-0x0000000000000000-mapping.dmp

Download
memory/1852-263-0x0000028E5AEA0000-0x0000028E5AF11000-memory.dmp

Filesize
452KB

Download
memory/2216-459-0x0000000000430000-0x00000000004DE000-memory.dmp

Filesize
696KB

Download
memory/2216-452-0x0000000000000000-mapping.dmp

Download
memory/2216-457-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2300-218-0x0000000000000000-mapping.dmp

Download
memory/2424-234-0x000001ACF6040000-0x000001ACF60B1000-memory.dmp

Filesize
452KB

Download
memory/2476-224-0x00000141E4560000-0x00000141E45D1000-memory.dmp

Filesize
452KB

Download
memory/2696-285-0x000001BB25840000-0x000001BB258B1000-memory.dmp

Filesize
452KB

Download
memory/2708-297-0x000001F04BD80000-0x000001F04BDF1000-memory.dmp

Filesize
452KB

Download
memory/2788-243-0x0000027922B70000-0x0000027922BE1000-memory.dmp

Filesize
452KB

Download
memory/2880-189-0x0000000000000000-mapping.dmp

Download
memory/2976-264-0x0000000004910000-0x00000000049AD000-memory.dmp

Filesize
628KB

Download
memory/2976-274-0x0000000000400000-0x0000000004424000-memory.dmp

Filesize
64.1MB

Download
memory/2976-208-0x0000000000000000-mapping.dmp

Download
memory/2996-269-0x0000000000E60000-0x0000000000E75000-memory.dmp

Filesize
84KB

Download
memory/3136-116-0x0000000000000000-mapping.dmp

Download
memory/3416-124-0x0000000000000000-mapping.dmp

Download
memory/3628-559-0x0000000000000000-mapping.dmp

Download
memory/3644-444-0x0000000000000000-mapping.dmp

Download
memory/3744-203-0x0000000000000000-mapping.dmp

Download
memory/3836-121-0x0000000000000000-mapping.dmp

Download
memory/3912-446-0x0000000000000000-mapping.dmp

Download
memory/3912-501-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3948-277-0x0000000000000000-mapping.dmp

Download
memory/4100-496-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/4100-447-0x0000000000000000-mapping.dmp

Download
memory/4104-207-0x0000000000000000-mapping.dmp

Download
memory/4112-129-0x0000000000000000-mapping.dmp

Download
memory/4124-213-0x0000000000000000-mapping.dmp

Download
memory/4128-533-0x0000000000000000-mapping.dmp

Download
memory/4144-228-0x0000000000000000-mapping.dmp

Download
memory/4144-267-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/4144-279-0x0000000000400000-0x00000000043C8000-memory.dmp

Filesize
63.8MB

Download
memory/4156-132-0x0000000000000000-mapping.dmp

Download
memory/4184-324-0x00007FF635214060-mapping.dmp

Download
memory/4184-328-0x000001B4B4C70000-0x000001B4B4CE4000-memory.dmp

Filesize
464KB

Download
memory/4184-395-0x000001B4B7600000-0x000001B4B7706000-memory.dmp

Filesize
1.0MB

Download
memory/4184-393-0x000001B4B6680000-0x000001B4B669B000-memory.dmp

Filesize
108KB

Download
memory/4184-327-0x000001B4B4AE0000-0x000001B4B4B2E000-memory.dmp

Filesize
312KB

Download
memory/4188-134-0x0000000000000000-mapping.dmp

Download
memory/4188-159-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/4188-168-0x0000000000400000-0x0000000002BF1000-memory.dmp

Filesize
39.9MB

Download
memory/4192-456-0x0000000000000000-mapping.dmp

Download
memory/4216-438-0x0000000000000000-mapping.dmp

Download
memory/4216-494-0x0000000004930000-0x0000000004F36000-memory.dmp

Filesize
6.0MB

Download
memory/4220-210-0x0000000000000000-mapping.dmp

Download
memory/4244-153-0x0000000002FF0000-0x0000000002FF2000-memory.dmp

Filesize
8KB

Download
memory/4244-151-0x0000000001380000-0x000000000139C000-memory.dmp

Filesize
112KB

Download
memory/4244-138-0x0000000000000000-mapping.dmp

Download
memory/4244-152-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/4244-150-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/4244-147-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/4248-248-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/4248-258-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/4248-223-0x0000000000000000-mapping.dmp

Download
memory/4248-271-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/4248-272-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/4276-532-0x0000000000000000-mapping.dmp

Download
memory/4292-527-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4292-517-0x0000000000000000-mapping.dmp

Download
memory/4300-143-0x0000000000000000-mapping.dmp

Download
memory/4308-201-0x0000000000000000-mapping.dmp

Download
memory/4332-282-0x0000000004550000-0x000000000457F000-memory.dmp

Filesize
188KB

Download
memory/4332-290-0x0000000008920000-0x0000000008921000-memory.dmp

Filesize
4KB

Download
memory/4332-304-0x0000000004932000-0x0000000004933000-memory.dmp

Filesize
4KB

Download
memory/4332-305-0x0000000004933000-0x0000000004934000-memory.dmp

Filesize
4KB

Download
memory/4332-306-0x00000000094F0000-0x00000000094F1000-memory.dmp

Filesize
4KB

Download
memory/4332-307-0x0000000009520000-0x0000000009521000-memory.dmp

Filesize
4KB

Download
memory/4332-303-0x0000000008E50000-0x0000000008E51000-memory.dmp

Filesize
4KB

Download
memory/4332-295-0x0000000000400000-0x00000000043E1000-memory.dmp

Filesize
63.9MB

Download
memory/4332-289-0x0000000006150000-0x000000000616B000-memory.dmp

Filesize
108KB

Download
memory/4332-296-0x0000000004934000-0x0000000004936000-memory.dmp

Filesize
8KB

Download
memory/4332-316-0x0000000009570000-0x0000000009571000-memory.dmp

Filesize
4KB

Download
memory/4332-294-0x0000000008E20000-0x0000000008E39000-memory.dmp

Filesize
100KB

Download
memory/4332-320-0x0000000009700000-0x0000000009701000-memory.dmp

Filesize
4KB

Download
memory/4332-247-0x0000000000000000-mapping.dmp

Download
memory/4332-302-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/4452-154-0x0000000000000000-mapping.dmp

Download
memory/4484-156-0x0000000000000000-mapping.dmp

Download
memory/4596-232-0x0000000000000000-mapping.dmp

Download
memory/4612-233-0x0000000000000000-mapping.dmp

Download
memory/4676-524-0x0000000000400000-0x000000000309A000-memory.dmp

Filesize
44.6MB

Download
memory/4676-513-0x0000000005140000-0x0000000005A66000-memory.dmp

Filesize
9.1MB

Download
memory/4676-460-0x0000000000000000-mapping.dmp

Download
memory/4680-161-0x0000000000000000-mapping.dmp

Download
memory/4680-505-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download
memory/4680-498-0x0000000002D90000-0x0000000002D99000-memory.dmp

Filesize
36KB

Download
memory/4680-448-0x0000000000000000-mapping.dmp

Download
memory/4684-537-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/4684-521-0x0000000000000000-mapping.dmp

Download
memory/4684-536-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/4684-535-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4700-221-0x0000000000000000-mapping.dmp

Download
memory/4756-222-0x0000000000000000-mapping.dmp

Download
memory/4876-165-0x0000000000000000-mapping.dmp

Download
memory/4876-214-0x00000000011A0000-0x00000000011FD000-memory.dmp

Filesize
372KB

Download
memory/4876-209-0x0000000004B26000-0x0000000004C27000-memory.dmp

Filesize
1.0MB

Download
memory/4888-220-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4888-187-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4888-188-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4888-184-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4888-183-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4888-166-0x0000000000000000-mapping.dmp

Download
memory/4888-227-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4888-231-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4888-216-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4900-439-0x0000000000000000-mapping.dmp

Download
memory/4900-475-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/4960-531-0x0000000000000000-mapping.dmp

Download
memory/4976-441-0x0000000000000000-mapping.dmp

Download
memory/4976-491-0x0000000001070000-0x0000000001072000-memory.dmp

Filesize
8KB

Download
memory/4992-311-0x0000000000417E3A-mapping.dmp

Download
memory/4992-309-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4992-319-0x0000000005050000-0x0000000005656000-memory.dmp

Filesize
6.0MB

Download
memory/5004-265-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/5004-262-0x0000000000B40000-0x0000000000B5F000-memory.dmp

Filesize
124KB

Download
memory/5004-238-0x0000000000000000-mapping.dmp

Download
memory/5004-276-0x000000001B370000-0x000000001B372000-memory.dmp

Filesize
8KB

Download
memory/5004-257-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/5004-250-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/5076-507-0x0000000000418E52-mapping.dmp

Download
memory/5076-522-0x0000000005550000-0x0000000005B56000-memory.dmp

Filesize
6.0MB

Download
memory/5096-528-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/5096-516-0x0000000000000000-mapping.dmp

Download
memory/5096-526-0x0000000004C42000-0x0000000004C43000-memory.dmp

Filesize
4KB

Download
memory/5112-211-0x000001E20B500000-0x000001E20B571000-memory.dmp

Filesize
452KB

Download
memory/5112-530-0x0000000000000000-mapping.dmp

Download
memory/5112-190-0x00007FF635214060-mapping.dmp

Download
memory/5144-555-0x0000000000000000-mapping.dmp

Download
memory/5216-466-0x0000000000000000-mapping.dmp

Download
memory/5244-291-0x0000000000000000-mapping.dmp

Download
memory/5388-556-0x0000000000000000-mapping.dmp

Download
memory/5420-308-0x0000027A7C620000-0x0000027A7C630000-memory.dmp

Filesize
64KB

Download
memory/5420-310-0x0000027A7C720000-0x0000027A7C730000-memory.dmp

Filesize
64KB

Download
memory/5484-440-0x0000000000000000-mapping.dmp

Download
memory/5652-449-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/5652-437-0x0000000000000000-mapping.dmp

Download
memory/5880-322-0x0000000000000000-mapping.dmp

Download