amadey | 10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed

Analysis

max time kernel
300s
max time network
306s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
26-09-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
Size

1.8MB
MD5

bd7abe8f2f298b19d4a91f3ac05d96ac
SHA1

0a2560343a2f6d28008e409ede3050faff272058
SHA256

10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed
SHA512

4a0fbecbd0098a81724fcb9e930b1256c0b218898c557883572f6c64954932c3479a0b384564ef72e027c425dc4eda0cdbd7abc857025795055d0c9d1c38c09a
SSDEEP

49152:wVXX1Qtyb/1DB8DXFu4zQghNPeE8melL:KZB87FuBgORmeN

Score

10^/10

amadey asyncrat nightingale stealc 9c9aa5 fed3aa save collection credential_access discovery evasion execution persistence rat stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

save

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Nightingale stealer
Nightingale stealer is an information stealer written in C#.
stealer nightingale
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 18 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5937db8fb2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5c7a38c17d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ad7d9639e4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1175197065.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	49994b2be4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 36 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ad7d9639e4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1175197065.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5937db8fb2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	49994b2be4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5c7a38c17d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ad7d9639e4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5c7a38c17d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1175197065.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5937db8fb2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	49994b2be4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe

Executes dropped EXE 21 IoCs

pid	Process
3160	axplong.exe
4724	ad7d9639e4.exe
4168	1175197065.exe
3740	skotes.exe
5116	neon.exe
2320	5937db8fb2.exe
5068	49994b2be4.exe
3464	127676b0fb.exe
1480	5c7a38c17d.exe
4944	axplong.exe
1280	skotes.exe
2320	neon.exe
3848	neon.exe
4492	skotes.exe
5100	axplong.exe
4984	skotes.exe
1376	axplong.exe
3164	skotes.exe
4448	axplong.exe
888	axplong.exe
4480	skotes.exe

Identifies Wine through registry keys 2 TTPs 18 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	ad7d9639e4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	5c7a38c17d.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	1175197065.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	5937db8fb2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	49994b2be4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Wine	axplong.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\ad7d9639e4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\ad7d9639e4.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\1175197065.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\1175197065.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\5937db8fb2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\5937db8fb2.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\49994b2be4.exe = "C:\\Users\\Admin\\1000026002\\49994b2be4.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\127676b0fb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000028001\\127676b0fb.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
416	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
60	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000800000001ab25-111.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
3280	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
3160	axplong.exe
4724	ad7d9639e4.exe
4168	1175197065.exe
3740	skotes.exe
2320	5937db8fb2.exe
5068	49994b2be4.exe
1480	5c7a38c17d.exe
4944	axplong.exe
1280	skotes.exe
4492	skotes.exe
5100	axplong.exe
4984	skotes.exe
1376	axplong.exe
3164	skotes.exe
4448	axplong.exe
888	axplong.exe
4480	skotes.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5116 set thread context of 4556	5116	neon.exe	96
PID 5116 set thread context of 5044	5116	neon.exe	104

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	1175197065.exe
File created	C:\Windows\Tasks\axplong.job	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1175197065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	127676b0fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad7d9639e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5937db8fb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49994b2be4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c7a38c17d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5000	cmd.exe
3840	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133718635692564549"	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3840	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3280	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
3280	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
3160	axplong.exe
3160	axplong.exe
4724	ad7d9639e4.exe
4724	ad7d9639e4.exe
4168	1175197065.exe
4168	1175197065.exe
3740	skotes.exe
3740	skotes.exe
5116	neon.exe
5116	neon.exe
2320	5937db8fb2.exe
2320	5937db8fb2.exe
5068	49994b2be4.exe
5068	49994b2be4.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
4412	chrome.exe
4412	chrome.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3464	127676b0fb.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	neon.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe
Token: SeCreatePagefilePrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	4412	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3280	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
4168	1175197065.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
3464	127676b0fb.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
3464	127676b0fb.exe
4412	chrome.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
3464	127676b0fb.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe
3464	127676b0fb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 3160	3280	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe	71
PID 3280 wrote to memory of 3160	3280	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe	71
PID 3280 wrote to memory of 3160	3280	10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe	71
PID 3160 wrote to memory of 4724	3160	axplong.exe	72
PID 3160 wrote to memory of 4724	3160	axplong.exe	72
PID 3160 wrote to memory of 4724	3160	axplong.exe	72
PID 3160 wrote to memory of 4168	3160	axplong.exe	73
PID 3160 wrote to memory of 4168	3160	axplong.exe	73
PID 3160 wrote to memory of 4168	3160	axplong.exe	73
PID 4168 wrote to memory of 3740	4168	1175197065.exe	74
PID 4168 wrote to memory of 3740	4168	1175197065.exe	74
PID 4168 wrote to memory of 3740	4168	1175197065.exe	74
PID 3160 wrote to memory of 5116	3160	axplong.exe	75
PID 3160 wrote to memory of 5116	3160	axplong.exe	75
PID 3740 wrote to memory of 2320	3740	skotes.exe	76
PID 3740 wrote to memory of 2320	3740	skotes.exe	76
PID 3740 wrote to memory of 2320	3740	skotes.exe	76
PID 3740 wrote to memory of 5068	3740	skotes.exe	77
PID 3740 wrote to memory of 5068	3740	skotes.exe	77
PID 3740 wrote to memory of 5068	3740	skotes.exe	77
PID 3740 wrote to memory of 3464	3740	skotes.exe	78
PID 3740 wrote to memory of 3464	3740	skotes.exe	78
PID 3740 wrote to memory of 3464	3740	skotes.exe	78
PID 3464 wrote to memory of 4412	3464	127676b0fb.exe	79
PID 3464 wrote to memory of 4412	3464	127676b0fb.exe	79
PID 4412 wrote to memory of 4824	4412	chrome.exe	81
PID 4412 wrote to memory of 4824	4412	chrome.exe	81
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83
PID 4412 wrote to memory of 2644	4412	chrome.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe
"C:\Users\Admin\AppData\Local\Temp\10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\1000354001\ad7d9639e4.exe
    "C:\Users\Admin\AppData\Local\Temp\1000354001\ad7d9639e4.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\1000355001\1175197065.exe
    "C:\Users\Admin\AppData\Local\Temp\1000355001\1175197065.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\1000023001\5937db8fb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000023001\5937db8fb2.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2320
    - - C:\Users\Admin\1000026002\49994b2be4.exe
        
        "C:\Users\Admin\1000026002\49994b2be4.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\1000028001\127676b0fb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000028001\127676b0fb.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3464
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff57ff9758,0x7fff57ff9768,0x7fff57ff9778
        7⤵
        
        PID:4824
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:2
        7⤵
        
        PID:2644
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:8
        7⤵
        
        PID:3596
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:8
        7⤵
        
        PID:2748
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:1
        7⤵
        
        PID:4560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3176 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:1
        7⤵
        
        PID:4556
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:1
        7⤵
        
        PID:1920
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:8
        7⤵
        
        PID:4188
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:8
        7⤵
        
        PID:3396
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:8
        7⤵
        
        PID:3228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 --field-trial-handle=1888,i,9554615031346437246,4426184365032916533,131072 /prefetch:8
        7⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\1000029001\5c7a38c17d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000029001\5c7a38c17d.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1480
- - C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
    "C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5000
    - - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3840
    - - C:\Windows\system32\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
        5⤵
        Adds Run key to start application
        
        PID:1264
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\neon.exe
      "C:\Users\Admin\AppData\Local\Temp\neon.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3848
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      outlook_office_path
      outlook_win_path
      PID:5044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        
        PID:3192

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4808

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4944

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1280

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4492

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5100

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2820

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1376

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4984

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4448

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3164

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:888

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1271bafa-eef0-47b2-bcac-741b5d3ad00f.tmp

Filesize
323KB

MD5
263a958a362759c6e8961ba96d8d8777

SHA1
78bde690e40df1dc794976fc86a5c43b7d6062b9

SHA256
a9d78193108e1531c6468d35e3f89ebcf4a2906c17bf629915758c435ed0be72

SHA512
8d95f3316a5bbcdb30c3799f7f3ca483de20c2213d137dc679a16b53ccbc914fcc588eb21f29ebdc4fd2b649dab803d8c1ab43351c0e81414246a8007d555937

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
0b48682375aa96f9e3a22cf14c405f96

SHA1
09a88281f7b1466dee3f2ab2b25d72e22a76627b

SHA256
2788e681422ea58ff7969df3dbb10eb1212b61dba77200ec0d5f1281c9f30771

SHA512
e0f96369ee8747388769049aeccaa65936e2360eea486320d78796fd8d382b03a7009e2af9f2a070a012b20a0e30b57d73d340433b838b3e660df5cf818982d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
1d1083a965567aa48021e982cec56145

SHA1
944391ad30689482316739dfa6c1d64cbabe4f0e

SHA256
ead7a1631b1427f7d17ac72ca347490df7123de13b16836ea8373e7dd646182c

SHA512
b47fb0cfaabf89199d19bf20df4c8d31c21f429a3de22b8ce9f2ef52b22b3970eef906759232ae0f4210e5996c151bd6602410cf95f43089cbca4e756209adc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
8ba3c6207ba26e0c7e83bb9b2e738fc9

SHA1
30eaf2e33d540e073746110dfd74f4d0e38b48d1

SHA256
e2f751e044b4cb72b47014a1dff908f39342d834034d4d76f00343b10a6470ef

SHA512
c9c875d4d4175df47749247b76352852eccfba1881d1c318f56e9c3ca475b800fde5c1d5d957bee7d8122c10275041e0e782f19a46ea9dbe773cf6d769d62c23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
8c67b5685e27ab618867be8b286418ea

SHA1
bea8aa22f594115547f6b7d9cb024a482e493f58

SHA256
33b47bd11acf51e994138a678b5856066c72255d3aaa54dffadd57b6f78e31a6

SHA512
c006a47f51636950f3ad92f47664d8552cf05af7db84fff6aba2949deb1f133ebd4636bdf577925a34e55bb2769f732338bd8a5cef2d2f4e4a950d186b6e3e39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b461e7bd480035072dd77bcd9a9aff4e

SHA1
173808a4594de1d6eb9c9c8ecc90c5d4055991bd

SHA256
9ce8e238dbb96ef219660b1d644e27f0076c38de3a393977c476d2f1be7f568a

SHA512
071e69c239710233adcbf1b373403f7503b82ead589cc2f0d0ee5decdc454446b89725cecce77f5d78ba62cb7b62be857b143e481369faca17db1fd5a797a597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3c4036da8a2e4ff5ce7b089b4be6ae40

SHA1
f80d94051880b0ec980619b7cb373cba67385b42

SHA256
0f053ce3b160e91f995be20131727750b1a33fd5a61bca2c2c1123bc25aebf37

SHA512
f3043e02e69796537ed6d86ac015d2c455561b3a8ecdc7fb376a34506c11481736b8b23e29e0f065a36f9927ed5ae7447441bf67873498616602b7afa86dbd9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1a8c1d5d5b207e933444c7100e559efd

SHA1
398a7db874ba5fc16bccf1aab60f1039ff73786c

SHA256
69e24983911284deecc54c72a193c48adefa3e88c45417a4d59f8e55a9650b97

SHA512
a2953f90496c073bd2301817285f7af21c3cf4fecf7b6c3bebd76fead02965bb515606d0b81f02ce4274f9cf70cb5d7c2940375ebf02ccae9b9af8800cfcacbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
323KB

MD5
b541837e367a03f692169055f192a7a7

SHA1
83acfeb7ff471f11855d94bedd76edf4558f6780

SHA256
240b69280379d45b798f11e44ef2ee61b1b82d8a8a9b3db5268dd3cb5a3613d0

SHA512
eac407c652100b1e8d0f871e37cb6c1ecf596fc9d8221fd6d3dc6ca0310bff988ca0cf47b8ee7d3662bd6e895c69941f116567af7200ce990770659af5994192

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
b43cb498b153e6f9b29338d89f51f4c1

SHA1
dcac5db99f9c1c1d661776725378bd124836e961

SHA256
cdd26f9a92c07624d8a704064e5a3cd4bf0a33dc95306b536f6bb67b5cae4786

SHA512
a2116bc64f82eab638c432796b5d461c338321bd6fee8d7f1e831d71aa0aa2bf7f2f76262981abcc1d033bb559687e89fd576c360420919fc120104d10dc010e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
341KB

MD5
ec32edc93d27396affd67ea9b857480d

SHA1
2f2a5d0d0f02ef3869088b42684d8d928d490b74

SHA256
e41dfb1348e611843488a4a8f3b939bce7af4652ffa5fc6b6ad0641f2478d3e4

SHA512
95b073001b1178f8f7c67cde0b31467e8339cbe31c836a162dd1e786da24928cecc1340b20dffa9b133b7628dcffe836193c28b72b33ecd47da730cabfb0cfc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
5d574dc518025fad52b7886c1bff0e13

SHA1
68217a5f9e9a64ca8fed9eefa4171786a8f9f8f7

SHA256
755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2

SHA512
21de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\neon.exe.log

Filesize
1KB

MD5
e555c48cb712a9597ecb55a60135d1f8

SHA1
2081c72d30c34ec3f61f9944545ecdaae11521f7

SHA256
815c80df060afa8acf7640ca011735ef77c66666d03901e04a8767827d5da4e9

SHA512
32129b5be15217e5400f1e7536270a703d62db60ebb06396b9d74703e6a0dcd2e78f7f42b2019093be1508a9310912f305b88de274a295c9135a4086cd8c8427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b0c9db00a53a4682b20faf5c07394899

SHA1
41292985bf22d0c303da4db2263f31c5a39daf63

SHA256
46eee6076ec6aa62af17417697508f4a67289ccff02b739a4efd256091252233

SHA512
a70cf7c71773483651994f5ede898d6874cc33cd87e36e0584576d893244566afc985e470cbd299304ed9347910eeb93b7aa019885a31acdff39492550838e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000028001\127676b0fb.exe

Filesize
1.1MB

MD5
109677787158bb7913c84844415c51ce

SHA1
e2ddb6c884e456b2e8bb131ad2525abba41b281c

SHA256
750de76e0ec8b879244cb40d97df55fdaa0f582393f539a8d5fe2169406c936b

SHA512
59453526479ee8283218dbf1d796122572cd6d0712e8c2a892e9e243a8b5218c3b8e6f13d06d8fba9ddaaf083d100f872ede618eb88bc5f71b4bee6c556df12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000029001\5c7a38c17d.exe

Filesize
1.8MB

MD5
d47f5061136cbb1fc4d56bc8e0355c12

SHA1
3829e4804c1e0dcd77dc82cad9490bfaa3258887

SHA256
b3cae12b1399883b64871dfb422899f804fb2ae2fcfe073fe783165295b4886d

SHA512
ba14be86e71ce577c5e6106208ffb9a58e509ee8a67e94aa6646a93d5bf2691431ba886d28a8de7711005bb144face91a52b2936a749a5de6d539c64655504bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000354001\ad7d9639e4.exe

Filesize
1.8MB

MD5
87e8169e650f30493ca9a395620cce1d

SHA1
153a1ec34d2edd3e102f5618e4807be158a0d60d

SHA256
74f284fa73cadda54e2b0d90d4f612f725cfff6c20ee5e9560c02d8de8936d3c

SHA512
251b6580c776427e6113c62decf83e6ac4984161916aeb6ee88b81afe37f1ea766a8daa52fcb735d952fa81adf1e12098d8486051e837a39f74d54de904e8695

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000355001\1175197065.exe

Filesize
1.8MB

MD5
b369d7b9b209d6a20687967cc218715a

SHA1
e6fc8803983c53288d261ab8933aa07684cfcfbd

SHA256
5ca1fbe6ea1f6278e17206f28d6e910a1064c072be039eeed3dcd54883f4bca9

SHA512
ec7c6982bf5bbfaf2fb2de353a677b3d1b2bcbffed5e0ff8fa112d3c3ba869258242de43fa55b703be76f9d7834d41c76e51dfdd0d6fa501c46c5160b5781518

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

Filesize
3.5MB

MD5
b3fd0e1003b1cd38402b6d32829f6135

SHA1
c9cedd6322fb83457f56b64b4624b07e2786f702

SHA256
e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31

SHA512
04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
bd7abe8f2f298b19d4a91f3ac05d96ac

SHA1
0a2560343a2f6d28008e409ede3050faff272058

SHA256
10c63c1b8a6a9f6123bde8331732946a9ecf54378fa6ffee0a4fd5f0a00d2bed

SHA512
4a0fbecbd0098a81724fcb9e930b1256c0b218898c557883572f6c64954932c3479a0b384564ef72e027c425dc4eda0cdbd7abc857025795055d0c9d1c38c09a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jjvdbhzz.xfc.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.exe

Filesize
76KB

MD5
0e362e7005823d0bec3719b902ed6d62

SHA1
590d860b909804349e0cdc2f1662b37bd62f7463

SHA256
2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

SHA512
518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.txt

Filesize
64B

MD5
e48df9ab5855d87a6293f08796b658f6

SHA1
25bd5d79cf38da970d8ffe60aa954e33c7dc2c68

SHA256
2a9792a5c034ccbc3033fe1f6634e1948f2f156a6e78713740f94a0aab192ffa

SHA512
d43fa78b0722d0e16819a9782136de8d9496d140d9c56498bdaa0c369d67ff8160f0f9acb2881b8f0d379a1c84eaf140c372b75293d1749483184fd485a077ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.txt

Filesize
67B

MD5
9e6fe11a0008cedfc866bea7a55fc413

SHA1
9da8bcdf9d2befd29c866f8cda7f03e2380e771b

SHA256
ffca11ac34f27b6aa63a98e2f3ac0c88e58529d0804091a5ca472f3331c638d8

SHA512
8cde5bf0a3ddca4f95dc4966cc2cedef2f7baf11d4286d1a04533120b8c287abe2c76effc07fa317543979c1b8a2389bda130ff510592e688e558f05380330f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.txt

Filesize
67B

MD5
7c6ad6501f4b102b8b7f4d026773299e

SHA1
ff4a75588a261236f954c0e1d62ed7cdb5093bb0

SHA256
547ee9f92dcef3fc84b72889d3294b2bda715c0f8d40b5aed9969e7e638c4ff3

SHA512
58e43c11d07a235e3207fb77f5ba0fce9f667cd458061cf5b38f600bb5aa6fcfaa4a9fdfb99fb65f98f375672ed384e9139ae061ee05f9e00820f778366fd548

Download Submit
memory/416-901-0x0000018E5CA30000-0x0000018E5CA52000-memory.dmp

Filesize
136KB

Download
memory/888-1870-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/888-1866-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/1280-306-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/1280-336-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/1376-1202-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/1376-1141-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/1480-214-0x0000000000FC0000-0x0000000001469000-memory.dmp

Filesize
4.7MB

Download
memory/1480-196-0x0000000000FC0000-0x0000000001469000-memory.dmp

Filesize
4.7MB

Download
memory/2320-91-0x00000000002D0000-0x000000000096A000-memory.dmp

Filesize
6.6MB

Download
memory/2320-89-0x00000000002D0000-0x000000000096A000-memory.dmp

Filesize
6.6MB

Download
memory/2320-536-0x0000000005810000-0x00000000058AC000-memory.dmp

Filesize
624KB

Download
memory/2320-535-0x0000000000E50000-0x0000000000E6A000-memory.dmp

Filesize
104KB

Download
memory/3160-49-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-19-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-227-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-14-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-57-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-76-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-16-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-116-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-20-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-17-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3160-18-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/3164-1504-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/3164-1508-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/3280-0-0x00000000012D0000-0x0000000001780000-memory.dmp

Filesize
4.7MB

Download
memory/3280-15-0x00000000012D0000-0x0000000001780000-memory.dmp

Filesize
4.7MB

Download
memory/3280-5-0x00000000012D0000-0x0000000001780000-memory.dmp

Filesize
4.7MB

Download
memory/3280-3-0x00000000012D0000-0x0000000001780000-memory.dmp

Filesize
4.7MB

Download
memory/3280-2-0x00000000012D1000-0x00000000012FF000-memory.dmp

Filesize
184KB

Download
memory/3280-1-0x0000000077344000-0x0000000077345000-memory.dmp

Filesize
4KB

Download
memory/3740-60-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/3740-106-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/3740-105-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/3740-221-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/4168-59-0x0000000001300000-0x00000000017A8000-memory.dmp

Filesize
4.7MB

Download
memory/4168-47-0x0000000001300000-0x00000000017A8000-memory.dmp

Filesize
4.7MB

Download
memory/4448-1509-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/4448-1505-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/4480-1871-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/4480-1867-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/4492-700-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/4492-760-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/4724-34-0x0000000000D40000-0x00000000013DA000-memory.dmp

Filesize
6.6MB

Download
memory/4724-33-0x0000000000D40000-0x00000000013DA000-memory.dmp

Filesize
6.6MB

Download
memory/4944-305-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/4944-358-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/4984-1140-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/4984-1200-0x00000000009A0000-0x0000000000E48000-memory.dmp

Filesize
4.7MB

Download
memory/5044-836-0x000001CE6A8B0000-0x000001CE6A926000-memory.dmp

Filesize
472KB

Download
memory/5044-838-0x000001CE6A880000-0x000001CE6A89E000-memory.dmp

Filesize
120KB

Download
memory/5044-837-0x000001CE6A820000-0x000001CE6A860000-memory.dmp

Filesize
256KB

Download
memory/5044-831-0x0000000040000000-0x0000000040030000-memory.dmp

Filesize
192KB

Download
memory/5044-832-0x000001CE68370000-0x000001CE6839C000-memory.dmp

Filesize
176KB

Download
memory/5068-104-0x00000000013B0000-0x0000000001A4A000-memory.dmp

Filesize
6.6MB

Download
memory/5068-103-0x00000000013B0000-0x0000000001A4A000-memory.dmp

Filesize
6.6MB

Download
memory/5100-762-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/5100-701-0x0000000000EE0000-0x0000000001390000-memory.dmp

Filesize
4.7MB

Download
memory/5116-126-0x0000000001B70000-0x0000000001C11000-memory.dmp

Filesize
644KB

Download
memory/5116-122-0x0000000000B30000-0x0000000000B93000-memory.dmp

Filesize
396KB

Download
memory/5116-129-0x0000000002120000-0x0000000002245000-memory.dmp

Filesize
1.1MB

Download
memory/5116-123-0x00000000015B0000-0x000000000165E000-memory.dmp

Filesize
696KB

Download
memory/5116-124-0x00000000017D0000-0x0000000001A19000-memory.dmp

Filesize
2.3MB

Download
memory/5116-125-0x0000000001AF0000-0x0000000001B6E000-memory.dmp

Filesize
504KB

Download
memory/5116-298-0x00000000257D0000-0x00000000257EA000-memory.dmp

Filesize
104KB

Download
memory/5116-299-0x00000000255C0000-0x00000000255C6000-memory.dmp

Filesize
24KB

Download
memory/5116-127-0x0000000001C20000-0x0000000001CBD000-memory.dmp

Filesize
628KB

Download
memory/5116-130-0x00000000022C0000-0x000000000235C000-memory.dmp

Filesize
624KB

Download
memory/5116-131-0x0000000002760000-0x00000000027B1000-memory.dmp

Filesize
324KB

Download
memory/5116-132-0x00000000027C0000-0x0000000002AB9000-memory.dmp

Filesize
3.0MB

Download
memory/5116-135-0x0000000002C10000-0x0000000002D06000-memory.dmp

Filesize
984KB

Download
memory/5116-137-0x0000000002D80000-0x0000000002F09000-memory.dmp

Filesize
1.5MB

Download
memory/5116-139-0x0000000002F10000-0x0000000002FAA000-memory.dmp

Filesize
616KB

Download
memory/5116-140-0x00000000031C0000-0x00000000031ED000-memory.dmp

Filesize
180KB

Download
memory/5116-133-0x0000000000E00000-0x0000000000E27000-memory.dmp

Filesize
156KB

Download
memory/5116-134-0x0000000002AC0000-0x0000000002C0A000-memory.dmp

Filesize
1.3MB

Download
memory/5116-144-0x00000000051D0000-0x00000000052C7000-memory.dmp

Filesize
988KB

Download
memory/5116-145-0x000000001FA40000-0x000000001FB83000-memory.dmp

Filesize
1.3MB

Download
memory/5116-143-0x0000000004780000-0x000000000516C000-memory.dmp

Filesize
9.9MB

Download
memory/5116-149-0x0000000022880000-0x00000000228C9000-memory.dmp

Filesize
292KB

Download
memory/5116-150-0x00000000228D0000-0x000000002297A000-memory.dmp

Filesize
680KB

Download
memory/5116-152-0x00000000244E0000-0x000000002452C000-memory.dmp

Filesize
304KB

Download
memory/5116-153-0x00000000055A0000-0x00000000055B5000-memory.dmp

Filesize
84KB

Download
memory/5116-154-0x0000000024530000-0x0000000024555000-memory.dmp

Filesize
148KB

Download
memory/5116-155-0x00000000055C0000-0x00000000055D7000-memory.dmp

Filesize
92KB

Download
memory/5116-156-0x00000000245F0000-0x0000000024624000-memory.dmp

Filesize
208KB

Download
memory/5116-157-0x0000000024630000-0x000000002463B000-memory.dmp

Filesize
44KB

Download
memory/5116-163-0x0000000025500000-0x000000002552A000-memory.dmp

Filesize
168KB

Download
memory/5116-151-0x0000000023DE0000-0x00000000244D2000-memory.dmp

Filesize
6.9MB

Download
memory/5116-159-0x0000000024660000-0x0000000024829000-memory.dmp

Filesize
1.8MB

Download
memory/5116-160-0x0000000024830000-0x0000000024886000-memory.dmp

Filesize
344KB

Download
memory/5116-162-0x0000000025340000-0x00000000253E6000-memory.dmp

Filesize
664KB

Download
memory/5116-164-0x00000000255E0000-0x0000000025775000-memory.dmp

Filesize
1.6MB

Download
memory/5116-166-0x0000000025DA0000-0x0000000025E5F000-memory.dmp

Filesize
764KB

Download
memory/5116-167-0x0000000025E60000-0x0000000026120000-memory.dmp

Filesize
2.8MB

Download
memory/5116-168-0x00000000255A0000-0x00000000255A8000-memory.dmp

Filesize
32KB

Download
memory/5116-169-0x0000000026E90000-0x000000002703C000-memory.dmp

Filesize
1.7MB

Download
memory/5116-148-0x00000000229A0000-0x0000000023DD7000-memory.dmp

Filesize
20.2MB

Download
memory/5116-165-0x0000000025C30000-0x0000000025D96000-memory.dmp

Filesize
1.4MB

Download
memory/5116-161-0x0000000024890000-0x00000000248A1000-memory.dmp

Filesize
68KB

Download
memory/5116-158-0x0000000024640000-0x0000000024654000-memory.dmp

Filesize
80KB

Download
memory/5116-147-0x000000001FCC0000-0x000000001FDEC000-memory.dmp

Filesize
1.2MB

Download
memory/5116-146-0x000000001FB90000-0x000000001FC25000-memory.dmp

Filesize
596KB

Download
memory/5116-136-0x0000000002D10000-0x0000000002D7A000-memory.dmp

Filesize
424KB

Download
memory/5116-138-0x00000000016A0000-0x00000000016BE000-memory.dmp

Filesize
120KB

Download
memory/5116-142-0x00000000016C0000-0x00000000016CA000-memory.dmp

Filesize
40KB

Download
memory/5116-141-0x0000000002290000-0x00000000022A1000-memory.dmp

Filesize
68KB

Download
memory/5116-128-0x00000000020C0000-0x0000000002119000-memory.dmp

Filesize
356KB

Download
memory/5116-75-0x00000000248B0000-0x000000002494E000-memory.dmp

Filesize
632KB

Download
memory/5116-74-0x0000000000E30000-0x00000000011AC000-memory.dmp

Filesize
3.5MB

Download