Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

Analysis

  • max time kernel
    68s
  • max time network
    275s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/04/2024, 22:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    11da303928db319382c12f97a02cfbb9f3a4b029b4e823704e7aaeaf86916b08.exe
  • Size 1.8MB
  • Sample240404-19fjfsbe7s
  • SHA256 11da303928db319382c12f97a02cfbb9f3a4b029b4e823704e7aaeaf86916b08
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygluptebalummaredlineriseprozgrat@oleh_pspjok123livetrafficgooglediscoverydropperevasioninfostealerloaderpersistencephishingratspywarestealerthemidatrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.17

C2

  • http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • @OLEH_PSP

C2

  • 185.172.128.33:8970

Extracted

Family

  • redline

Botnet

  • Jok123

C2

  • 185.215.113.67:26260

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 4.185.137.132:1632

Extracted

Family

  • amadey

Version

  • 4.17

C2

  • http://185.215.113.32

Attributes
  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://affordcharmcropwo.shop/api

  • https://enthusiasimtitleow.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 6 IoCs
  • Detected google phishing page
    phishinggoogle
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 9 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\11da303928db319382c12f97a02cfbb9f3a4b029b4e823704e7aaeaf86916b08.exe
    "C:\Users\Admin\AppData\Local\Temp\11da303928db319382c12f97a02cfbb9f3a4b029b4e823704e7aaeaf86916b08.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1104
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3924
    • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
      "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
          "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5052
        • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
          "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4448
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
          4⤵
            PID:6264
            • C:\Windows\SysWOW64\choice.exe
              choice /C Y /N /D Y /T 3
              5⤵
                PID:6696
        • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
          "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
          2⤵
          • Executes dropped EXE
          PID:3560
        • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
          "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4604
        • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
          "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4008
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:2192
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3436
            • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
              "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2540
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
                3⤵
                • Creates scheduled task(s)
                PID:4144
              • C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe
                "C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:5096
                • C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:2556
              • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                "C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"
                3⤵
                • Executes dropped EXE
                PID:1952
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:7052
                • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"
                  4⤵
                    PID:5268
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                        PID:6904
                      • C:\Windows\System32\cmd.exe
                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                        5⤵
                          PID:6228
                          • C:\Windows\system32\netsh.exe
                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                            6⤵
                            • Modifies Windows Firewall
                            PID:6556
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          5⤵
                            PID:4972
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            5⤵
                              PID:5160
                        • C:\Users\Admin\AppData\Local\Temp\1000184001\toolspub1.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000184001\toolspub1.exe"
                          3⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          PID:3300
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 492
                            4⤵
                            • Program crash
                            PID:4956
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                        2⤵
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:2836
                        • C:\Windows\system32\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                          3⤵
                          • Blocklisted process makes network request
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2988
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profiles
                            4⤵
                              PID:5024
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\687926120302_Desktop.zip' -CompressionLevel Optimal
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1592
                        • C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                          "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:2956
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3960
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 816
                            3⤵
                            • Program crash
                            PID:4228
                        • C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
                          "C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:3240
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5092
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 800
                            3⤵
                            • Program crash
                            PID:1256
                        • C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe
                          "C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe"
                          2⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2000
                        • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                          "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
                          2⤵
                            PID:1908
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            2⤵
                            • Blocklisted process makes network request
                            • Loads dropped DLL
                            PID:5252
                          • C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
                            "C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"
                            2⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            PID:5400
                          • C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
                            "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"
                            2⤵
                            • UAC bypass
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:5756
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe" -Force
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5148
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3636
                              • C:\Users\Admin\Pictures\R8uXlhKAor1uQeXsBCfcVdy0.exe
                                "C:\Users\Admin\Pictures\R8uXlhKAor1uQeXsBCfcVdy0.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:5272
                                • C:\Users\Admin\Pictures\R8uXlhKAor1uQeXsBCfcVdy0.exe
                                  "C:\Users\Admin\Pictures\R8uXlhKAor1uQeXsBCfcVdy0.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:4324
                              • C:\Users\Admin\Pictures\76MoqyoHvdb0cn8ZKhDt4x6Y.exe
                                "C:\Users\Admin\Pictures\76MoqyoHvdb0cn8ZKhDt4x6Y.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:6040
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6208
                                  • C:\Windows\System32\Conhost.exe
                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    6⤵
                                      PID:1592
                                  • C:\Users\Admin\Pictures\76MoqyoHvdb0cn8ZKhDt4x6Y.exe
                                    "C:\Users\Admin\Pictures\76MoqyoHvdb0cn8ZKhDt4x6Y.exe"
                                    5⤵
                                      PID:7068
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        6⤵
                                          PID:1580
                                        • C:\Windows\System32\cmd.exe
                                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                          6⤵
                                            PID:6340
                                            • C:\Windows\system32\netsh.exe
                                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                              7⤵
                                              • Modifies Windows Firewall
                                              PID:6420
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            6⤵
                                              PID:1320
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              6⤵
                                                PID:5872
                                              • C:\Windows\rss\csrss.exe
                                                C:\Windows\rss\csrss.exe
                                                6⤵
                                                  PID:7112
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -nologo -noprofile
                                                    7⤵
                                                      PID:504
                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                      7⤵
                                                      • Creates scheduled task(s)
                                                      PID:6808
                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                      schtasks /delete /tn ScheduledUpdate /f
                                                      7⤵
                                                        PID:3596
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -nologo -noprofile
                                                        7⤵
                                                          PID:2568
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -nologo -noprofile
                                                          7⤵
                                                            PID:4560
                                                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                            7⤵
                                                              PID:4044
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                8⤵
                                                                  PID:7052
                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                7⤵
                                                                • Creates scheduled task(s)
                                                                PID:6712
                                                        • C:\Users\Admin\Pictures\UQlev6uqnycSrCpJd9okWUZd.exe
                                                          "C:\Users\Admin\Pictures\UQlev6uqnycSrCpJd9okWUZd.exe"
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:5804
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -nologo -noprofile
                                                            5⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:6368
                                                          • C:\Users\Admin\Pictures\UQlev6uqnycSrCpJd9okWUZd.exe
                                                            "C:\Users\Admin\Pictures\UQlev6uqnycSrCpJd9okWUZd.exe"
                                                            5⤵
                                                              PID:5768
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -nologo -noprofile
                                                                6⤵
                                                                  PID:3252
                                                                • C:\Windows\System32\cmd.exe
                                                                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                  6⤵
                                                                    PID:5592
                                                                    • C:\Windows\system32\netsh.exe
                                                                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                      7⤵
                                                                      • Modifies Windows Firewall
                                                                      PID:680
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -nologo -noprofile
                                                                    6⤵
                                                                      PID:5892
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -nologo -noprofile
                                                                      6⤵
                                                                        PID:6248
                                                                  • C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe
                                                                    "C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe" --silent --allusers=0
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Enumerates connected drives
                                                                    PID:5952
                                                                    • C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe
                                                                      C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2a4,0x2a8,0x2ac,0x2a0,0x2b0,0x6aa4e1d0,0x6aa4e1dc,0x6aa4e1e8
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:6216
                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\llhgE0R2YkRBtmgdrYnJBfW6.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\llhgE0R2YkRBtmgdrYnJBfW6.exe" --version
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:6556
                                                                    • C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe
                                                                      "C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5952 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240404222136" --session-guid=309cc801-14a3-4865-beaa-d865071d1b56 --server-tracking-blob=ZDA5Zjg5NjFkYjgzZmM1NjYxZGRlOTViYzliYjU5NjdiMDUxZTNiZmQ5M2UzZWMxMjhkZWUzMGJjZTk1NTc5MTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIyNjkyOTAuODEyMCIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjFiZmFiNDQ0LTA4Y2MtNGEzZi1iZGVmLWMyNDg2ODhjNWZmNCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B004000000000000
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Enumerates connected drives
                                                                      PID:6616
                                                                      • C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe
                                                                        C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2a0,0x2b0,0x2b4,0x27c,0x2b8,0x692ce1d0,0x692ce1dc,0x692ce1e8
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:6680
                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042221361\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042221361\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                                                                      5⤵
                                                                        PID:5924
                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042221361\assistant\assistant_installer.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042221361\assistant\assistant_installer.exe" --version
                                                                        5⤵
                                                                          PID:6172
                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042221361\assistant\assistant_installer.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042221361\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0xd30040,0xd3004c,0xd30058
                                                                            6⤵
                                                                              PID:5488
                                                                        • C:\Users\Admin\Pictures\dnS4ARHvJwMUAulCGxzRpLBg.exe
                                                                          "C:\Users\Admin\Pictures\dnS4ARHvJwMUAulCGxzRpLBg.exe"
                                                                          4⤵
                                                                          • Modifies firewall policy service
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Drops file in System32 directory
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          PID:7060
                                                                        • C:\Users\Admin\Pictures\r1xrkxXJdqJg3bqAZfTnFhMD.exe
                                                                          "C:\Users\Admin\Pictures\r1xrkxXJdqJg3bqAZfTnFhMD.exe"
                                                                          4⤵
                                                                            PID:2144
                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                                                              5⤵
                                                                                PID:2296
                                                                                • C:\Windows\SYSTEM32\msiexec.exe
                                                                                  "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
                                                                                  6⤵
                                                                                    PID:5580
                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
                                                                                    "ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"
                                                                                    6⤵
                                                                                      PID:4832
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1560
                                                                          • C:\Windows\system32\browser_broker.exe
                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            PID:4480
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5372
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5640
                                                                          • C:\Windows\system32\browser_broker.exe
                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            PID:5880
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies registry class
                                                                            PID:5988
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies registry class
                                                                            PID:5516
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies registry class
                                                                            PID:5944
                                                                          • C:\Windows\system32\browser_broker.exe
                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                            1⤵
                                                                              PID:4000
                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                              1⤵
                                                                                PID:2640
                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                1⤵
                                                                                • Modifies Internet Explorer settings
                                                                                PID:4980
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                • Drops file in Windows directory
                                                                                • Modifies registry class
                                                                                PID:5576
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                1⤵
                                                                                  PID:6320
                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                  1⤵
                                                                                    PID:2832
                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                    1⤵
                                                                                      PID:6972
                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                      1⤵
                                                                                        PID:6332
                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                        1⤵
                                                                                          PID:6120
                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                          1⤵
                                                                                            PID:1388
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                              PID:5636
                                                                                            • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                              1⤵
                                                                                                PID:4408
                                                                                              • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                                1⤵
                                                                                                  PID:5928
                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                  1⤵
                                                                                                    PID:5592
                                                                                                    • C:\Windows\System32\MsiExec.exe
                                                                                                      C:\Windows\System32\MsiExec.exe -Embedding E70DBE1279EAA8D781EE49D39BEE1104
                                                                                                      2⤵
                                                                                                        PID:6964
                                                                                                      • C:\Windows\System32\MsiExec.exe
                                                                                                        C:\Windows\System32\MsiExec.exe -Embedding A9477A18EB2FC4A126B9559C591F82A4 E Global\MSI0000
                                                                                                        2⤵
                                                                                                          PID:5420
                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 355FC402945B9BCCB1CEF201A33B2425 M Global\MSI0000
                                                                                                          2⤵
                                                                                                            PID:5716
                                                                                                        • C:\Windows\system32\LogonUI.exe
                                                                                                          "LogonUI.exe" /flags:0x0 /state0:0xa3aa0855 /state1:0x41c64e6d
                                                                                                          1⤵
                                                                                                            PID:5652
                                                                                                          • C:\Windows\system32\browser_broker.exe
                                                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:2780
                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:6908

                                                                                                              Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Reconnaissance

                                                                                                                    Resource Development

                                                                                                                    Initial Access

                                                                                                                    Execution

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Persistence

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Create or Modify System Process

                                                                                                                    2
                                                                                                                    T1543

                                                                                                                    Windows Service

                                                                                                                    2
                                                                                                                    T1543.003

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Privilege Escalation

                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                    1
                                                                                                                    T1548

                                                                                                                    Bypass User Account Control

                                                                                                                    1
                                                                                                                    T1548.002

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Create or Modify System Process

                                                                                                                    2
                                                                                                                    T1543

                                                                                                                    Windows Service

                                                                                                                    2
                                                                                                                    T1543.003

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Defense Evasion

                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                    1
                                                                                                                    T1548

                                                                                                                    Bypass User Account Control

                                                                                                                    1
                                                                                                                    T1548.002

                                                                                                                    Impair Defenses

                                                                                                                    2
                                                                                                                    T1562

                                                                                                                    Disable or Modify System Firewall

                                                                                                                    1
                                                                                                                    T1562.004

                                                                                                                    Disable or Modify Tools

                                                                                                                    1
                                                                                                                    T1562.001

                                                                                                                    Modify Registry

                                                                                                                    6
                                                                                                                    T1112

                                                                                                                    Subvert Trust Controls

                                                                                                                    1
                                                                                                                    T1553

                                                                                                                    Install Root Certificate

                                                                                                                    1
                                                                                                                    T1553.004

                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                    2
                                                                                                                    T1497

                                                                                                                    Credential Access

                                                                                                                    Unsecured Credentials

                                                                                                                    5
                                                                                                                    T1552

                                                                                                                    Credentials In Files

                                                                                                                    4
                                                                                                                    T1552.001

                                                                                                                    Credentials in Registry

                                                                                                                    1
                                                                                                                    T1552.002

                                                                                                                    Discovery

                                                                                                                    Peripheral Device Discovery

                                                                                                                    2
                                                                                                                    T1120

                                                                                                                    Query Registry

                                                                                                                    7
                                                                                                                    T1012

                                                                                                                    System Information Discovery

                                                                                                                    6
                                                                                                                    T1082

                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                    2
                                                                                                                    T1497

                                                                                                                    Lateral Movement

                                                                                                                    Collection

                                                                                                                    Data from Local System

                                                                                                                    5
                                                                                                                    T1005

                                                                                                                    Command and Control

                                                                                                                    Web Service

                                                                                                                    1
                                                                                                                    T1102

                                                                                                                    Exfiltration

                                                                                                                    Impact

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    e5ab6d1.rbs
                                                                                                                    • Path C:\Config.Msi\e5ab6d1.rbs
                                                                                                                    • Size 894KB
                                                                                                                    • SHA256 5889379252e9d158eec8a3dbd474a08c0ffe773fbbe8210cc08ef0aa2be5d285
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    edgecompatviewlist[1].xml
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8S7W85J5\edgecompatviewlist[1].xml
                                                                                                                    • Size 74KB
                                                                                                                    • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                    • Size 1KB
                                                                                                                    • SHA256 d74d3ede6b742be05ed911afd226ae8a88a50b941b4798973a20b4952475bb5d
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    suggestions[1].en-US
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\9M9T45F2\suggestions[1].en-US
                                                                                                                    • Size 17KB
                                                                                                                    • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    favicon[1].ico
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FTX15WX6\favicon[1].ico
                                                                                                                    • Size 5KB
                                                                                                                    • SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    4Kv5U5b1o3f[1].png
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XVE1R4VQ\4Kv5U5b1o3f[1].png
                                                                                                                    • Size 610B
                                                                                                                    • SHA256 2bc7a47889c56ad49f1b8b97385d5a4d212e79bb8a9b30df0665a165f58b273e
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                    • Size 1KB
                                                                                                                    • SHA256 64d459714f98144b7a04079efbd965519d8b0bd3ed0021832e3683e79bcd41c6
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                                                                                    • Size 724B
                                                                                                                    • SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                    • Size 410B
                                                                                                                    • SHA256 80335f8dee112ba4d089534fa5a84247138eaf0f464280f16fe2f39ab0590a27
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    A16C6C16D94F76E0808C087DFC657D99_C0E9A060DFB4E460CC3576DA89FF9A7C
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_C0E9A060DFB4E460CC3576DA89FF9A7C
                                                                                                                    • Size 406B
                                                                                                                    • SHA256 7d5f8c7645e66d3cfa372905623d18db1e3f9287872f7b5f5749917b3177524f
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                                                                                    • Size 392B
                                                                                                                    • SHA256 e5ad232273e61b12b97817198b625a2bbe1d59310ae118e8c4c2b736a08dc1e1
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    additional_file0.tmp
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042221361\additional_file0.tmp
                                                                                                                    • Size 2.5MB
                                                                                                                    • SHA256 fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    opera_package
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042221361\opera_package
                                                                                                                    • Size 103.9MB
                                                                                                                    • SHA256 473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    explorgu.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                                                                                                                    • Size 1.8MB
                                                                                                                    • SHA256 11da303928db319382c12f97a02cfbb9f3a4b029b4e823704e7aaeaf86916b08
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    ISetup8.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe
                                                                                                                    • Size 344KB
                                                                                                                    • SHA256 a6ce6890aa019d53389c89e591e61bbb7b2e8703a63e4f2ef7b178b3e630669e
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                    • Size 4.1MB
                                                                                                                    • SHA256 8a2289028089e0cc4b6f045b77367c591b39cba31aabed69834e046b6bee3432
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    toolspub1.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000184001\toolspub1.exe
                                                                                                                    • Size 173KB
                                                                                                                    • SHA256 7eb2e027926ce98818c8587d7af2fe2376febbdf84353e6963ec57640334ec13
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    alex1234.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                                                                                                                    • Size 1.7MB
                                                                                                                    • SHA256 3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    redlinepanel.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                                                                                                                    • Size 301KB
                                                                                                                    • SHA256 2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    32456.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                                                                                                                    • Size 499KB
                                                                                                                    • SHA256 09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    goldprimeldlldf.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                                                                                    • Size 464KB
                                                                                                                    • SHA256 afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    NewB.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                                                    • Size 418KB
                                                                                                                    • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    swiiiii.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                                                                                                                    • Size 321KB
                                                                                                                    • SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    koooooo.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
                                                                                                                    • Size 379KB
                                                                                                                    • SHA256 23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    go.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe
                                                                                                                    • Size 894KB
                                                                                                                    • SHA256 59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    random.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
                                                                                                                    • Size 3.0MB
                                                                                                                    • SHA256 11e9be55e0e1ea1867d5ab121aef3f2c8f6bd1b17989c67eb3a69ee331ca8f53
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    file300un.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
                                                                                                                    • Size 400KB
                                                                                                                    • SHA256 0a9df33580d2f032589301602ae78df0fd0daa276eb5308695e5978626996ff7
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    TmpAFC8.tmp
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\TmpAFC8.tmp
                                                                                                                    • Size 2KB
                                                                                                                    • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    __PSScriptPolicyTest_oq0s2v3m.ye4.ps1
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oq0s2v3m.ye4.ps1
                                                                                                                    • Size 1B
                                                                                                                    • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    clip64.dll
                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                                                                                    • Size 109KB
                                                                                                                    • SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    settings.dat
                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                                                                                    • Size 40B
                                                                                                                    • SHA256 d95e87ebd41adfd3bb640b168660ac9e677ec54c4c0a04bbc3536cc9910f50db
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    Traffic.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                                                                                    • Size 541KB
                                                                                                                    • SHA256 f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    propro.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                                                                                    • Size 304KB
                                                                                                                    • SHA256 bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    76MoqyoHvdb0cn8ZKhDt4x6Y.exe
                                                                                                                    • Path C:\Users\Admin\Pictures\76MoqyoHvdb0cn8ZKhDt4x6Y.exe
                                                                                                                    • Size 4.1MB
                                                                                                                    • SHA256 7e3d844edd6d0a788ab1c9f1ea88ca2cb04809ee21aa55f0c2265a927507b187
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    BF6MN5txh8ETuqbJ1iVqBHeJ.exe
                                                                                                                    • Path C:\Users\Admin\Pictures\BF6MN5txh8ETuqbJ1iVqBHeJ.exe
                                                                                                                    • Size 3KB
                                                                                                                    • SHA256 68caf6114736f1be3a492fb04243fbb7f523d37fd97edd076358c4c64b084ee3
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    F6Eoiswas4Sf6HuaPJSJgRUs.exe
                                                                                                                    • Path C:\Users\Admin\Pictures\F6Eoiswas4Sf6HuaPJSJgRUs.exe
                                                                                                                    • Size 7KB
                                                                                                                    • SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    R8uXlhKAor1uQeXsBCfcVdy0.exe
                                                                                                                    • Path C:\Users\Admin\Pictures\R8uXlhKAor1uQeXsBCfcVdy0.exe
                                                                                                                    • Size 344KB
                                                                                                                    • SHA256 b8d261c3ad8dc7079256bcb9236657b733950c2618472ec47fb54309f9df9faf
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    llhgE0R2YkRBtmgdrYnJBfW6.exe
                                                                                                                    • Path C:\Users\Admin\Pictures\llhgE0R2YkRBtmgdrYnJBfW6.exe
                                                                                                                    • Size 5.1MB
                                                                                                                    • SHA256 f18a4c0845599acab6d36f92f6462640bb6e6c0b4b6f47f02399173802169daa
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    zaQVsBJaYz0bxCmKuGOqsAFC.exe
                                                                                                                    • Path C:\Users\Admin\Pictures\zaQVsBJaYz0bxCmKuGOqsAFC.exe
                                                                                                                    • Size 3KB
                                                                                                                    • SHA256 13a48255fcb254427ad79340172914b3fced434c98e61598bcec7a6eb4d84b8b
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    Google Chrome.lnk
                                                                                                                    • Path C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                    • Size 2KB
                                                                                                                    • SHA256 394cd6851cb59170fbdd220d22c1e488188a5b3ef14afe3be64fbedea6fcd69b
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    MSI70.tmp
                                                                                                                    • Path C:\Windows\Installer\MSI70.tmp
                                                                                                                    • Size 195KB
                                                                                                                    • SHA256 cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    e5ab6d2.msi
                                                                                                                    • Path C:\Windows\Installer\e5ab6d2.msi
                                                                                                                    • Size 36.9MB
                                                                                                                    • SHA256 b4d4a1cdfc335c2df5e4f5a8830808ef329755cf01206e39724d29f5a99d4a2d
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    VBoxDrv.sys
                                                                                                                    • Path C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys
                                                                                                                    • Size 1013KB
                                                                                                                    • SHA256 05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    gpt.ini
                                                                                                                    • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                    • Size 127B
                                                                                                                    • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    Opera_installer_2404042221355935952.dll
                                                                                                                    • Path \Users\Admin\AppData\Local\Temp\Opera_installer_2404042221355935952.dll
                                                                                                                    • Size 4.6MB
                                                                                                                    • SHA256 668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    cred64.dll
                                                                                                                    • Path \Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                                                                                    • Size 1.2MB
                                                                                                                    • SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                    Submit Download

                                                                                                                    memory/984-53-0x0000000003170000-0x0000000005170000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/984-42-0x0000000000C60000-0x0000000000E1C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/984-43-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/984-52-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/984-148-0x0000000003170000-0x0000000005170000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/984-44-0x0000000005610000-0x0000000005620000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-3-0x00000000053A0000-0x00000000053A1000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-11-0x00000000053F0000-0x00000000053F1000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-7-0x0000000005370000-0x0000000005371000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-6-0x00000000053D0000-0x00000000053D1000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-1-0x0000000076F04000-0x0000000076F05000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-9-0x00000000053C0000-0x00000000053C1000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-8-0x0000000005380000-0x0000000005381000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-15-0x0000000000A30000-0x0000000000EE3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-2-0x0000000000A30000-0x0000000000EE3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-5-0x0000000005390000-0x0000000005391000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-4-0x00000000053B0000-0x00000000053B1000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1104-0-0x0000000000A30000-0x0000000000EE3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1560-399-0x000002031B000000-0x000002031B010000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1560-379-0x000002031A720000-0x000002031A730000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1560-418-0x000002031B880000-0x000002031B882000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1952-511-0x0000000000400000-0x0000000002F40000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2556-221-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2556-220-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2556-218-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2640-150-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2640-151-0x0000000004A60000-0x0000000004A70000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2640-145-0x0000000000230000-0x00000000002AA000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2640-157-0x0000000002430000-0x0000000004430000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2640-158-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3436-154-0x0000000000400000-0x0000000000450000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3436-159-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-103-0x0000000005AA0000-0x00000000060A6000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-160-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-78-0x0000000000220000-0x0000000000270000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-79-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-85-0x0000000004D00000-0x0000000004D10000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-108-0x0000000004D30000-0x0000000004D42000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-107-0x0000000004E20000-0x0000000004F2A000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-110-0x0000000004D90000-0x0000000004DCE000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3560-113-0x0000000004DD0000-0x0000000004E1B000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3636-518-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-372-0x0000000000900000-0x0000000000DB3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-26-0x0000000005290000-0x0000000005291000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-77-0x0000000000900000-0x0000000000DB3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-580-0x0000000000900000-0x0000000000DB3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-146-0x0000000000900000-0x0000000000DB3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-18-0x0000000000900000-0x0000000000DB3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-19-0x0000000000900000-0x0000000000DB3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-83-0x0000000000900000-0x0000000000DB3000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-21-0x0000000005280000-0x0000000005281000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-23-0x0000000005240000-0x0000000005241000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-28-0x00000000052B0000-0x00000000052B1000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-22-0x00000000052A0000-0x00000000052A1000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-25-0x0000000005250000-0x0000000005251000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-24-0x0000000005260000-0x0000000005261000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-20-0x0000000005270000-0x0000000005271000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3924-27-0x00000000052C0000-0x00000000052C1000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3960-231-0x0000000000400000-0x000000000044C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3960-235-0x0000000000400000-0x000000000044C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4324-618-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4324-614-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4448-109-0x000000001B8F0000-0x000000001B900000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4448-105-0x00007FFE2ED90000-0x00007FFE2F77C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4448-115-0x00007FFE2ED90000-0x00007FFE2F77C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4448-106-0x0000000000CB0000-0x0000000000D3C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4604-129-0x0000000000B90000-0x0000000000C12000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4604-130-0x00007FFE2ED90000-0x00007FFE2F77C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4604-131-0x000000001BB20000-0x000000001BB30000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4892-47-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4892-152-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4892-54-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-82-0x0000000005930000-0x0000000005940000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-111-0x0000000006A60000-0x0000000006A7E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-161-0x0000000005930000-0x0000000005940000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-80-0x0000000005B80000-0x000000000607E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-153-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-76-0x0000000072150000-0x000000007283E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-74-0x0000000000EA0000-0x0000000000EF2000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-84-0x0000000005800000-0x000000000580A000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-104-0x0000000006300000-0x0000000006376000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5052-81-0x0000000005760000-0x00000000057F2000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5092-268-0x0000000000400000-0x000000000044C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5092-265-0x0000000000400000-0x000000000044C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-455-0x0000000000900000-0x000000000109C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-448-0x0000000000900000-0x000000000109C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-446-0x0000000000900000-0x000000000109C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-445-0x0000000000900000-0x000000000109C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-449-0x0000000000900000-0x000000000109C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-450-0x0000000000900000-0x000000000109C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-453-0x0000000000900000-0x000000000109C000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-631-0x0000000000900000-0x000000000109C000-memory.dmp
                                                                                                                    Download