aee69ef9040e902b7a6639d7594df47e0e73625143a671583db8b85be525a3e5

Resubmissions

02/03/2024, 22:38

240302-2kwptaae3710

02/03/2024, 22:34

240302-2g86qsad9610

Analysis

max time kernel
1801s
max time network
1799s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fake AV/InternetSecurityGuard.exe
Size 6.1MB
Sample240302-2kwptaae37
SHA256 b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77
MD5 04155ed507699b4e37532e8371192c0b
SHA1 a14107131237dbb0df750e74281c462a2ea61016
SHA512 6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371
SSDEEP 98304:hvOOFJ+Z8eAgy7SH9s76RSvyqJOBgECfMfYv+85JH0DVczt8A:hvOOFJ+ggr9s76R+wcMAv+IHCczt8
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

bootkit discovery evasion persistence spyware stealer

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	InternetSecurityGuard.exe

Blocks application from running via registry modification 18 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe"	InternetSecurityGuard.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\host_new	InternetSecurityGuard.exe
File created	C:\Windows\System32\drivers\etc\hosts	InternetSecurityGuard.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	InternetSecurityGuard.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	InternetSecurityGuard.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMsnScan.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hwpe.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\persfw.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolcv.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdfndr.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\driverctrl.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfplogvw.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avciman.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsched32.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PC_Antispyware2010.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atro55en.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\start.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PskSvc.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpfsetup.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jammer.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwtool16.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svc.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bvt.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDInProcPatch.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgbob.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashMaiSv.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnsx.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpf.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfd.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssmmc32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npf40_tw_98_nt_me_2k.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avupgsvc.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDInProcPatch.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerscan.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winppr32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lordpe.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdt.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscache.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supftrl.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\W3asbas.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 36 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\58117\\IS3be.exe\" /s /d"	InternetSecurityGuard.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	InternetSecurityGuard.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	InternetSecurityGuard.exe
File opened (read-only)	\??\U:	InternetSecurityGuard.exe
File opened (read-only)	\??\Y:	InternetSecurityGuard.exe
File opened (read-only)	\??\J:	InternetSecurityGuard.exe
File opened (read-only)	\??\O:	InternetSecurityGuard.exe
File opened (read-only)	\??\Q:	InternetSecurityGuard.exe
File opened (read-only)	\??\N:	InternetSecurityGuard.exe
File opened (read-only)	\??\W:	InternetSecurityGuard.exe
File opened (read-only)	\??\H:	InternetSecurityGuard.exe
File opened (read-only)	\??\K:	InternetSecurityGuard.exe
File opened (read-only)	\??\M:	InternetSecurityGuard.exe
File opened (read-only)	\??\L:	InternetSecurityGuard.exe
File opened (read-only)	\??\P:	InternetSecurityGuard.exe
File opened (read-only)	\??\V:	InternetSecurityGuard.exe
File opened (read-only)	\??\R:	InternetSecurityGuard.exe
File opened (read-only)	\??\S:	InternetSecurityGuard.exe
File opened (read-only)	\??\X:	InternetSecurityGuard.exe
File opened (read-only)	\??\Z:	InternetSecurityGuard.exe
File opened (read-only)	\??\E:	InternetSecurityGuard.exe
File opened (read-only)	\??\G:	InternetSecurityGuard.exe
File opened (read-only)	\??\I:	InternetSecurityGuard.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	InternetSecurityGuard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\ltHI = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\ltTST = "17729"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IIL = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	InternetSecurityGuard.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FAKEAV~1\\INTERN~1.EXE"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Software\Microsoft	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Software\Microsoft\Internet Explorer	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\Clsid	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Software	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\ = "Implements DocHostUIHandler"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "InternetSecurityGuard.DocHostUIHandler"	InternetSecurityGuard.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2272	mofcomp.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4324	InternetSecurityGuard.exe
4324	InternetSecurityGuard.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2272	4324	InternetSecurityGuard.exe	93
PID 4324 wrote to memory of 2272	4324	InternetSecurityGuard.exe	93
PID 4324 wrote to memory of 2272	4324	InternetSecurityGuard.exe	93
PID 4324 wrote to memory of 4064	4324	InternetSecurityGuard.exe	94
PID 4324 wrote to memory of 4064	4324	InternetSecurityGuard.exe	94
PID 4324 wrote to memory of 4064	4324	InternetSecurityGuard.exe	94
PID 4324 wrote to memory of 4504	4324	InternetSecurityGuard.exe	97
PID 4324 wrote to memory of 4504	4324	InternetSecurityGuard.exe	97
PID 4324 wrote to memory of 4504	4324	InternetSecurityGuard.exe	97
PID 4324 wrote to memory of 4412	4324	InternetSecurityGuard.exe	121
PID 4324 wrote to memory of 4412	4324	InternetSecurityGuard.exe	121
PID 4324 wrote to memory of 4412	4324	InternetSecurityGuard.exe	121
PID 4324 wrote to memory of 4844	4324	InternetSecurityGuard.exe	122
PID 4324 wrote to memory of 4844	4324	InternetSecurityGuard.exe	122
PID 4324 wrote to memory of 4844	4324	InternetSecurityGuard.exe	122
PID 4324 wrote to memory of 4856	4324	InternetSecurityGuard.exe	124
PID 4324 wrote to memory of 4856	4324	InternetSecurityGuard.exe	124
PID 4324 wrote to memory of 4856	4324	InternetSecurityGuard.exe	124
PID 4324 wrote to memory of 4316	4324	InternetSecurityGuard.exe	106
PID 4324 wrote to memory of 4316	4324	InternetSecurityGuard.exe	106
PID 4324 wrote to memory of 4316	4324	InternetSecurityGuard.exe	106
PID 4324 wrote to memory of 4008	4324	InternetSecurityGuard.exe	108
PID 4324 wrote to memory of 4008	4324	InternetSecurityGuard.exe	108
PID 4324 wrote to memory of 4008	4324	InternetSecurityGuard.exe	108
PID 4324 wrote to memory of 4544	4324	InternetSecurityGuard.exe	111
PID 4324 wrote to memory of 4544	4324	InternetSecurityGuard.exe	111
PID 4324 wrote to memory of 4544	4324	InternetSecurityGuard.exe	111
PID 4324 wrote to memory of 3788	4324	InternetSecurityGuard.exe	114
PID 4324 wrote to memory of 3788	4324	InternetSecurityGuard.exe	114
PID 4324 wrote to memory of 3788	4324	InternetSecurityGuard.exe	114
PID 4324 wrote to memory of 2576	4324	InternetSecurityGuard.exe	116
PID 4324 wrote to memory of 2576	4324	InternetSecurityGuard.exe	116
PID 4324 wrote to memory of 2576	4324	InternetSecurityGuard.exe	116
PID 4324 wrote to memory of 2116	4324	InternetSecurityGuard.exe	118
PID 4324 wrote to memory of 2116	4324	InternetSecurityGuard.exe	118
PID 4324 wrote to memory of 2116	4324	InternetSecurityGuard.exe	118
PID 4324 wrote to memory of 3972	4324	InternetSecurityGuard.exe	120
PID 4324 wrote to memory of 3972	4324	InternetSecurityGuard.exe	120
PID 4324 wrote to memory of 3972	4324	InternetSecurityGuard.exe	120
PID 4324 wrote to memory of 4844	4324	InternetSecurityGuard.exe	122
PID 4324 wrote to memory of 4844	4324	InternetSecurityGuard.exe	122
PID 4324 wrote to memory of 4844	4324	InternetSecurityGuard.exe	122
PID 4324 wrote to memory of 4856	4324	InternetSecurityGuard.exe	124
PID 4324 wrote to memory of 4856	4324	InternetSecurityGuard.exe	124
PID 4324 wrote to memory of 4856	4324	InternetSecurityGuard.exe	124
PID 4324 wrote to memory of 2556	4324	InternetSecurityGuard.exe	126
PID 4324 wrote to memory of 2556	4324	InternetSecurityGuard.exe	126
PID 4324 wrote to memory of 2556	4324	InternetSecurityGuard.exe	126
PID 4324 wrote to memory of 3068	4324	InternetSecurityGuard.exe	128
PID 4324 wrote to memory of 3068	4324	InternetSecurityGuard.exe	128
PID 4324 wrote to memory of 3068	4324	InternetSecurityGuard.exe	128
PID 4324 wrote to memory of 4912	4324	InternetSecurityGuard.exe	130
PID 4324 wrote to memory of 4912	4324	InternetSecurityGuard.exe	130
PID 4324 wrote to memory of 4912	4324	InternetSecurityGuard.exe	130
PID 4324 wrote to memory of 1428	4324	InternetSecurityGuard.exe	133
PID 4324 wrote to memory of 1428	4324	InternetSecurityGuard.exe	133
PID 4324 wrote to memory of 1428	4324	InternetSecurityGuard.exe	133
PID 4324 wrote to memory of 3624	4324	InternetSecurityGuard.exe	135
PID 4324 wrote to memory of 3624	4324	InternetSecurityGuard.exe	135
PID 4324 wrote to memory of 3624	4324	InternetSecurityGuard.exe	135
PID 4324 wrote to memory of 544	4324	InternetSecurityGuard.exe	137
PID 4324 wrote to memory of 544	4324	InternetSecurityGuard.exe	137
PID 4324 wrote to memory of 544	4324	InternetSecurityGuard.exe	137
PID 4324 wrote to memory of 4900	4324	InternetSecurityGuard.exe	139

C:\Users\Admin\AppData\Local\Temp\Fake AV\InternetSecurityGuard.exe
"C:\Users\Admin\AppData\Local\Temp\Fake AV\InternetSecurityGuard.exe"
1⤵
- Enumerates VirtualBox registry keys
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp "C:\Users\Admin\AppData\Local\Temp\Fake AV\13.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\SysWOW64\netsh.exe
  netsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Fake AV\InternetSecurityGuard.exe" "Internet Security Guard" ENABLE
  2⤵
  PID:4064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.com 8.8.8.8
  2⤵
  PID:4504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.net 8.8.8.8
  2⤵
  PID:4412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.com 208.67.222.222
  2⤵
  PID:4844
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.net 208.67.222.222
  2⤵
  PID:4856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.com 8.8.4.4
  2⤵
  PID:4316
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.net 8.8.4.4
  2⤵
  PID:4008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.com 208.67.220.220
  2⤵
  PID:4544
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt diinu560ubjjsv.net 208.67.220.220
  2⤵
  PID:3788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.com 8.8.8.8
  2⤵
  PID:2576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.net 8.8.8.8
  2⤵
  PID:2116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.com 208.67.222.222
  2⤵
  PID:3972
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.net 208.67.222.222
  2⤵
  PID:4844
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.com 8.8.4.4
  2⤵
  PID:4856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.net 8.8.4.4
  2⤵
  PID:2556
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.com 208.67.220.220
  2⤵
  PID:3068
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt insssyfinr1275tc.net 208.67.220.220
  2⤵
  PID:4912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.com 8.8.8.8
  2⤵
  PID:1428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.net 8.8.8.8
  2⤵
  PID:3624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.com 208.67.222.222
  2⤵
  PID:544
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.net 208.67.222.222
  2⤵
  PID:4900
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.com 8.8.4.4
  2⤵
  PID:4504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.net 8.8.4.4
  2⤵
  PID:1060
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.com 208.67.220.220
  2⤵
  PID:5012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt hppwycfjr1248swx.net 208.67.220.220
  2⤵
  PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3324 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2608 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IS3be.exe

Path C:\ProgramData\58117\IS3be.exe
Size 1.6MB
SHA256 ed91d7b63c8e37e45b919cb8c1608609bda48ce90e82ad01695a98b73236514b
MD5 55f79fe733be19706936f0abdafff2ba
SHA1 85919d2c809bed26f4a08378840007dfa1c000ae
SHA512 487927e621356c291ee176a1e9115c2ab56a9892a6703f4bc8cfb6fac40c77b8c6029442dfa64c040497409730ef7b33f59f680e57dfa3c4997d4390ff1b9787
SSDEEP 24576:nQyyevWWdA6Mibs1vOFJ+tWLUj1qePeQcgVidlgKcOFBhZ5MAyWGlkLHnaLDAivT:hvJA1vOFJ+0L28eAgKd7dE2AAE9p7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 196B
SHA256 8c39246796530ee7588fc16486335d00d5b7273ebb26efe5833e4cfc2bcfe223
MD5 6e86650ad96258b23f022605c5f202d5
SHA1 321290e91871cb653441e3c87ee8b20ab5f008a0
SHA512 e8a7bdf4bd2fba233a1a6cdf977d57dcb37ae46bc52bf29b4d23c6294e769069e146bcb5f56c4edbc3f93d38a226a9349f604b54156696ccdef41106cc05060c
MD5 SHA1 SHA512

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 379B
SHA256 b0f25cda37a0590e6eaaf405e33eee3d50113e86801a03a7cefd1b580b81374a
MD5 6871230366e5a626c0e1309e1aad06a0
SHA1 7b55b19a7ce4e337fe0c5496c58c7b3bd9813e26
SHA512 6a384fd84db550d88f096f5539447f2e7fe2c6e7b3247c12f2f4a44858a45c2db3e5cebd0dc67618bbcee39313043773e85b7d988fb1993dd4eb36d5aa0e59f5
MD5 SHA1 SHA512

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 1KB
SHA256 ef85197b121ac4233011aa98b2ef748a8f6e64990c62da0c693bb6ee20df169f
MD5 960bfd7a85bbb2cff7ad93f9c460e65b
SHA1 32831b399c0925cf0363cd8c6cb976a282cd63d6
SHA512 57bfd2902fb0cb3777899d6041582433313278de3e38c6d2626b753ac5ad191d14fbb59d9107f322a558b8547979881406de40e9b6515ae3a25360bb9e065628
MD5 SHA1 SHA512

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 1KB
SHA256 d2305b9c7f508e2830d307bfd796124dc1ef608fc54736c36fbc6a7f672e0c3c
MD5 87973e9f53f15455366d272408bb4b72
SHA1 aecfd2021567682dfd568b167c7267c0366bc1ba
SHA512 b9543d363b4ffa8fbd75df77c88a957ebc3c95ad9b1790cddcc78cccdef59dc448e142dd4357aa9c0b2a0073745ff05fa1ccf33b33b410e33c808a5aa55571bd
MD5 SHA1 SHA512

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 1KB
SHA256 4f13a78ca511483504d401c70ca322605e6ae41b34253a3da6dc8aaceae4edb2
MD5 9dddabdf82798874e51afdcda1074cb9
SHA1 40627f19c239cb7f4c1aaf2495f2e5cbc1f8b526
SHA512 7903ba76a82fd1977ffa7a8bd2229b2d67be869c87e4cecea08fbc49ae1cd19f70654f961daa074b1fa9e4c1556188ee6c5ec0b790faadf8046ac19c1f3416fe
MD5 SHA1 SHA512

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 2KB
SHA256 c3bd45206ef62d0416d72911f2a3922a68e7e585359834bc41efb8e5ff56a2b6
MD5 335e4defd8e9a343064fc37a8554a422
SHA1 8a1036b3a1c3f24b03416fdbd6f212b42114466d
SHA512 14a9ac11a2ddb3515c851eb79c1dee986b19f7ac73d7bee8cc180f36f68254a884caaabf42c3223963fa95958c0f9367a40754532df070f0175c8a522f104693
MD5 SHA1 SHA512

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 2KB
SHA256 8ce0d9b31ac1e69a268f0a57b2dfb1f8ee42e294b907387b48dafdde00eec6fd
MD5 367c6a5eeeceac6d4de144b0a7fa7eed
SHA1 8db02ba0666d4be9beb4312d48470f0686e20c4f
SHA512 151a7483ca3fb5d06a5a755ae0623a50f85597a9b6f0547d5651a5f563f343c2934328744d9c530026da791237930d77cd1594aa90b7b18173f5d0b77f7d1edd
MD5 SHA1 SHA512

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 3KB
SHA256 2fe5ec3e8c672ed5a1de0caab5bae1586be488538d1ed1860a56dbce7e9dafcb
MD5 4292d8765c0fe5b5d000236a5a60f1b1
SHA1 0729be3c44923d760403a0b98b1aa3e1f0f98320
SHA512 75e3b852675b23b08f4aa641bbed5e3e9298f7afe2eacc1fec2bb77aac59ce8c4e5c75ff10f17d1012fccab2dd89ce45b1bf15eb071aded8b6c0f021ebdd71b1
MD5 SHA1 SHA512

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 4KB
SHA256 7cff287af0fd70070fbaf977776aecac9c1207d9af0365ae73c1da0d262adfac
MD5 993c1465133479f6aaa6b674031c7a13
SHA1 070fde059b20f2141c025877029a5cc57f1b2477
SHA512 6a9a38531d032fbb3623ba79b7f34b35b944fdbabcd1d8546732914a18218e5f717ac2c5c6573423a9671de2d9ab552fcab1df20a04ab270504e6719f38e5ef2
SSDEEP 96:rMKcIDhLtICS9q+pYBzhmbfkh41tRVSw6a8UKYdXVTJr:rMKcI81q+6yb8h/YJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 5KB
SHA256 fe9585a540133cce4ecee74978ae377aaa8e27f47c6abb2bfbd1cc6861d461e1
MD5 e1fbe0a0e0946e1d0a75c22a4594eda9
SHA1 690b0f98a392bd5563ba6136219fe33e6cc0b3b6
SHA512 00700687f4a6b5a2374fc3db15ed2eb7652dcbff066d82014bcafb86235cede352b8bbece3718effa76d7fb50884fa085d82c1f84caf47293a95beec1441fe9e
SSDEEP 96:rMKcIDhLtICS9q+xYBzhmbfkhj1tRVSw6a8UKYdXVTJbLmjrx+:rMKcI81q+Syb84/YarI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 6KB
SHA256 e4812294cef0ddbed13f5882e89af73151ba8c20df72a055037cfcf8128540ed
MD5 38686b54b9c445a57adc915e696ba2b2
SHA1 a42c0853db90dc738d3609bd819a2348de77045e
SHA512 a9d3cec23ad75acd938f6347424587012c2228e00d0004f40c287be90b6adaa7948b0bc2aa0459c81c5d7a051c26a29a1e7f80e7abcd334a11b90921774fc13c
SSDEEP 96:rMKcIDhLtICS9q+xYBzhmbfkhIt1tRVSw6a8UKYdXVTJbLmjrxh8U/Q/:rMKcI81q+Syb82A/Yar1/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 6KB
SHA256 d7fa7138a3d5c42a527f1e7ca8ef95aed2bcf18d1ce1ee2a4fad8d309d991297
MD5 584fd96828cea92461bfeb4b1ab4ff3f
SHA1 2dcf732dbc02b0119f2908b578b37d2bacbfa8f6
SHA512 161221d70409c88e6b378c6fe0e6dcd92d1bfcf0232950cea923546647e2a806fe0e965e92fbb6814e77644a9ec960d61e3c85c0356b21db01796bd6a3bcfae4
SSDEEP 96:rMKcIDhLtICS9q+xYBzhmbfkh11tRVSw6a8UKYdXVTJbLmjrxh8U/Q5zwZJrxI:rMKcI81q+Syb8K/Yar1/PJrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 7KB
SHA256 50128802e80b1da34b576eecdf3d94e6cff411246e6e80a1075981ccd976b5a3
MD5 f75800cc1c37bf14925bfd8113d070bb
SHA1 b494d11aca02dff51b5437403da34d850e4980c6
SHA512 247c83bb3ca2e4a33c465e3c26f69c2534818e40a66262e7ff258d0c7647ab99e4cadf0f3b1c168eb51cc5ff787f92e762dfc76070468d735c31048917a1bec8
SSDEEP 96:rMKcIDhLtICS9q+xYBzhmbfkhM1tRVSw6a8UKYdXVTJbLmjrxh8U/Q5zwZJrxFuW:rMKcI81q+Syb8N/Yar1/PJrhqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 8KB
SHA256 84b4a5bdc0027fad1fe9a755c4f4e981e8dc7eb26d6941caba3305eee59b49ba
MD5 c49e21c821c4a48bcc0d88ad7b691ce1
SHA1 de7dfb1c76318088159804407e2b730aa38bb9ce
SHA512 38812ef78862a454470e127217eb26bfc09048dd07eaae68268cd89c7276a84e7765929f44a482de040f9b4a2b747ff9817cbe1f984c4b70f9bd4c4228987a8f
SSDEEP 192:rMKcI81q+Syb8R/Yar1/PJrhqMEVuIsc1:4I8wLybM/YWNlc1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 9KB
SHA256 39d8c2a52e1ace18a83f4ace58d0f83581fcd032c87611c8fff35b758f93ed4b
MD5 e8609ff64a46e977ac4e0cba23df0af5
SHA1 ad2e02d8e80308e259d96a1b8c161eb288b8387b
SHA512 b129338561214ddbc66e59d053f6e27a8a20ad6a165629c6e826b7b54b94716dce943890dd9b6c71b43f667271edb6096e14436b0fda411745d8bfc0113168c9
SSDEEP 192:rMKcI81q+Syb8M/Yar1/PJrhqMEVuIscMxPhE:4I8wLybR/YWNlcwhE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 10KB
SHA256 042468e0b4a444b9158a2da7bada8e7192267fe692aa2293d96c84ed1ca67c98
MD5 581f83985926a642320015798ade0329
SHA1 e7c374513a073c3aad6953b9f2376573e032aaea
SHA512 f7f68144e179ced2819a2306e49e3e4e3f946a3730ae91798f1737b3d6d7dd598a7a77b2bb0762a807f2fb68a0980996dad86176e360c8be2b539c77f2109688
SSDEEP 192:rMKcI81q+Syb8h/Yar1/PJrhqMEVuIscMxPhkzEVI2EVuIsc9:4I8wLybk/YWNlcwhjI2lc9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 11KB
SHA256 37dc39717decbcdc805de7d93b5db19b42f78f2963da6c066691cbcee124bded
MD5 fdcea2b1f73e045d4f576e25c521c431
SHA1 951fa0ee101bc8da13e998c82a51506a44afa3aa
SHA512 e7bf31e645321754db3a4e2a8b6ca78928e8d3d2d9da2e47e14ccd433c1fec0846a81a7728521f52628f189fc2fa418224553041cfa2078f8d24e266de1ea3d4
SSDEEP 192:rMKcI81q+Syb8c/Yar1/PJrhqMEVuIscMxPhkzEVI2EVuIscG6:4I8wLybp/YWNlcwhjI2lcG6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 12KB
SHA256 d59d074e987bb3f7724c3036ad5ec7dc8ea2e4330e7e0288dfc145aa15c4371e
MD5 bc9908da1946dd75ca3b900ca14ae9e3
SHA1 45a6c4dd7b6020c7ad2e6ebb3efceafe9bc030ad
SHA512 d924b5614eba1a7556faa1aed36880e6362f4801c4dbbc9d24df1f1802349e97799d7509e70fd58148155384b219ce878969763b2dbec13eceec4c7377242ecc
SSDEEP 192:rMKcI81q+Syb8K/Yar1/PJrhqMEVuIscMxPhkzEVI2EVuIscGpEVuIscb:4I8wLybb/YWNlcwhjI2lcGplcb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 13KB
SHA256 c3fe323cdcd150a055f36a824da6788310b49c9b7d8f2c4c816765aa63da5878
MD5 2e0646a152f511fa0c7ebcee84aa9972
SHA1 e12683d4f3e590cb35f59fd79dedc4d216158f9b
SHA512 53fabc326efda0fbd8d6e24af0fa70e06b5c5d226e498972e99e5d2ca681659c214fb82784ad364874bfd5a7e405cf0d85fa4e837b7334adf51549e72e49b41e
SSDEEP 192:rMKcI81q+Syb84/Yar1/PJrhqMEVuIscMxPhkzEVI2EVuIscGpEVuIscA2/S:4I8wLyb1/YWNlcwhjI2lcGplcl/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 15KB
SHA256 edc37dffa05dc64544775305ce7930f55225882274987da5429eb3ad250f9d92
MD5 32b0bb8ce86405b7de04d62056f5798f
SHA1 53ba77325e5b954239c225ca4cbc968204d56473
SHA512 45846d0fd6b815ed6170900329b31d03fa9d0e08351b31d7d120b7dfeed5a17caaaffa81bd7e04529b4a536a9eaa74da437206acb87662b8788d5f3d4bb9d45b
SSDEEP 192:rMKcI81q+Syb8T/Yar1/PJrhqMEVuIscMxPhkzEVI2EVuIscGpEVuIscA2/+c1zx:4I8wLyby/YWNlcwhjI2lcGplcl/+Yd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 15KB
SHA256 0125c3f382e076783a371bf1463b0d78340d3346bb7ba3af480a2f802690d549
MD5 ddbb5dd8b03c89a63f0d1d2dea591bf9
SHA1 18ba993c5a0c1e7f00c1e6a9f36ec23518e2c0c5
SHA512 c8a81fb0f6592fd7a4cbb405fe0d4321207722df8d13e1769490395df606d5a05a3746a9de83449413677c3bd3b805702c829b9c84e07e13965c1e8c40b489af
SSDEEP 192:rMKcI81q+Syb8R/Yar1/PJrhqMEVuIscMxPhkzEVI2EVuIscGpEVuIscA2/+c1zx:4I8wLyb0/YWNlcwhjI2lcGplcl/+Yd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 16KB
SHA256 0bbf0e1e1b48755c6e87bb466faf928fac8513cad02fc5b6a0f39ff114f87f80
MD5 ed76002e770714721c032b67e1aaa588
SHA1 81ac97c117251452c45ee1b54c2457c28869b370
SHA512 6d2b7ec5c58a1f3c377e2ea192c2340dfbe620bbffc566719e4775fb82932101bc80cb9ecf1a70e8c31fd6955c617beb5a35e8e091484965c26cfb63568e013b
SSDEEP 384:4I8wLybO/YWNlcwhjI2lcGplcl/+Y9lc9:4I89Wlcw62lcclcJlc9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 16KB
SHA256 6203d0d132a61e0dcfd01f422f6b7094c747a0b4de5b4009b3604b4bfa6d52fd
MD5 ffa582938c9d03507b9af32c7a71f2b5
SHA1 dbe19e4c023838860a43a8fcaa44556fccb48886
SHA512 13c2adfc5938ace1c02aba73d5fcfaf6fa417175a000b2ee73e7ba35c6e42f3f4de6659915f88d7d79a77d83008529f902293615b37dc6ba8b73e1efaeb83475
SSDEEP 384:4ILwLAbO/YWNlcwhjI2lcGplcl/+Y9lc9:4IL5Wlcw62lcclcJlc9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISZECJXG.cfg

Path C:\ProgramData\ISDJCG\ISZECJXG.cfg
Size 185B
SHA256 c47da9be4fc4d757add73c49654c9179067af547d0cc758d6356e2955bbfcb61
MD5 b8224e5293d4fad1927c751cc00c80e7
SHA1 270b8c752c7e93ec5485361fe6ef7b37f0b4513b
SHA512 8fed9a509e46319529145fa2159251e43040d26080af84e44badaab1dd339c767ff75a2c473bc0abfb448b03beb96718ee34ba6bc150ed3085322878b55a22f2
MD5 SHA1 SHA512

Submit Download

13.mof

Path C:\Users\Admin\AppData\Local\Temp\Fake AV\13.mof
Size 344B
SHA256 3c77f5f888d417a7a31284cb8c5e3bdb4d926c4a274cecac8a8b2920659d5927
MD5 3754f8f8abad5bad797085d0717a9766
SHA1 48d92f36cb721b390e216aa03b27b41f25c563fc
SHA512 c59f322ece53c757767e52fe9bfbc3526a13afe9ec7503e3d1cae683eeb55cbb808a1bce720fd58f97f286756d314124bcf797c2167275e08ed93ba759bf3985
MD5 SHA1 SHA512

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Internet Security Guard\cookies.sqlite
Size 96KB
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
SSDEEP 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 843e12137a61312e1956f3f9da7ec44061b59f1e42059474dbe53d31393ae77c
MD5 1732d165e66e0cf4aae165fa05cf845f
SHA1 0db53e17348e29276f972dec008b9bca83a50c80
SHA512 d25b4c560b82af639617a1dab5d11b497c1e442e67f6b4d1dcfcc3020b0684c74bd40ba2738ac2ec4ef954df1bb74097ef38401d1296c2976c6f49a08b855b1d
SSDEEP 96:xHGg5nUTeqGqpdI6GeOTzSBPXAnpjpHhE2u5DtABw8V7knSB+:35nIRpdI6GeXPX+hExXABw8VY0+
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
MD5 SHA1 SHA512

Submit Download

memory/4324-633-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-649-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-481-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-440-0x00000000021B0000-0x00000000021B1000-memory.dmp

Download

memory/4324-439-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-274-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-88-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-618-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-621-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-623-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-626-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-627-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-628-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-629-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-630-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-631-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-632-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-0-0x00000000021B0000-0x00000000021B1000-memory.dmp

Download

memory/4324-634-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-635-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-636-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-637-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-638-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-639-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-640-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-641-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-642-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-643-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-644-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-645-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-646-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-647-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-648-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-482-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-650-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-651-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-652-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-653-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-654-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-655-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-656-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-657-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-658-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-659-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-660-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-661-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-662-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-663-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-664-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-665-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-666-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-667-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-668-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-669-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-670-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-671-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-672-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-673-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-674-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-675-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-676-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-677-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-678-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-679-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-680-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4324-681-0x0000000013140000-0x0000000013764000-memory.dmp

Download