Behavioral Report

Analysis

max time kernel
854s
max time network
897s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-10-2022 23:05

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

https://oneqanatclub.com/O4uYeU5lV6dN_0UrzBx4sNtDjheJnvEjQ8xUsiyyfa0/?clck=1580b126227a97924669dc06f0c24968&sid=17357599

Score

10^/10

privateloader redline smokeloader backdoor evasion infostealer loader themida trojan upx vmprotect

Malware Config

Extracted

Family

privateloader

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

Attributes

payload_url
https://vipsofts.xyz/files/mega.bmp

Signatures

Detects Smokeloader packer ⋅ 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/3232-167-0x00000000002A0000-0x00000000002A9000-memory.dmp family_smokeloader
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

resource	yara_rule
behavioral1/memory/3232-167-0x00000000002A0000-0x00000000002A9000-memory.dmp	family_smokeloader

RedLine payload ⋅ 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3448-172-0x0000000004A30000-0x0000000004A78000-memory.dmp	family_redline
behavioral1/memory/3448-190-0x0000000004A80000-0x0000000004AC6000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Identifies VirtualBox via ACPI registry values (likely anti-VM) ⋅ 2 TTPs 2 IoCs

evasion

TTPs:

Query Registry Virtualization/Sandbox Evasion

Processes:

Install.exeInstall.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Install.exe

Downloads MZ/PE file

Executes dropped EXE ⋅ 5 IoCs

Processes:

JMJhPzbC2n4Zu9meYzq49xfk.exes1nmdxFLL7Hl5PRq4LV7qciE.exe5FtM2JIZz2X55wMcbEr0_lzN.exereSBqOpFAvDeS2YmHvhpI6Yg.exeAwyDlE77HPmtzrFN6gjJ1XGO.exe

pid	process
3208	JMJhPzbC2n4Zu9meYzq49xfk.exe
3188	s1nmdxFLL7Hl5PRq4LV7qciE.exe
3232	5FtM2JIZz2X55wMcbEr0_lzN.exe
3252	reSBqOpFAvDeS2YmHvhpI6Yg.exe
3384	AwyDlE77HPmtzrFN6gjJ1XGO.exe

UPX packed file ⋅ 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/3496-180-0x0000000001190000-0x000000000244B000-memory.dmp upx

resource	yara_rule
behavioral1/memory/3496-180-0x0000000001190000-0x000000000244B000-memory.dmp	upx

VMProtect packed file ⋅ 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/files/0x000300000002085f-99.dat	vmprotect
behavioral1/files/0x000300000002085f-100.dat	vmprotect
behavioral1/files/0x000300000002085f-105.dat	vmprotect
behavioral1/memory/3188-134-0x0000000140000000-0x000000014060D000-memory.dmp	vmprotect

Checks BIOS information in registry ⋅ 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

Install.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Install.exe

Loads dropped DLL ⋅ 11 IoCs

Processes:

pid process

460
460
460
460
460
460
460
460
460
460
460

pid	process
460
460
460
460
460
460
460
460
460
460
460

Themida packer ⋅ 35 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/460-68-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-69-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-70-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-71-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-72-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-74-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-75-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-76-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-79-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-80-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-81-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-82-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-84-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-85-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-83-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-87-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-91-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/2692-136-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3752-156-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3752-155-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3752-154-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3752-153-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3752-152-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3752-151-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3752-150-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/460-146-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3888-171-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3888-176-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3888-179-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3752-181-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3888-187-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3888-185-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3888-189-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3888-197-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida
behavioral1/memory/3888-211-0x00000000011C0000-0x0000000001C3A000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs

TTPs:

Web Service
Looks up external IP address via web service ⋅ 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

963 ipinfo.io
1070 ipinfo.io
1171 ipinfo.io
1186 ipinfo.io
1244 ipinfo.io
1245 ipinfo.io
1307 ipinfo.io
961 ipinfo.io
1071 ipinfo.io

flow	ioc
963	ipinfo.io
1070	ipinfo.io
1171	ipinfo.io
1186	ipinfo.io
1244	ipinfo.io
1245	ipinfo.io
1307	ipinfo.io
961	ipinfo.io
1071	ipinfo.io

Drops file in System32 directory ⋅ 8 IoCs

Processes:

Install.exeInstall.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy	Install.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy	Install.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Install.exe

Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 2 IoCs

Processes:

Install.exeInstall.exe

pid process

460 Install.exe
2692 Install.exe
Program crash ⋅ 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3960 3188 WerFault.exe s1nmdxFLL7Hl5PRq4LV7qciE.exe

pid	process
460	Install.exe
2692	Install.exe

pid	pid_target	process	target process
3960	3188	WerFault.exe	s1nmdxFLL7Hl5PRq4LV7qciE.exe

Checks processor information in registry ⋅ 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates processes with tasklist ⋅ 1 TTPs 1 IoCs

TTPs:

Process Discovery

Processes:

tasklist.exe

pid process

3988 tasklist.exe

pid	process
3988	tasklist.exe

Enumerates system info in registry ⋅ 2 TTPs 3 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings ⋅ 1 TTPs 36 IoCs

adware spyware

TTPs:

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371776087"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29F9EED1-4502-11ED-B2F2-7E6ADD856DC1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000750040fd9d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000000ad5fbff0204e45288443a7924aba4d85719a98f3e00b9d1d2e42da1dd887320000000000e80000000020000200000009c723ac7f5c725fac68c277e5e9fc0463829a5470f66fd2ff1dad4240ee91c9f9000000052a4c2c4bf0a5cc6a39da487fe08ed428db212f2b007a327046da05a677db063bbea6e34005d4c9df2c261a22f17b9ecd13519b461de865295e10589a224904e3ed092868759cba9191a2d63933f1bca2d9ec19af63b4cf6eb45f0010adc9e53477341906fddc9005526b30fadc21f8c705c47df31d876d8bd4180ded9c7841d9840347bb2fe0214f0b14f74553cbbcd40000000a7798735f476fbe0f45b9288ef51d8c13eb61290a3211b908f1e8f52155976fcc74e06e8746ce277a2a88f39fae0f46e8410b36039d936e09f96732ffa8e70a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000068e01d1b93910a27677e8d719b0b693daf0c7b553a43136475f81003c82c8ef000000000e80000000020000200000004ce2717aea3859a5cc214282dc135b373db8aab942b6a2a02d75a9143047394b20000000b8c0cb3d71402d09770f5c165026dd6c986b5327944fe4b803db907928fc946b40000000e92fcc99cf2747f9c771ccfef5f450f75ad8757e064d41831f213d87aefb2ba8516f97afec1a9b1366ad9775ce5e4b4331c44bd137752971022a15685a6bef24	iexplore.exe

Modifies registry class ⋅ 2 IoCs

Processes:

firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	firefox.exe

NTFS ADS ⋅ 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\File.zip:Zone.Identifier firefox.exe
Script User-Agent ⋅ 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 1218 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	ioc	process
File created	C:\Users\Admin\Downloads\File.zip:Zone.Identifier	firefox.exe

description	flow	ioc
HTTP User-Agent header	1218	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses ⋅ 12 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exeInstall.exeInstall.exe

pid	process
1752	chrome.exe
1784	chrome.exe
1784	chrome.exe
2696	chrome.exe
1784	chrome.exe
1784	chrome.exe
888	chrome.exe
460	Install.exe
460	Install.exe
2692	Install.exe
2692	Install.exe
2692	Install.exe

Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 2920 firefox.exe
Token: SeDebugPrivilege 2920 firefox.exe
Token: SeDebugPrivilege 2920 firefox.exe

description	pid	process
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe

Suspicious use of FindShellTrayWindow ⋅ 43 IoCs

Processes:

iexplore.exechrome.exefirefox.exe

pid	process
1128	iexplore.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe

Suspicious use of SendNotifyMessage ⋅ 38 IoCs

Processes:

chrome.exefirefox.exe

pid	process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe

Suspicious use of SetWindowsHookEx ⋅ 15 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid	process
1128	iexplore.exe
1128	iexplore.exe
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe

Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes:

iexplore.exechrome.exe

description	pid	process	target process
PID 1128 wrote to memory of 316	1128	iexplore.exe	IEXPLORE.EXE
PID 1128 wrote to memory of 316	1128	iexplore.exe	IEXPLORE.EXE
PID 1128 wrote to memory of 316	1128	iexplore.exe	IEXPLORE.EXE
PID 1128 wrote to memory of 316	1128	iexplore.exe	IEXPLORE.EXE
PID 1784 wrote to memory of 1676	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1676	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1676	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1548	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1752	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1752	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1752	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe
PID 1784 wrote to memory of 1240	1784	chrome.exe	chrome.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://oneqanatclub.com/O4uYeU5lV6dN_0UrzBx4sNtDjheJnvEjQ8xUsiyyfa0/?clck=1580b126227a97924669dc06f0c24968&sid=17357599

Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory

PID:1128

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1128 CREDAT:275457 /prefetch:2

Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx

PID:316

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory

PID:1784

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef68d4f50,0x7fef68d4f60,0x7fef68d4f70

PID:1676

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:2

PID:1548

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1440 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1704 /prefetch:8

PID:1240

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1

PID:1028

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1

PID:824

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8

PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3352 /prefetch:2

PID:2200

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1

PID:2244

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3516 /prefetch:8

PID:2308

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:8

PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1

PID:2448

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:8

PID:2588

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3272 /prefetch:8

PID:2656

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2772 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:2696

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1

PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3240 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:888

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2384 /prefetch:8

PID:2992

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3216 /prefetch:8

PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3184 /prefetch:8

PID:2080

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8

PID:1976

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,5547594153638325652,5795461598854088223,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1

PID:3544

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

PID:2912

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

Checks processor information in registry
Modifies registry class
NTFS ADS
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx

PID:2920

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2920.0.78837257\851381524" -parentBuildID 20200403170909 -prefsHandle 1200 -prefMapHandle 1192 -prefsLen 1 -prefMapSize 220106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2920 "\\.\pipe\gecko-crash-server-pipe.2920" 1276 gpu

PID:2172

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2920.3.229414219\721214678" -childID 1 -isForBrowser -prefsHandle 1684 -prefMapHandle 1680 -prefsLen 156 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2920 "\\.\pipe\gecko-crash-server-pipe.2920" 1848 tab

PID:880

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2920.13.1301066417\917422167" -childID 2 -isForBrowser -prefsHandle 2672 -prefMapHandle 2668 -prefsLen 6938 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2920 "\\.\pipe\gecko-crash-server-pipe.2920" 2684 tab

PID:1076

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2ec

PID:2664

C:\Users\Admin\Downloads\File\Install.exe

"C:\Users\Admin\Downloads\File\Install.exe"

Identifies VirtualBox via ACPI registry values (likely anti-VM)
Checks BIOS information in registry
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious behavior: EnumeratesProcesses

PID:460

C:\Users\Admin\Pictures\Minor Policy\JMJhPzbC2n4Zu9meYzq49xfk.exe

"C:\Users\Admin\Pictures\Minor Policy\JMJhPzbC2n4Zu9meYzq49xfk.exe"

Executes dropped EXE

PID:3208

C:\Users\Admin\Pictures\Minor Policy\s1nmdxFLL7Hl5PRq4LV7qciE.exe

"C:\Users\Admin\Pictures\Minor Policy\s1nmdxFLL7Hl5PRq4LV7qciE.exe"

Executes dropped EXE

PID:3188

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3188 -s 100

Program crash

PID:3960

C:\Users\Admin\Pictures\Minor Policy\5FtM2JIZz2X55wMcbEr0_lzN.exe

"C:\Users\Admin\Pictures\Minor Policy\5FtM2JIZz2X55wMcbEr0_lzN.exe"

Executes dropped EXE

PID:3232

C:\Users\Admin\Pictures\Minor Policy\reSBqOpFAvDeS2YmHvhpI6Yg.exe

"C:\Users\Admin\Pictures\Minor Policy\reSBqOpFAvDeS2YmHvhpI6Yg.exe"

Executes dropped EXE

PID:3252

C:\Windows\SysWOW64\at.exe

at 3874982763784yhwgdfg78234789s42809374918uf

PID:3728

C:\Windows\SysWOW64\cmd.exe

cmd /c cmd < Film.aspx & ping -n 5 localhost

PID:2284

C:\Windows\SysWOW64\cmd.exe

cmd

PID:3180

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "imagename eq AvastUI.exe"

Enumerates processes with tasklist

PID:3988

C:\Users\Admin\Pictures\Minor Policy\wnzB9pZg5GbvEtqE_y9VQhAC.exe

"C:\Users\Admin\Pictures\Minor Policy\wnzB9pZg5GbvEtqE_y9VQhAC.exe"

PID:3264

C:\Windows\SysWOW64\control.exe

"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\0w5FZee.CPL",

PID:3904

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0w5FZee.CPL",

PID:2732

C:\Users\Admin\Pictures\Minor Policy\AwyDlE77HPmtzrFN6gjJ1XGO.exe

"C:\Users\Admin\Pictures\Minor Policy\AwyDlE77HPmtzrFN6gjJ1XGO.exe"

Executes dropped EXE

PID:3384

C:\Users\Admin\Pictures\Minor Policy\uXYDbtCo2pT0ipfckNFNlLZU.exe

"C:\Users\Admin\Pictures\Minor Policy\uXYDbtCo2pT0ipfckNFNlLZU.exe"

PID:3356

C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\Install.exe

.\Install.exe

PID:3364

C:\Users\Admin\AppData\Local\Temp\7zSF355.tmp\Install.exe

.\Install.exe /S /site_id "525403"

PID:1232

C:\Users\Admin\Pictures\Minor Policy\Gonp2H5ckveo9K3iSi9tu3iV.exe

"C:\Users\Admin\Pictures\Minor Policy\Gonp2H5ckveo9K3iSi9tu3iV.exe"

PID:3348

C:\Users\Admin\Pictures\Minor Policy\Ha_ZWZhqO37f8j65fQKayGAy.exe

"C:\Users\Admin\Pictures\Minor Policy\Ha_ZWZhqO37f8j65fQKayGAy.exe"

PID:3496

C:\Users\Admin\Pictures\Minor Policy\INIRNsjrliQ_MZEUaNB8NgcW.exe

"C:\Users\Admin\Pictures\Minor Policy\INIRNsjrliQ_MZEUaNB8NgcW.exe"

PID:3484

C:\Users\Admin\Pictures\Minor Policy\INIRNsjrliQ_MZEUaNB8NgcW.exe

"C:\Users\Admin\Pictures\Minor Policy\INIRNsjrliQ_MZEUaNB8NgcW.exe" -q

PID:1632

C:\Users\Admin\Pictures\Minor Policy\h3E1PJPnb3gddvF5jY1EiTjF.exe

"C:\Users\Admin\Pictures\Minor Policy\h3E1PJPnb3gddvF5jY1EiTjF.exe"

PID:3468

C:\Users\Admin\Pictures\Minor Policy\9KX5Owg1vMVPqD8zrONZVgSl.exe

"C:\Users\Admin\Pictures\Minor Policy\9KX5Owg1vMVPqD8zrONZVgSl.exe"

PID:3448

C:\Users\Admin\Pictures\Minor Policy\0NB0b63zUnUAA3ADRA67vqmG.exe

"C:\Users\Admin\Pictures\Minor Policy\0NB0b63zUnUAA3ADRA67vqmG.exe"

PID:3436

C:\Users\Admin\Downloads\File\Install.exe

"C:\Users\Admin\Downloads\File\Install.exe"

Identifies VirtualBox via ACPI registry values (likely anti-VM)
Checks BIOS information in registry
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious behavior: EnumeratesProcesses

PID:2692

C:\Users\Admin\Pictures\Minor Policy\5wuGexFxV6ZzswTosSj14BDl.exe

"C:\Users\Admin\Pictures\Minor Policy\5wuGexFxV6ZzswTosSj14BDl.exe"

PID:3032

C:\Users\Admin\Pictures\Minor Policy\Wo3bvEj2INmZhMYtncRfdc2e.exe

"C:\Users\Admin\Pictures\Minor Policy\Wo3bvEj2INmZhMYtncRfdc2e.exe"

PID:3656

C:\Users\Admin\Pictures\Minor Policy\ql3CwmRVjrI5kK5528Uapehi.exe

"C:\Users\Admin\Pictures\Minor Policy\ql3CwmRVjrI5kK5528Uapehi.exe"

PID:3064

C:\Users\Admin\Pictures\Minor Policy\ipE0bORH9cVBb8ofjieKFd5H.exe

"C:\Users\Admin\Pictures\Minor Policy\ipE0bORH9cVBb8ofjieKFd5H.exe"

PID:1624

C:\Users\Admin\Pictures\Minor Policy\Tm9jtxy66pCVsi8v_WJ0I4Jv.exe

"C:\Users\Admin\Pictures\Minor Policy\Tm9jtxy66pCVsi8v_WJ0I4Jv.exe"

PID:3400

C:\Users\Admin\Pictures\Minor Policy\1Qh6MWh1gv6kP0Rii04b5wJ8.exe

"C:\Users\Admin\Pictures\Minor Policy\1Qh6MWh1gv6kP0Rii04b5wJ8.exe"

PID:3884

C:\Users\Admin\Pictures\Minor Policy\CVcj9BNs0F8XHf1wLrmNEN81.exe

"C:\Users\Admin\Pictures\Minor Policy\CVcj9BNs0F8XHf1wLrmNEN81.exe"

PID:4016

C:\Users\Admin\Pictures\Minor Policy\ltEnF7VNE3KMa683B8ZjbAoj.exe

"C:\Users\Admin\Pictures\Minor Policy\ltEnF7VNE3KMa683B8ZjbAoj.exe"

PID:2308

C:\Users\Admin\Pictures\Minor Policy\HoZ1wPnndtzhCCKhJUgCR98O.exe

"C:\Users\Admin\Pictures\Minor Policy\HoZ1wPnndtzhCCKhJUgCR98O.exe"

PID:3872

C:\Users\Admin\Pictures\Minor Policy\AcGToIuLXFWWq3Zsrdg6MOLk.exe

"C:\Users\Admin\Pictures\Minor Policy\AcGToIuLXFWWq3Zsrdg6MOLk.exe"

PID:3664

C:\Users\Admin\Pictures\Minor Policy\4uqNtHPcYoOD_SbkDknhNX4S.exe

"C:\Users\Admin\Pictures\Minor Policy\4uqNtHPcYoOD_SbkDknhNX4S.exe"

PID:3936

C:\Users\Admin\Pictures\Minor Policy\YIXMjiwE9x4NZZNsegkqdHPr.exe

"C:\Users\Admin\Pictures\Minor Policy\YIXMjiwE9x4NZZNsegkqdHPr.exe"

PID:3896

C:\Users\Admin\Pictures\Minor Policy\aGY5IRjSMUa3Q1eamXBAxq6v.exe

"C:\Users\Admin\Pictures\Minor Policy\aGY5IRjSMUa3Q1eamXBAxq6v.exe"

PID:3648

C:\Users\Admin\Downloads\File\Install.exe

"C:\Users\Admin\Downloads\File\Install.exe"

PID:3752

C:\Users\Admin\Downloads\File\Install.exe

"C:\Users\Admin\Downloads\File\Install.exe"

PID:3888

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
MD5
bf034518c3427206cc85465dc2e296e5

SHA1
ef3d8f548ad3c26e08fa41f2a74e68707cfc3d3a

SHA256
e5da797df9533a2fcae7a6aa79f2b9872c8f227dd1c901c91014c7a9fa82ff7e

SHA512
c307eaf605bd02e03f25b58fa38ff8e59f4fb5672ef6cb5270c8bdb004bca56e47450777bfb7662797ffb18ab409cde66df4536510bc5a435cc945e662bddb78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\98E4B9E09258E3C5F565FA64983EE15B
MD5
ecada0504efc6e1df03354aa95ad9fd1

SHA1
fe000f557ee4571c3652cb7641a7528cc8764349

SHA256
1263f46b6877365a32b8d7ac54767b2e8888adc28c9a1b4d971707518396c329

SHA512
feba072b792392e3867b699a7814da3d71e05167d7c453006c95fed7bf0b7be9ac733b84784308ea8a52d2e5e80c1ebc684c65d1b08f43e4d4f2bf34c73404cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
MD5
bf5a934ae5614ab9b09c04be4998625a

SHA1
482133e9795fd83ba552acc3e0bfe015a2002d12

SHA256
519e5f2d6fb668379950dad584ba9627651308e7a2fbe13808219289738cb6ff

SHA512
6a8ca39f10f7502abf88c8df1ce95692caa75e95556a2a38521d6036797f8ba44e92a096a21c1ebc5595cfd51743f2a9577b65ad80072109cfe5270ab1debc82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D91FAD7AD7DE45FA94A812E7F6DAECE3
MD5
c3c18ebb8a80dabd3ebf0d1919b6bef4

SHA1
25a8584ed780b0f6dc849794809e4b23b5091924

SHA256
50c6171aaf2addd7582ed5f2af88bfd42b7a3c6a6f76e9df2ee3ce764e0e7472

SHA512
7426b4f9a20de2df81c9edf534d27d76a8ea7223ee4dac953bb4e4a04bd915790cc4b7f0df41fd704279417aa7bc6dd7bb9c104f51bcfeb995ae1d99010cdff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5
2b3f2227b4c9a72b885f8c6339da7395

SHA1
594c9c0b81282611a19e2ba5f9a0668ab6a183fa

SHA256
f4562edfb8653ce3b2465f69d51be98f4e5efac919cd53c45b7746a62991f0f9

SHA512
d4996d82b840a0c8b250cd81cac2565d894d66c585e0a6da86dc18e20844836182c0f9135325ccf649a948d274ba4861570f1d8271d9832d1bbcf5ce48854760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
MD5
c61fbb291147e38393d4f9aa43f74f0a

SHA1
99f5a1d00d9fee6d2182413c8e5c4e70d38dbd9b

SHA256
76396124070389860a853dae4f7a6d1dee6184a024660627493da17a7f7b3ede

SHA512
5e4d51b3d7564cb00a45bf65f835ec1e8c027ea20e399145d44853c29cb36129b78786cc38fbcdd315e41cef2b8b0f444a86027ca682be0e54900dbe3081fb49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
0724c792a599effe2051e81dc4c36560

SHA1
30d615694cdf4f0beb6a8007938d4c0e71e57008

SHA256
241c57c10906c95dd690d1119afd132fbdd069b30fc6c3e13ae78e91ba6e8ad2

SHA512
e3442455c7ec7fb4ac6581d7dd78487c321606e4cc03bc0f6337af0567bfa724a1be8b091353d3e1cde062db259d1e46527bbb9877df2a2a61dda21a73b2bcb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
7387ab066e68731c71e4b7e3d03469f7

SHA1
5a14ad4d03c5875b16a95224648fcc5c86f456bb

SHA256
56c752af28b9a248364a53f576e1173513b66946c3c0e93ac2b5aa539762017c

SHA512
a3e43d7dc717a798a4168d01c053a7ab51c94077e9b67161a293ff31cbacd3c53fa4d3bdfed05142d3fe8c8c70ed353e15cad15f322201530cfa4d35124abd67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
d8d46292e1417855ca7fd7f935fdc242

SHA1
c7e748449aa0e7326cd46c17fafd2c06b86c0e22

SHA256
bf3c83daa1652604355f04aae4225621b473e00c3d53a3def7e6bd0c1a8b3ef3

SHA512
d0b80176d67f0f43a850613948642dcc1704f4abcd550e8cd51befcb39e51177e38f6dba1fd3ba3683fb0407372f887687f1ec878bb12afccc51e88b3bcb5c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\98E4B9E09258E3C5F565FA64983EE15B
MD5
6d0a9e540bda5bc8ff5caa67cb96d2bc

SHA1
52de6566b046f73202a32a3b552b267edee7821d

SHA256
107ca3b9c0dd2e6b2026e779c614d3824f42dc6df888d980e2e29ba580c1b422

SHA512
6a663557849faa01f155b1445f4aa75cf8463b3656dcebd61cef34d5b33af723aa0554f4f491dbf9d572c16d5c0a89078dde04074fcd2f4440d1cf5ff69448f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
MD5
97e24271f5c2ba38cdec7272b78413ff

SHA1
e54cf3f6d7369969c86cd755e29e9162eaeae894

SHA256
d35ca34cecc6eeaf58085c382f8d8adf1c8a67b0cc181326b3bfd8648453550f

SHA512
7cc9a24fefd52a5884d07cfa646b966d423fd777f15cb4c971e421214dadb6064079557ae83220234f1090f4372567c6c408cc55b262b61fa2ffae7567b60302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D91FAD7AD7DE45FA94A812E7F6DAECE3
MD5
7177c824e8b22c16d4895c88b5e8bf18

SHA1
31b1c6842fe88b5f58f54131791e3e5a4bd93f7f

SHA256
d65800bf9f4451ce8d6fcec974ab4564902cba782b3bcf0cd1efc774ec0d4066

SHA512
b7417b94cc93d634b3b2e75a184464641dd0583e74a1a4269f776fcc782c2cef1e8d6d803671b0ea2d7d8a4c77167de0adab3c69468c7a3f67985e7c8106e861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
b1a73d4e67aff0b93942a7fecffc4624

SHA1
9b2a444c4588bd23977628cea4c6bb6abb643626

SHA256
53b686e4a21b4a8e01baf181c8f24eb356863ead015b74303abf50531b33361c

SHA512
09bfe9bae18f7502ce213ce2edb476191290336d83958d67b0faf7fa73ccbf2ee5d3e9b21569424e91ed8c3e17fbc58911dc44459e9e87c16d727425bdfad078

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\025VUJ08.txt
MD5
fc93e72c5467169df3343a1074917284

SHA1
32d9ef146c71fad2d28a5b1d50d9012d1773ee48

SHA256
df49f70cd4f4973f2dac0e19e71a690feaf175c5411ebff696c6388583ea8e5d

SHA512
d59fe4280a702bd29a9d35dbedc666ef846bac37015d2c98b49b3453cadbbb59644d6d744b333a8c9c9d5e95665b81a05bcf48abfcf89930d35decfe37d1bf82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\F27LA4G1.txt
MD5
9744084318ae0577a392c57eba09bcc6

SHA1
5a97a548e827e35974884eb8a9975f706b4884ce

SHA256
caf857bd3311d9c680f5b8330edefdda54e571e47d7470ef5f8c804ab29f136b

SHA512
5996e9e15264182643a3c8f790f188aa9097d61b0f9c3120e8ef4528c9cb2413983bfde99721591e8e9a403642c8c0623373eff303ceb722d91cccee5124c576

Download Submit
C:\Users\Admin\Pictures\Minor Policy\5FtM2JIZz2X55wMcbEr0_lzN.exe
MD5
fed15979d927202175a67f39a2de5b73

SHA1
541da8999a0f81a12122344eeafe3b030a09a4ab

SHA256
61006792b65fc074f90f6cc6b2696e04d52d679b4821d3684adccf106cac81ba

SHA512
5e1488cdb4ceda3c525a139218eca392e71389c6e63d0b92d7571894a467165a36dfb640377c5d978bf8bf1c1b8f846a524e5dc866bb1bca2ad0c4f96550c653

Download Submit
C:\Users\Admin\Pictures\Minor Policy\AwyDlE77HPmtzrFN6gjJ1XGO.exe
MD5
9519c85c644869f182927d93e8e25a33

SHA1
eadc9026e041f7013056f80e068ecf95940ea060

SHA256
f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

SHA512
dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

Download Submit
C:\Users\Admin\Pictures\Minor Policy\JMJhPzbC2n4Zu9meYzq49xfk.exe
MD5
3b64d7c84a343daf29c70331e454affe

SHA1
a6a882396f52d1697337356562cf7813be697e7a

SHA256
3313e6d16aabacfe4f6891408f9e8d3d9005d885e5bd0e8349c2a3dbe9352017

SHA512
fb9835a943b065c9f14af6b8812ec021626faa19672b512a418303c2472ba9450838d66f7a40062a94115a4d1dcd1d6ce42679fb235f8ee58edb94b37b01ca6a

Download Submit
C:\Users\Admin\Pictures\Minor Policy\reSBqOpFAvDeS2YmHvhpI6Yg.exe
MD5
c340449d532642420d4bedc2e9f7ce7c

SHA1
6153df468674d2eb1680eb6bb0e1bdbc0d6856b7

SHA256
a233b76767157c012c4d1ec34726d87ea1efac01e49efd9fef394c7e84966103

SHA512
c9a085e30ed056c819b992bbe34d606d9fca0704362917ad226b64d233b4800be5fb9de35150f2cdd6bc0f3f1132ac77f558f00dd27ca8d474df4a056a7ff4d3

Download Submit
C:\Users\Admin\Pictures\Minor Policy\s1nmdxFLL7Hl5PRq4LV7qciE.exe
MD5
04aeaa8f06b71a72b8905da20f679b10

SHA1
ebfa60215fcce5a369f1b340f1232125e37f7a68

SHA256
55c1cbe7368ef1eafbd435a2b570f362868bd2afda1ddbe59bcbb51b7fc63383

SHA512
5c393a8e6b3327ece1555aa73111f67e4858898efbbe38ac757a96d91da26a83f0b130e18b6955796e76bd4300475e8eeec63171c8ef407a09069874f48d5774

Download Submit
C:\Users\Admin\Pictures\Minor Policy\wnzB9pZg5GbvEtqE_y9VQhAC.exe
MD5
6bf21180935d9c68e9874d3290065319

SHA1
1febcc4eec0e295f15115cdc99551680d1300066

SHA256
84ef0f1d815866aaa7890feb40cd9e2e99d3542a30b842e1569ddcf255b3ba5f

SHA512
92cdadba9fbd7c4853788b4a3c393c4904323fcccc92c6912c47f0748c6305921714f31f830a28f821900772b1f787fa10af584b85fe88647bbf9c0f683cc790

Download Submit
C:\Windows\SysWOW64\GroupPolicy\gpt.ini
MD5
ec3584f3db838942ec3669db02dc908e

SHA1
8dceb96874d5c6425ebb81bfee587244c89416da

SHA256
77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340

SHA512
35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e

Download Submit
C:\Windows\System32\GroupPolicy\GPT.INI
MD5
7cc972a3480ca0a4792dc3379a763572

SHA1
f72eb4124d24f06678052706c542340422307317

SHA256
02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

SHA512
ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

Download Submit
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
MD5
cdfd60e717a44c2349b553e011958b85

SHA1
431136102a6fb52a00e416964d4c27089155f73b

SHA256
0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

SHA512
dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_1784_FCXPUYFGRUTRXEMZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\Pictures\Minor Policy\0NB0b63zUnUAA3ADRA67vqmG.exe
MD5
ff10f9a0f2e550a402f2a58c130670ba

SHA1
20ae921216a8ff801402423f4cc14130c6cd18ac

SHA256
8987486a7d6a0ded39ad78bebafb2828be0d927b178ef7bdac71ed2901f755cd

SHA512
e71b70b997db272e9d15089e46b0dc4ae503da8aa840bcba484bb7e07173198e5e610e7471844518579c474376287b2fb869629e45707cc83538c4c0b00327df

Download Submit
\Users\Admin\Pictures\Minor Policy\5FtM2JIZz2X55wMcbEr0_lzN.exe
MD5
fed15979d927202175a67f39a2de5b73

SHA1
541da8999a0f81a12122344eeafe3b030a09a4ab

SHA256
61006792b65fc074f90f6cc6b2696e04d52d679b4821d3684adccf106cac81ba

SHA512
5e1488cdb4ceda3c525a139218eca392e71389c6e63d0b92d7571894a467165a36dfb640377c5d978bf8bf1c1b8f846a524e5dc866bb1bca2ad0c4f96550c653

Download Submit
\Users\Admin\Pictures\Minor Policy\5FtM2JIZz2X55wMcbEr0_lzN.exe
MD5
fed15979d927202175a67f39a2de5b73

SHA1
541da8999a0f81a12122344eeafe3b030a09a4ab

SHA256
61006792b65fc074f90f6cc6b2696e04d52d679b4821d3684adccf106cac81ba

SHA512
5e1488cdb4ceda3c525a139218eca392e71389c6e63d0b92d7571894a467165a36dfb640377c5d978bf8bf1c1b8f846a524e5dc866bb1bca2ad0c4f96550c653

Download Submit
\Users\Admin\Pictures\Minor Policy\9KX5Owg1vMVPqD8zrONZVgSl.exe
MD5
00f5bd232be0bef4059ca39998cf47f6

SHA1
860bdec88978ecba95139c4a85d164c39442bc5f

SHA256
4c1838b8b8270e9bd163cdcde26d51a53a4dac1e83189218c7e6ca6671f49b15

SHA512
eb0a106ea099b9e7e43c18d97fdb8082b081789cc02c06f922a6e0717648d247a8b5485e33c9b5a34280579451d932641e9628e6128cef791cdc2c9da3cdf410

Download Submit
\Users\Admin\Pictures\Minor Policy\AwyDlE77HPmtzrFN6gjJ1XGO.exe
MD5
9519c85c644869f182927d93e8e25a33

SHA1
eadc9026e041f7013056f80e068ecf95940ea060

SHA256
f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

SHA512
dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

Download Submit
\Users\Admin\Pictures\Minor Policy\Gonp2H5ckveo9K3iSi9tu3iV.exe
MD5
a4ec02e6d37f6298e2c74cf92d556b26

SHA1
9880c84c2268ce0146faf55525de347e406e392a

SHA256
b5e597da46615362ad8dce44f85048fdef9d91dd9c1436be5087886682532f99

SHA512
602b3ee847c8a13a10cc2de16f070cc926f8b3413557d4b3f8c40bc650ba3a8c12c6b8c542844a6659ae6b3b8b3ec20abd6b2bb4609e3f1441ac36ac9057e80c

Download Submit
\Users\Admin\Pictures\Minor Policy\Gonp2H5ckveo9K3iSi9tu3iV.exe
MD5
a4ec02e6d37f6298e2c74cf92d556b26

SHA1
9880c84c2268ce0146faf55525de347e406e392a

SHA256
b5e597da46615362ad8dce44f85048fdef9d91dd9c1436be5087886682532f99

SHA512
602b3ee847c8a13a10cc2de16f070cc926f8b3413557d4b3f8c40bc650ba3a8c12c6b8c542844a6659ae6b3b8b3ec20abd6b2bb4609e3f1441ac36ac9057e80c

Download Submit
\Users\Admin\Pictures\Minor Policy\JMJhPzbC2n4Zu9meYzq49xfk.exe
MD5
3b64d7c84a343daf29c70331e454affe

SHA1
a6a882396f52d1697337356562cf7813be697e7a

SHA256
3313e6d16aabacfe4f6891408f9e8d3d9005d885e5bd0e8349c2a3dbe9352017

SHA512
fb9835a943b065c9f14af6b8812ec021626faa19672b512a418303c2472ba9450838d66f7a40062a94115a4d1dcd1d6ce42679fb235f8ee58edb94b37b01ca6a

Download Submit
\Users\Admin\Pictures\Minor Policy\h3E1PJPnb3gddvF5jY1EiTjF.exe
MD5
5dbb8eb6db53b2bcb51cac5f47cd5bdf

SHA1
a088f7a2037106b711d800ed6e42cf376f7995fa

SHA256
f1f912280be7cc45100b01e152420e36c76a731d5258e2c617e3a824cf494ddc

SHA512
4bdb5a508768e602e41179001a8e3b4cd2c92b501b61d8c1b6bf659469947f17c63047c7d1208ad5433ba018185633d598c9b22c708ff143dde277b44d73802c

Download Submit
\Users\Admin\Pictures\Minor Policy\reSBqOpFAvDeS2YmHvhpI6Yg.exe
MD5
c340449d532642420d4bedc2e9f7ce7c

SHA1
6153df468674d2eb1680eb6bb0e1bdbc0d6856b7

SHA256
a233b76767157c012c4d1ec34726d87ea1efac01e49efd9fef394c7e84966103

SHA512
c9a085e30ed056c819b992bbe34d606d9fca0704362917ad226b64d233b4800be5fb9de35150f2cdd6bc0f3f1132ac77f558f00dd27ca8d474df4a056a7ff4d3

Download Submit
\Users\Admin\Pictures\Minor Policy\s1nmdxFLL7Hl5PRq4LV7qciE.exe
MD5
04aeaa8f06b71a72b8905da20f679b10

SHA1
ebfa60215fcce5a369f1b340f1232125e37f7a68

SHA256
55c1cbe7368ef1eafbd435a2b570f362868bd2afda1ddbe59bcbb51b7fc63383

SHA512
5c393a8e6b3327ece1555aa73111f67e4858898efbbe38ac757a96d91da26a83f0b130e18b6955796e76bd4300475e8eeec63171c8ef407a09069874f48d5774

Download Submit
\Users\Admin\Pictures\Minor Policy\s1nmdxFLL7Hl5PRq4LV7qciE.exe
MD5
04aeaa8f06b71a72b8905da20f679b10

SHA1
ebfa60215fcce5a369f1b340f1232125e37f7a68

SHA256
55c1cbe7368ef1eafbd435a2b570f362868bd2afda1ddbe59bcbb51b7fc63383

SHA512
5c393a8e6b3327ece1555aa73111f67e4858898efbbe38ac757a96d91da26a83f0b130e18b6955796e76bd4300475e8eeec63171c8ef407a09069874f48d5774

Download Submit
\Users\Admin\Pictures\Minor Policy\uXYDbtCo2pT0ipfckNFNlLZU.exe
MD5
67ca1c303b9a27a042bb23b224aa33de

SHA1
4d0a85da1221d0c2ad531164ffc8917e73ed361a

SHA256
42bd4268ab039ef59233bf49957b4f134d08ce12e1bc5c4be3274150c6355826

SHA512
7bd224e18c4064158fcc2f1695d6f811bac029d9ca72c623485ef17bb79f7fb8f585d2ccbac13166b4269ddd5d0e9cc3e23a32ba241adf02aafd18f1636e54de

Download Submit
\Users\Admin\Pictures\Minor Policy\wnzB9pZg5GbvEtqE_y9VQhAC.exe
MD5
6bf21180935d9c68e9874d3290065319

SHA1
1febcc4eec0e295f15115cdc99551680d1300066

SHA256
84ef0f1d815866aaa7890feb40cd9e2e99d3542a30b842e1569ddcf255b3ba5f

SHA512
92cdadba9fbd7c4853788b4a3c393c4904323fcccc92c6912c47f0748c6305921714f31f830a28f821900772b1f787fa10af584b85fe88647bbf9c0f683cc790

Download Submit
memory/460-70-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-75-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-91-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-158-0x0000000077340000-0x00000000774C0000-memory.dmp

Download
memory/460-162-0x0000000007620000-0x00000000088DB000-memory.dmp

Download
memory/460-146-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-92-0x0000000077340000-0x00000000774C0000-memory.dmp

Download
memory/460-69-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-71-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-143-0x0000000007620000-0x00000000088DB000-memory.dmp

Download
memory/460-73-0x0000000077340000-0x00000000774C0000-memory.dmp

Download
memory/460-67-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Download
memory/460-76-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-68-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-74-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/460-72-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/1232-194-0x0000000010000000-0x0000000010940000-memory.dmp

Download
memory/1232-183-0x0000000000000000-mapping.dmp

Download
memory/1624-192-0x0000000000000000-mapping.dmp

Download
memory/1632-170-0x0000000000000000-mapping.dmp

Download
memory/2284-173-0x0000000000000000-mapping.dmp

Download
memory/2308-203-0x0000000000000000-mapping.dmp

Download
memory/2692-136-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2692-87-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2692-86-0x0000000077340000-0x00000000774C0000-memory.dmp

Download
memory/2692-214-0x0000000008880000-0x0000000009B3B000-memory.dmp

Download
memory/2692-83-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2692-79-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2692-84-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2692-138-0x0000000077340000-0x00000000774C0000-memory.dmp

Download
memory/2692-80-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2692-85-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2692-81-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2692-82-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/2732-175-0x0000000001ED0000-0x0000000002080000-memory.dmp

Download
memory/2732-159-0x0000000000000000-mapping.dmp

Download
memory/3032-196-0x0000000000000000-mapping.dmp

Download
memory/3064-193-0x0000000000000000-mapping.dmp

Download
memory/3180-184-0x0000000000000000-mapping.dmp

Download
memory/3188-134-0x0000000140000000-0x000000014060D000-memory.dmp

Download
memory/3188-101-0x0000000000000000-mapping.dmp

Download
memory/3208-103-0x0000000000000000-mapping.dmp

Download
memory/3232-167-0x00000000002A0000-0x00000000002A9000-memory.dmp

Download
memory/3232-169-0x0000000000400000-0x000000000044A000-memory.dmp

Download
memory/3232-182-0x0000000000400000-0x000000000044A000-memory.dmp

Download
memory/3232-165-0x00000000004DC000-0x00000000004EC000-memory.dmp

Download
memory/3232-108-0x0000000000000000-mapping.dmp

Download
memory/3252-111-0x0000000000000000-mapping.dmp

Download
memory/3264-112-0x0000000000000000-mapping.dmp

Download
memory/3348-116-0x0000000000000000-mapping.dmp

Download
memory/3356-117-0x0000000000000000-mapping.dmp

Download
memory/3364-174-0x0000000000000000-mapping.dmp

Download
memory/3384-119-0x0000000000000000-mapping.dmp

Download
memory/3400-191-0x0000000000000000-mapping.dmp

Download
memory/3436-127-0x0000000000000000-mapping.dmp

Download
memory/3436-163-0x0000000000E50000-0x0000000000E8E000-memory.dmp

Download
memory/3448-128-0x0000000000000000-mapping.dmp

Download
memory/3448-190-0x0000000004A80000-0x0000000004AC6000-memory.dmp

Download
memory/3448-172-0x0000000004A30000-0x0000000004A78000-memory.dmp

Download
memory/3448-147-0x0000000000400000-0x0000000000948000-memory.dmp

Download
memory/3468-130-0x0000000000000000-mapping.dmp

Download
memory/3484-131-0x0000000000000000-mapping.dmp

Download
memory/3496-132-0x0000000000000000-mapping.dmp

Download
memory/3496-180-0x0000000001190000-0x000000000244B000-memory.dmp

Download
memory/3648-207-0x0000000000000000-mapping.dmp

Download
memory/3656-195-0x0000000000000000-mapping.dmp

Download
memory/3664-200-0x0000000000000000-mapping.dmp

Download
memory/3728-139-0x0000000000000000-mapping.dmp

Download
memory/3752-152-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3752-156-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3752-151-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3752-178-0x0000000077340000-0x00000000774C0000-memory.dmp

Download
memory/3752-150-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3752-155-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3752-154-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3752-181-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3752-153-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3872-201-0x0000000000000000-mapping.dmp

Download
memory/3884-205-0x0000000000000000-mapping.dmp

Download
memory/3888-185-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3888-187-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3888-179-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3888-176-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3888-197-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3888-171-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3888-188-0x0000000077340000-0x00000000774C0000-memory.dmp

Download
memory/3888-211-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3888-189-0x00000000011C0000-0x0000000001C3A000-memory.dmp

Download
memory/3896-198-0x0000000000000000-mapping.dmp

Download
memory/3904-144-0x0000000000000000-mapping.dmp

Download
memory/3936-199-0x0000000000000000-mapping.dmp

Download
memory/3960-149-0x0000000000000000-mapping.dmp

Download
memory/3988-209-0x0000000000000000-mapping.dmp

Download
memory/4016-204-0x0000000000000000-mapping.dmp

Download