fabookie | b3b62cb04437802ec78718be852b36c1fee33e8aed8538ccaf069edc57676b23

Analysis

max time kernel
11s
max time network
110s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
13/03/2025, 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_installer.exe
Size

7.7MB
MD5

6d74d7fdedfd638c81a396151a32de81
SHA1

8c9a62cd9f92beaf135ef6bc56d13d300af41207
SHA256

ad0d5e12252297d905e3b73eb4bf007bf26b5b3dfcae99b5d0e52c6165d0cb26
SHA512

63e9c099d35399b7cb278d01ee66f630f090d55d4bda21e37a09b6a12e5bd4ad035440fb6064f0e880d999dc08c6e9d429237112723c4d9ec08c564f4a391e13
SSDEEP

196608:xPLUCgfWXHx55I2cRKWI885YLO2Rmk8p3xqibcxhJeN3UNhDkMDDhA:xTdgf855IRVIR5Yq2gzxuGy++K

Score

10^/10

fabookie nullmixer raccoon redline socelars vidar 164fb74855c13a4287d8fe7ac579a35bdf7002ab 915 media19n v3user1 aspackv2 discovery dropper execution infostealer persistence spyware stealer upx

Malware Config

Extracted

Family

socelars

http://www.biohazardgraphics.com/

Extracted

Family

redline

Botnet

media19n

65.108.69.168:13293

Attributes

auth_value
d6d1029ee103315c8e2d6f15b37e84fc

Extracted

Family

nullmixer

http://kelenxz.xyz/

Extracted

Family

raccoon

Botnet

164fb74855c13a4287d8fe7ac579a35bdf7002ab

Attributes

url4cnc
http://194.180.174.53/takecareandkeepitup

http://91.219.236.18/takecareandkeepitup

http://194.180.174.41/takecareandkeepitup

http://91.219.236.148/takecareandkeepitup

https://t.me/takecareandkeepitup

rc4.plain

Extracted

Family

redline

Botnet

v3user1

159.69.246.184:13127

Attributes

auth_value
54df5250af9cbc5099c3e1e6f9e897c0

Extracted

Family

vidar

Version

49.1

Botnet

915

https://noc.social/@sergeev46

https://c.im/@sergeev47

Attributes

profile_id
915

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000027df4-115.dat	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Fabookie family
fabookie
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
Nullmixer family
nullmixer
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/880-188-0x0000000000400000-0x0000000003D6C000-memory.dmp	family_raccoon_v1
behavioral2/memory/880-185-0x0000000000400000-0x0000000003D6C000-memory.dmp	family_raccoon_v1
behavioral2/memory/880-180-0x0000000000400000-0x0000000003D6C000-memory.dmp	family_raccoon_v1
behavioral2/memory/880-227-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/880-226-0x0000000000400000-0x0000000003D6C000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4792-214-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/4696-265-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Redline family
redline
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Socelars family
socelars

Socelars payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000027df1-148.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000a000000027df4-115.dat	Nirsoft
behavioral2/memory/3336-305-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/3844-323-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x000a000000027df4-115.dat	WebBrowserPassView
behavioral2/memory/3844-323-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/404-263-0x0000000000400000-0x0000000000536000-memory.dmp	family_vidar
behavioral2/memory/404-317-0x0000000000400000-0x0000000000536000-memory.dmp	family_vidar

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3452	powershell.exe
3312	powershell.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a000000027ded-55.dat	aspack_v212_v242
behavioral2/files/0x000a000000027dec-58.dat	aspack_v212_v242
behavioral2/files/0x000a000000027def-63.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1252571373-3012572919-3982031544-1000\Control Panel\International\Geo\Nation	Sat19eb375798ed72201.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1252571373-3012572919-3982031544-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1252571373-3012572919-3982031544-1000\Control Panel\International\Geo\Nation	Sat198f04ccae0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1252571373-3012572919-3982031544-1000\Control Panel\International\Geo\Nation	Sat195518974c.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1252571373-3012572919-3982031544-1000\Control Panel\International\Geo\Nation	Sat19a9aebcde6f786.exe

Executes dropped EXE 26 IoCs

pid	Process
4620	setup_install.exe
476	Sat1998dc915b0dd3a69.exe
1588	Sat19d470e8e0597fc47.exe
404	Sat196a179a23a4a4a2.exe
1208	Sat194d446031aec9ca.exe
1052	Sat195518974c.exe
3060	Sat194837533b1da14.exe
3504	Sat19ccc19655a1ffcf.exe
3100	Sat1971d73793fd.exe
3028	Sat19a9aebcde6f786.exe
5116	Sat192603358e4defd.exe
1480	Sat198f04ccae0.exe
1868	@.cmd
5016	Sat19f1c04426464e86.exe
3152	Sat1903c7a13784132f6.exe
4640	Sat191705f5bd9d1.exe
388	Sat198ad4994ac28a.exe
4676	Sat19eb375798ed72201.exe
2540	Sat195518974c.tmp
4960	Sat195518974c.exe
4160	Sat19a9aebcde6f786.exe
4208	Sat195518974c.tmp
880	@.cmd
2448	Sat19d470e8e0597fc47.exe
4792	Sat192603358e4defd.exe
4728	Sat19d470e8e0597fc47.exe

Loads dropped DLL 10 IoCs

pid	Process
4620	setup_install.exe
4620	setup_install.exe
4620	setup_install.exe
4620	setup_install.exe
4620	setup_install.exe
4620	setup_install.exe
2540	Sat195518974c.tmp
4208	Sat195518974c.tmp
4128	rundll32.exe
4128	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Sat1971d73793fd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
8	iplogger.org
65	iplogger.org
117	iplogger.org
121	iplogger.org
129	iplogger.org
136	iplogger.org
142	iplogger.org
152	iplogger.org
12	iplogger.org
43	iplogger.org
114	iplogger.org
125	iplogger.org
132	iplogger.org
146	iplogger.org
158	iplogger.org
155	iplogger.org
23	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 880	1868	@.cmd	137
PID 5116 set thread context of 4792	5116	Sat192603358e4defd.exe	131

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000027e08-146.dat	upx
behavioral2/memory/1868-154-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/1868-202-0x0000000000400000-0x000000000044E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1760	4620	WerFault.exe	84
2604	3504	WerFault.exe	115
4968	880	WerFault.exe	137
4380	388	WerFault.exe	121
4048	404	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat19d470e8e0597fc47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat19ccc19655a1ffcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat1903c7a13784132f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat198ad4994ac28a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat1998dc915b0dd3a69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat1971d73793fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat195518974c.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat191705f5bd9d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat19a9aebcde6f786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat196a179a23a4a4a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat198f04ccae0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat192603358e4defd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat195518974c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat19eb375798ed72201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat19a9aebcde6f786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat195518974c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat192603358e4defd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat195518974c.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat198ad4994ac28a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat198ad4994ac28a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat198ad4994ac28a.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4444	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3452	powershell.exe
3452	powershell.exe
3312	powershell.exe
3312	powershell.exe
3452	powershell.exe
3452	powershell.exe
1868	@.cmd
1868	@.cmd
3312	powershell.exe
3312	powershell.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	Sat19d470e8e0597fc47.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeDebugPrivilege	5016	Sat19f1c04426464e86.exe
Token: SeDebugPrivilege	5116	Sat192603358e4defd.exe
Token: SeCreateTokenPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeAssignPrimaryTokenPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeLockMemoryPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeIncreaseQuotaPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeMachineAccountPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeTcbPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeSecurityPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeTakeOwnershipPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeLoadDriverPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeSystemProfilePrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeSystemtimePrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeProfSingleProcessPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeIncBasePriorityPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeCreatePagefilePrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeCreatePermanentPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeBackupPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeRestorePrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeShutdownPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeDebugPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeAuditPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeSystemEnvironmentPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeChangeNotifyPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeRemoteShutdownPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeUndockPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeSyncAgentPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeEnableDelegationPrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeManageVolumePrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeImpersonatePrivilege	3152	Sat1903c7a13784132f6.exe
Token: SeCreateGlobalPrivilege	3152	Sat1903c7a13784132f6.exe
Token: 31	3152	Sat1903c7a13784132f6.exe
Token: 32	3152	Sat1903c7a13784132f6.exe
Token: 33	3152	Sat1903c7a13784132f6.exe
Token: 34	3152	Sat1903c7a13784132f6.exe
Token: 35	3152	Sat1903c7a13784132f6.exe
Token: SeDebugPrivilege	1208	Sat194d446031aec9ca.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4620	2248	setup_installer.exe	84
PID 2248 wrote to memory of 4620	2248	setup_installer.exe	84
PID 2248 wrote to memory of 4620	2248	setup_installer.exe	84
PID 4620 wrote to memory of 4928	4620	setup_install.exe	87
PID 4620 wrote to memory of 4928	4620	setup_install.exe	87
PID 4620 wrote to memory of 4928	4620	setup_install.exe	87
PID 4620 wrote to memory of 3720	4620	setup_install.exe	88
PID 4620 wrote to memory of 3720	4620	setup_install.exe	88
PID 4620 wrote to memory of 3720	4620	setup_install.exe	88
PID 4928 wrote to memory of 3452	4928	cmd.exe	89
PID 4928 wrote to memory of 3452	4928	cmd.exe	89
PID 4928 wrote to memory of 3452	4928	cmd.exe	89
PID 3720 wrote to memory of 3312	3720	cmd.exe	90
PID 3720 wrote to memory of 3312	3720	cmd.exe	90
PID 3720 wrote to memory of 3312	3720	cmd.exe	90
PID 4620 wrote to memory of 3820	4620	setup_install.exe	91
PID 4620 wrote to memory of 3820	4620	setup_install.exe	91
PID 4620 wrote to memory of 3820	4620	setup_install.exe	91
PID 4620 wrote to memory of 3248	4620	setup_install.exe	92
PID 4620 wrote to memory of 3248	4620	setup_install.exe	92
PID 4620 wrote to memory of 3248	4620	setup_install.exe	92
PID 4620 wrote to memory of 4068	4620	setup_install.exe	93
PID 4620 wrote to memory of 4068	4620	setup_install.exe	93
PID 4620 wrote to memory of 4068	4620	setup_install.exe	93
PID 4620 wrote to memory of 3088	4620	setup_install.exe	94
PID 4620 wrote to memory of 3088	4620	setup_install.exe	94
PID 4620 wrote to memory of 3088	4620	setup_install.exe	94
PID 4620 wrote to memory of 1348	4620	setup_install.exe	95
PID 4620 wrote to memory of 1348	4620	setup_install.exe	95
PID 4620 wrote to memory of 1348	4620	setup_install.exe	95
PID 4620 wrote to memory of 1784	4620	setup_install.exe	96
PID 4620 wrote to memory of 1784	4620	setup_install.exe	96
PID 4620 wrote to memory of 1784	4620	setup_install.exe	96
PID 4620 wrote to memory of 1364	4620	setup_install.exe	97
PID 4620 wrote to memory of 1364	4620	setup_install.exe	97
PID 4620 wrote to memory of 1364	4620	setup_install.exe	97
PID 4620 wrote to memory of 1524	4620	setup_install.exe	98
PID 4620 wrote to memory of 1524	4620	setup_install.exe	98
PID 4620 wrote to memory of 1524	4620	setup_install.exe	98
PID 4620 wrote to memory of 1144	4620	setup_install.exe	99
PID 4620 wrote to memory of 1144	4620	setup_install.exe	99
PID 4620 wrote to memory of 1144	4620	setup_install.exe	99
PID 4620 wrote to memory of 320	4620	setup_install.exe	100
PID 4620 wrote to memory of 320	4620	setup_install.exe	100
PID 4620 wrote to memory of 320	4620	setup_install.exe	100
PID 4620 wrote to memory of 228	4620	setup_install.exe	101
PID 4620 wrote to memory of 228	4620	setup_install.exe	101
PID 4620 wrote to memory of 228	4620	setup_install.exe	101
PID 4620 wrote to memory of 3048	4620	setup_install.exe	102
PID 4620 wrote to memory of 3048	4620	setup_install.exe	102
PID 4620 wrote to memory of 3048	4620	setup_install.exe	102
PID 4620 wrote to memory of 4316	4620	setup_install.exe	103
PID 4620 wrote to memory of 4316	4620	setup_install.exe	103
PID 4620 wrote to memory of 4316	4620	setup_install.exe	103
PID 4620 wrote to memory of 3644	4620	setup_install.exe	104
PID 4620 wrote to memory of 3644	4620	setup_install.exe	104
PID 4620 wrote to memory of 3644	4620	setup_install.exe	104
PID 4620 wrote to memory of 460	4620	setup_install.exe	105
PID 4620 wrote to memory of 460	4620	setup_install.exe	105
PID 4620 wrote to memory of 460	4620	setup_install.exe	105
PID 4620 wrote to memory of 3812	4620	setup_install.exe	106
PID 4620 wrote to memory of 3812	4620	setup_install.exe	106
PID 4620 wrote to memory of 3812	4620	setup_install.exe	106
PID 460 wrote to memory of 476	460	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\7zS8C831088\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS8C831088\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat19d470e8e0597fc47.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19d470e8e0597fc47.exe
      Sat19d470e8e0597fc47.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19d470e8e0597fc47.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19d470e8e0597fc47.exe
        5⤵
        Executes dropped EXE
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19d470e8e0597fc47.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19d470e8e0597fc47.exe
        5⤵
        Executes dropped EXE
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19d470e8e0597fc47.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19d470e8e0597fc47.exe
        5⤵
        
        PID:4696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat191705f5bd9d1.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat191705f5bd9d1.exe
      Sat191705f5bd9d1.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat195518974c.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat195518974c.exe
      Sat195518974c.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\is-J7KGM.tmp\Sat195518974c.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-J7KGM.tmp\Sat195518974c.tmp" /SL5="$A0028,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat195518974c.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat195518974c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat195518974c.exe" /SILENT
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\is-3A387.tmp\Sat195518974c.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3A387.tmp\Sat195518974c.tmp" /SL5="$30272,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat195518974c.exe" /SILENT
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat194d446031aec9ca.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat194d446031aec9ca.exe
      Sat194d446031aec9ca.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat196a179a23a4a4a2.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat196a179a23a4a4a2.exe
      Sat196a179a23a4a4a2.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 1796
        5⤵
        Program crash
        
        PID:4048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat19ccc19655a1ffcf.exe /mixtwo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19ccc19655a1ffcf.exe
      Sat19ccc19655a1ffcf.exe /mixtwo
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 444
        5⤵
        Program crash
        
        PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat1971d73793fd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat1971d73793fd.exe
      Sat1971d73793fd.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1868
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 612
        7⤵
        Program crash
        
        PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat198f04ccae0.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat198f04ccae0.exe
      Sat198f04ccae0.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1480
    - - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" .\5LQZ.CB
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\5LQZ.CB
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\5LQZ.CB
        7⤵
        
        PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat19a9aebcde6f786.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19a9aebcde6f786.exe
      Sat19a9aebcde6f786.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19a9aebcde6f786.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19a9aebcde6f786.exe" -u
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat194837533b1da14.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:320
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat194837533b1da14.exe
      Sat194837533b1da14.exe
      4⤵
      Executes dropped EXE
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat1903c7a13784132f6.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat1903c7a13784132f6.exe
      Sat1903c7a13784132f6.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3152
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:4048
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3100
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:4444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3028
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7fff6b42cc40,0x7fff6b42cc4c,0x7fff6b42cc58
        6⤵
        
        PID:4448
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1940 /prefetch:2
        6⤵
        
        PID:412
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2200 /prefetch:3
        6⤵
        
        PID:4588
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2252 /prefetch:8
        6⤵
        
        PID:4820
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3096 /prefetch:1
        6⤵
        
        PID:3020
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3240 /prefetch:1
        6⤵
        
        PID:4756
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4552,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4548 /prefetch:1
        6⤵
        
        PID:3684
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3992,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3620 /prefetch:8
        6⤵
        
        PID:4456
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3636,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4868 /prefetch:8
        6⤵
        
        PID:3024
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4504,i,985941282211481286,16459254780476024848,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4536 /prefetch:8
        6⤵
        
        PID:4296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat19f1c04426464e86.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19f1c04426464e86.exe
      Sat19f1c04426464e86.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat192603358e4defd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat192603358e4defd.exe
      Sat192603358e4defd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat192603358e4defd.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat192603358e4defd.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat198ad4994ac28a.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat198ad4994ac28a.exe
      Sat198ad4994ac28a.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      PID:388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 392
        5⤵
        Program crash
        
        PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat1998dc915b0dd3a69.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat1998dc915b0dd3a69.exe
      Sat1998dc915b0dd3a69.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat19eb375798ed72201.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19eb375798ed72201.exe
      Sat19eb375798ed72201.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4676
    - - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" .\5LQZ.CB
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\5LQZ.CB
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\5LQZ.CB
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\5LQZ.CB
        8⤵
        
        PID:4436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 596
    3⤵
    - Program crash
    PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4620 -ip 4620
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3504 -ip 3504
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 880 -ip 880
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 388 -ip 388
1⤵
PID:3028

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 404 -ip 404
1⤵
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:792

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6e1257b8-fe96-470a-9b79-2526f2d0f4ed.tmp

Filesize
123KB

MD5
f3eeac316d92c65aaa27ba13cf776b50

SHA1
eea6f7f3da544ea527e32036f004e9898c9f7a37

SHA256
8537d86f24e88649291edc800af0a5ae4a7cdfd0e209c7edb5697f0f5dd938c7

SHA512
4a28d33190048ace1c189f632791d2533d8cb38998b0be864c1f41baf73cd858a22c52d529e3113f9d279b5c2d05b4105b453c3a58cd2e2d76bcdc07dd9dfa98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8bd508d9-970c-42b5-b225-97e2e256658f.tmp

Filesize
17KB

MD5
bf61538684d0534d0168a398fda18fdc

SHA1
90210fe9e436e1175f94890788ae855724bf3499

SHA256
1a0f43142bd759abb31ce526ff68e015704b7b8364a83c9069fa65e3b43ece6c

SHA512
60d5a2d1f069e1bd304e76a1d8ed34101301780b3c4fa3334cdffd376c054b92f550088b8be8fd5245b92cdc8201e20ec058f99c2d4a5c633ad141b0546b6312

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
cd2c086bc3a1f1b78ea5b853746eac2a

SHA1
2a32c9a61c05633a746654287316dee3f765a806

SHA256
d3ab11dadde0b9c70782737f81e260fa2323c310388deddcf5b6ae3c7ffc1f1d

SHA512
b6654ad08628aeffe1212b04717bd5a4bd4a84defc5734c867467a18ef1eda669fbaf0fb4a98972e081b97e66772d0e1163cb9e458627a9afc964f62f606f4c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1c5f153a46806b57cf7afb6d3021e4c8

SHA1
805b1ff8519fa46708b3b288677251dbee793b71

SHA256
0a0a2e7e365ee8267037ce4077b4ae19c0ad82b1ffb7fb7a6004579db8635434

SHA512
5c9d282ff7600202af9705b7e3fbf646ab7dbd0c12961bdff8b0b26ac46d51bd1a95cd86ae7a6336203db2a5ef6d9a0a3db80f58ef2c872eb14c73579d6069a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
13dedee4b0faf4d1a71d961caa01c627

SHA1
7b75c670dfb801d451256815bfa0b61c23d90067

SHA256
6691521d886494021ab93fe3bd65842ac5b68733629665c405eb64651800d784

SHA512
a8234d19126e72688056a66289d76bf58e1b8e721c1fe7c1218c9b20486e0907660d4460a0ef1581441437b3df3c34ccca2ccc8050a51fcb9a6d042bf9089722

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
841fe62bfc6427409f265357e8af7638

SHA1
0fdc4d7db93addb60a7fed52f999e7c6759634c7

SHA256
301ad4f48370a43abc54a1055b646b0d58555b5fad1e315bdd6e5f982fc3be33

SHA512
76311234053e9cf810022a5b61cf65e86218e6f6bdaa88338f30a468ec3d9ab89b34b0fbe55a8320efa669398716b99f362f974f4c0462a6f6fa2e5cbb64d57e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
51a2e9cc36fb68e5deee6ea958ab40ce

SHA1
285181c693514dd3572c6fd0f18da7e6836030ce

SHA256
9f43756d1340ba8db589c1e9874299ee63524a31a2ba569a8721cf0629bdc02c

SHA512
ea3d4cb1bc29be9ad81ca2b3cf111c6a709e86b27a19eb5ac36ee10c46be43197a74833e703928f452e4459081d42fbb7929978566b54eb5b89bf67d2c52f2a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
ce854c96001ef6bc29a1732d67abc2c7

SHA1
3565db479f53b19ee02a5414c669128c2e3bb06f

SHA256
3b11ce530322fff2621f8b9cad22a573988cec8c9beaa83169f86a120090d7e4

SHA512
399f54bbc8f31454c957cfc871ed9b46baebb9fcac5f9ef615b3288020f0cad7f8212f0a39c14468f5237e6cbf33b21defc03b4d0833cb2590709f3920b4c443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sat192603358e4defd.exe.log

Filesize
700B

MD5
6c73acc93de14f5ec2f4ace1815669fc

SHA1
c7b507af5bc23cf42b1e8695a7952181b5d26276

SHA256
2c8c2b0e4d080458c9ed1e7888638fd679f803af6dc209f5369dcf0f1f2ef402

SHA512
b43128abf691951c5894040ba75c2e7731661d9a05f6d604291a4a60598e975b84a27c4ab7b944d106e5d17712492c079e3bf313236daca2c238fb610b6e9576

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat1903c7a13784132f6.exe

Filesize
1.4MB

MD5
10ac4fba5de09218407797cd1f2bdd20

SHA1
5c8c85d2c19ae6d0f654d4cb38f4ce12701420df

SHA256
c2775e2de2efe890dcde3454f0e2e0fd42e3977a0e2273662c1df1e0386f5b2f

SHA512
327293760da1ddf59238ab371e2b1d7ec34a724090f14e566dff33a9789f7ad75832d966ae84211c5d36e78cea34be5512e70542972f556b905326cddcba2890

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat191705f5bd9d1.exe

Filesize
127KB

MD5
0eb499e630955e9229c5fab1ae1acec8

SHA1
7b8afd14d3dc321ae417d63e976152c9fdfac881

SHA256
8d2e1e1fb84e28d67a81a138bbd254bb7bb864daff6d8dc3c11edfcf01ca72ec

SHA512
3789be00f3b07747f9de92d2fc07b223f5cd0f21b48c115911affebde40905d2eccb2acde3abd139e9ef87b85660f6ebcb4c9d6e794784f9e02f6de9d740394b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat192603358e4defd.exe

Filesize
529KB

MD5
beb1ab68d5df9e4ee701903ba6581f73

SHA1
6630db527aa16276cd4578a8cd899541cace86f4

SHA256
cc7bd4430407bdb351cea4cddb1f7963e4f80aa3577df5b6fcd443370f412bc9

SHA512
e6b0f78174f961522c6f25ecfb3804ff64b8804bb3bdaf071033e77f7881ffef8ba2b2d99f3bae8ad0a8f9a0fe4323b3009d517b3c160da6fa0e439952195948

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat194837533b1da14.exe

Filesize
1.9MB

MD5
74e88352f861cb12890a36f1e475b4af

SHA1
7dd54ab35260f277b8dcafb556dd66f4667c22d1

SHA256
64578ffca840ebc3f791f1faa21252941d9fd384622d54a28226659ad05650a3

SHA512
18a6911b0d86088d265f49471c52d901a39d1549f9ac36681946a1b91fdb2f71f162ddf4b4659be061302fae6d616852d44c9a151f66eb53bbcc2fde6e7b9463

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat194d446031aec9ca.exe

Filesize
149KB

MD5
9d603e605f97109a29d3a0777a1fa041

SHA1
98ce6e1f59d9c075e2c381b4c985f005560b5bd5

SHA256
bc118b7708d56b93707a9bb025d3bf62d723b7932435a08299f59249c1c37dbe

SHA512
afadf5b83f6dbfe3a664e86d8bf56d0b28ae67e11603f79b5addebc1e01482fc7a2aed7936bbc9b73090bfc79ee32e9c2f7b569b9b256eca334d460a5678fdcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat195518974c.exe

Filesize
1.5MB

MD5
204801e838e4a29f8270ab0ed7626555

SHA1
6ff2c20dc096eefa8084c97c30d95299880862b0

SHA256
13357a53f4c23bd8ac44790aa1db3233614c981ded62949559f63e841354276a

SHA512
008e6cb08094621bbcadfca32cc611a4a8c78158365e5c81eb58c4e7d5b7e3d36c88b543390120104f1c70c5393b1c1c38c33761cf65736fdf6873648df3fc8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat196a179a23a4a4a2.exe

Filesize
721KB

MD5
ac3452e6b2ac3d796f7cbcc3ce9d16b1

SHA1
30a6369af829d26a7073b46acaeba31df21e1c80

SHA256
abb6dd0a9d0fa056ae1e67c6ba8e96cfb6990f33b66e414a9550a6dcf72d5d36

SHA512
04032d524e6a2dd7d8d7f93229ecc0b0dcef5c88d8a285f5d2bec82966ae875e7dab1c76971aa02560ad8a927dc95a135c81ad39a3630d23bd298de99858e986

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat1971d73793fd.exe

Filesize
802KB

MD5
232971b6dda6840b8a1a1ca52507a7b6

SHA1
91c303f2d39ecc2888539d405e5abbe257c753b7

SHA256
98d3d377c64128a2995913d14c6bdd23abe67def2d186f0fd177f97cb6b4aa67

SHA512
ac7663a8c92918422fb6bf0a457093906924a0570da8f4a049bb32e182fbccbacf8dc6aaf70836df86b0173c75ae51a6932e4fe44846996b565f4c5b05c19ede

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat198ad4994ac28a.exe

Filesize
288KB

MD5
70cf68ed96c3747895cd32d3a548159e

SHA1
512dbaf2997f5b36f9b490c3ee11c59eb76ed9ed

SHA256
6c6642d2b8ea2588e3fefae51c902565faeca0c5ae09ac065499da3aee042f9f

SHA512
47ea090da2f80d871678ef8c1451434ab3b8f5d807200ea1642d8e7076f9586992b59ca517dd326745072c522d586564eaafa163731a17107a76af4e59e969ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat198f04ccae0.exe

Filesize
1.9MB

MD5
1f1593ca8c5e102d55dd56b97e154281

SHA1
9afa628d73b2d15660b54d549cbb1d92d4dae60f

SHA256
b06a2eb67d4c3870a9c565a294ff54c23fab91e1d14b58f969d6615aee5ddca6

SHA512
d7f32be51b3146e3a1d400be556646e3ac4f79bd7377498e1b3059916992757d2678a21b6bbdaef33228b6ff7dfba8a19c32a13afbb7669edf08bf4589b7f593

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat1998dc915b0dd3a69.exe

Filesize
127KB

MD5
e400dd7ff10109c7ecc4afd5855786d1

SHA1
58368e0817eb937ec226aa0c4ce5fa13bea713ea

SHA256
de51e0f397e41e1ccdabf2927c21659ec75548508eb7114a8a700124a5fbe6d9

SHA512
5197858eb5bc0ff76627f56595cd1f916e6ac4dfbc21c273caa7827ad067d053961b150156c0153fd37a63621bea1071e9bb8618f48e177fa535a96c8ff8d80e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19a9aebcde6f786.exe

Filesize
120KB

MD5
dcde74f81ad6361c53ebdc164879a25c

SHA1
640f7b475864bd266edba226e86672101bf6f5c9

SHA256
cc10c90381719811def4bc31ff3c8e32c483c0eeffcb149df0b071e5a60d517b

SHA512
821b1a05601bbaee21cbd0b3cf2859359795ae55a3df8dea81f1142ede74b52af31273ffbbba772d77e40477853e6b02c9df8c44fc2ddad1cf3d248530427fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19ccc19655a1ffcf.exe

Filesize
1.1MB

MD5
aa75aa3f07c593b1cd7441f7d8723e14

SHA1
f8e9190ccb6b36474c63ed65a74629ad490f2620

SHA256
af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1

SHA512
b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19d470e8e0597fc47.exe

Filesize
532KB

MD5
15709890fdb0a23e3f61fe023417f016

SHA1
7d3049400740bbaf70940ef93578feaec1453356

SHA256
04dd197044b9d4c84a86fb2e50fc3c0c3ac5b021aa1314b821d693fa60124465

SHA512
81c20eb0a424aa4badb65cd0bb4218d801a35e9d30d35f4e785a0f98caa422a00ee08096cb297a9cf428321d123d58776512a64585f6a5f539191182aa944915

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19eb375798ed72201.exe

Filesize
1.9MB

MD5
ef97f2cc55586968cd4b8f86dc1b4c0e

SHA1
80ea07b56e7cd7433432645c22dc36dc4754f5fa

SHA256
ef700737a87a874e8648ddc90578e0fb368c182caa1349093430a48a436aa20a

SHA512
8ccca0b4bfa594c1a161b851b8cdc370c628401c5e2d3bbc27ad3ff138446211c399d2b91907f261323fbcede4c1697c52843623d37667be5d202de8fc7435d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\Sat19f1c04426464e86.exe

Filesize
8KB

MD5
7e32ef0bd7899fa465bb0bc866b21560

SHA1
115d09eeaff6bae686263d57b6069dd41f63c80c

SHA256
f45daafd61371b1f080a92eea8e9c8bfc9b710f22c82d5a06a1b1bf271c646ad

SHA512
9fbf4afc7a03460cd56f2456684108ccce9cfc8d31361bb49dd0531fa82b6b002450ab3c4c7f3d96f1dc55761615465828b1c33702d23d59fabe155a9db1b5cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\libcurl.dll

Filesize
218KB

MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\libcurlpp.dll

Filesize
54KB

MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\libgcc_s_dw2-1.dll

Filesize
113KB

MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\libstdc++-6.dll

Filesize
647KB

MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\libwinpthread-1.dll

Filesize
69KB

MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C831088\setup_install.exe

Filesize
2.1MB

MD5
3cc762f712c0f34556878f217a674303

SHA1
b88755076566eb98c86ce92116123aed1235075b

SHA256
eee46155a7fcc3b10e8d68e5d263dca98ff7bd2c48f119dd7d2eaa7a7986f0d1

SHA512
109308ee2b4467bf57d18185668c5cd56cfe4556fda7034212e54c63ac8d97395fc058889f944788ab8ee3dc3333ba7b3d01bb5848f3269aabd249fecc462358

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cm_

Filesize
616KB

MD5
2448bd4f6d3604a6e4a9f30bde9f212e

SHA1
daa4e5010ad6e70ed9261b895e2d628c7f022f24

SHA256
352fa4400756d73588027f395bb2c940ebfff8556cde6c574afab90d1e1d4fe5

SHA512
6d0961debae7b941253e5a015e164384d1908e3bbc163bff5eb04b26f8a90c1239e633b5442b4801a72934102a140abaa11c6b91c9e0ef938c59c7bf3bc8843c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

Filesize
127KB

MD5
d22c97b55bb23ab3400d50a67a8ea9e5

SHA1
96bd182c0f62a843639430966eb50719406f5d0a

SHA256
286227287f1fa79d5d5d909c2f457fc4d0aefa6be9e940f9a1f214d113ff88b4

SHA512
d6715b37f0d80b9d750f375652d1c4f067292894a8e671ca7542321a17a597293b25f3515d3547f2fe7691adfc07695b5581d055e6f76aaa7add64b6ad16eedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsdjfjcy.zu3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DK4GC.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J7KGM.tmp\Sat195518974c.tmp

Filesize
2.5MB

MD5
a6865d7dffcc927d975be63b76147e20

SHA1
28e7edab84163cc2d0c864820bef89bae6f56bf8

SHA256
fdfcbc8cfb57a3451a3d148e50794772d477ed6cc434acc779f1f0dd63e93f4b

SHA512
a9d2b59b40793fb685911f0e452e43a8e83c1bd133fda8a2a210ef1b9ca7ad419b8502fbb75b37f1b0fdef6ad0381b7d910fbff0bcfdeeec9e26b81d11effcec

Download Submit
memory/388-255-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/404-317-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/404-263-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/880-185-0x0000000000400000-0x0000000003D6C000-memory.dmp

Filesize
57.4MB

Download
memory/880-227-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/880-226-0x0000000000400000-0x0000000003D6C000-memory.dmp

Filesize
57.4MB

Download
memory/880-180-0x0000000000400000-0x0000000003D6C000-memory.dmp

Filesize
57.4MB

Download
memory/880-188-0x0000000000400000-0x0000000003D6C000-memory.dmp

Filesize
57.4MB

Download
memory/1052-120-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1052-183-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1208-168-0x0000000001150000-0x000000000116C000-memory.dmp

Filesize
112KB

Download
memory/1208-158-0x0000000001020000-0x0000000001026000-memory.dmp

Filesize
24KB

Download
memory/1208-156-0x0000000000970000-0x000000000099E000-memory.dmp

Filesize
184KB

Download
memory/1208-169-0x0000000001030000-0x0000000001036000-memory.dmp

Filesize
24KB

Download
memory/1588-103-0x0000000000790000-0x000000000081C000-memory.dmp

Filesize
560KB

Download
memory/1588-104-0x00000000050A0000-0x0000000005116000-memory.dmp

Filesize
472KB

Download
memory/1588-159-0x0000000005970000-0x0000000005F16000-memory.dmp

Filesize
5.6MB

Download
memory/1588-114-0x0000000005000000-0x000000000501E000-memory.dmp

Filesize
120KB

Download
memory/1868-154-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1868-202-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2540-178-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/3312-97-0x0000000073C40000-0x00000000743F1000-memory.dmp

Filesize
7.7MB

Download
memory/3312-260-0x0000000007FF0000-0x0000000008086000-memory.dmp

Filesize
600KB

Download
memory/3312-96-0x0000000003390000-0x00000000033C6000-memory.dmp

Filesize
216KB

Download
memory/3312-223-0x0000000073C40000-0x00000000743F1000-memory.dmp

Filesize
7.7MB

Download
memory/3312-155-0x0000000006560000-0x00000000068B7000-memory.dmp

Filesize
3.3MB

Download
memory/3312-261-0x0000000073C40000-0x00000000743F1000-memory.dmp

Filesize
7.7MB

Download
memory/3312-111-0x0000000005BF0000-0x0000000005C12000-memory.dmp

Filesize
136KB

Download
memory/3312-102-0x0000000073C40000-0x00000000743F1000-memory.dmp

Filesize
7.7MB

Download
memory/3312-187-0x0000000006A10000-0x0000000006A2E000-memory.dmp

Filesize
120KB

Download
memory/3312-189-0x0000000006F60000-0x0000000006FAC000-memory.dmp

Filesize
304KB

Download
memory/3312-142-0x0000000006480000-0x00000000064E6000-memory.dmp

Filesize
408KB

Download
memory/3312-242-0x000000006EBD0000-0x000000006EC1C000-memory.dmp

Filesize
304KB

Download
memory/3312-277-0x0000000073C40000-0x00000000743F1000-memory.dmp

Filesize
7.7MB

Download
memory/3312-143-0x00000000064F0000-0x0000000006556000-memory.dmp

Filesize
408KB

Download
memory/3336-305-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3452-257-0x00000000076B0000-0x0000000007D2A000-memory.dmp

Filesize
6.5MB

Download
memory/3452-228-0x0000000006C70000-0x0000000006CA2000-memory.dmp

Filesize
200KB

Download
memory/3452-256-0x0000000073C40000-0x00000000743F1000-memory.dmp

Filesize
7.7MB

Download
memory/3452-229-0x000000006EBD0000-0x000000006EC1C000-memory.dmp

Filesize
304KB

Download
memory/3452-240-0x0000000006CD0000-0x0000000006D73000-memory.dmp

Filesize
652KB

Download
memory/3452-239-0x0000000006CB0000-0x0000000006CCE000-memory.dmp

Filesize
120KB

Download
memory/3452-275-0x0000000073C40000-0x00000000743F1000-memory.dmp

Filesize
7.7MB

Download
memory/3452-258-0x0000000007030000-0x000000000704A000-memory.dmp

Filesize
104KB

Download
memory/3452-259-0x0000000007090000-0x000000000709A000-memory.dmp

Filesize
40KB

Download
memory/3452-79-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

Filesize
4KB

Download
memory/3452-100-0x0000000004F70000-0x000000000563A000-memory.dmp

Filesize
6.8MB

Download
memory/3452-99-0x0000000073C40000-0x00000000743F1000-memory.dmp

Filesize
7.7MB

Download
memory/3452-222-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

Filesize
4KB

Download
memory/3504-203-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/3504-139-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/3844-323-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4128-274-0x000000002E4E0000-0x000000002E57B000-memory.dmp

Filesize
620KB

Download
memory/4128-254-0x00000000035F0000-0x00000000045F0000-memory.dmp

Filesize
16.0MB

Download
memory/4128-303-0x00000000035F0000-0x00000000045F0000-memory.dmp

Filesize
16.0MB

Download
memory/4128-271-0x000000002E4E0000-0x000000002E57B000-memory.dmp

Filesize
620KB

Download
memory/4128-268-0x000000002E420000-0x000000002E4D0000-memory.dmp

Filesize
704KB

Download
memory/4208-282-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/4208-466-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/4620-72-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4620-196-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/4620-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4620-68-0x0000000064941000-0x000000006494F000-memory.dmp

Filesize
56KB

Download
memory/4620-200-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4620-70-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4620-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4620-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4620-60-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4620-191-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/4620-61-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4620-197-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4620-71-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4620-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4620-199-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4620-198-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4620-69-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4620-77-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4620-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4620-78-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4696-265-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4792-214-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4792-218-0x0000000005550000-0x000000000558C000-memory.dmp

Filesize
240KB

Download
memory/4792-217-0x00000000055B0000-0x00000000056BA000-memory.dmp

Filesize
1.0MB

Download
memory/4792-216-0x0000000002E80000-0x0000000002E92000-memory.dmp

Filesize
72KB

Download
memory/4792-215-0x0000000005AC0000-0x00000000060D8000-memory.dmp

Filesize
6.1MB

Download
memory/4960-175-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4960-278-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5016-150-0x0000000000A40000-0x0000000000A48000-memory.dmp

Filesize
32KB

Download
memory/5116-149-0x0000000000150000-0x00000000001DA000-memory.dmp

Filesize
552KB

Download