amadey | c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Size

1.9MB
MD5

b8fc8a5801e3c0172a199430c7dba1d6
SHA1

2a53f4961410bea07de2259fd7875b30ae6a7856
SHA256

c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5
SHA512

b6a2e23babec64712408dbf0e1a9ce5720a4aff14c6de3e90a756c00ec97d01f394a18608de1cb2a90f87ce6c6fa8b4829ca57f77b8c110462b65af10e9ba3ec
SSDEEP

49152:Pfxsg8rRSzxCa2w6G/fSrvYMSdkhNebdu:HxaVo0w6oKbYXdkhuc

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

136.244.88.135:17615

Extracted

Family

redline

Botnet

@OLEH_PSP

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29862

Extracted

Family

stealc

Botnet

default

http://91.202.233.158

Attributes

url_path
/e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

newbundle2

185.215.113.67:15206

Extracted

Family

xworm

Version

5.0

188.190.10.161:4444

Mutex

TSXTkO0pNBdN2KNw

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

stealc

Botnet

save

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

47.238.55.14:4449

Mutex

rqwcncaesrdtlckoweu

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

lumma

https://defenddsouneuw.shop/api

https://reinforcenh.shop/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3272-1543-0x0000000000400000-0x000000000042E000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral2/memory/1216-42-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral2/files/0x0007000000023495-76.dat	family_redline
behavioral2/memory/1504-84-0x00000000009A0000-0x00000000009F2000-memory.dmp	family_redline
behavioral2/memory/4608-282-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral2/files/0x00070000000234ca-336.dat	family_redline
behavioral2/memory/2796-350-0x00000000002C0000-0x0000000000312000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/7976-2917-0x00000000076C0000-0x00000000077E2000-memory.dmp	family_stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 3892 created 3484	3892	rstxdhuj.exe	56
PID 5684 created 3484	5684	Waters.pif	56
PID 5684 created 3484	5684	Waters.pif	56
PID 7408 created 3484	7408	Thermal.pif	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	be7da0c89b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fb4c9a74e3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e731f96cac.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6c6b9fe6e7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	53bb5484ab.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe
6260	powershell.exe
5960	powershell.exe
5920	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e731f96cac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e731f96cac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	be7da0c89b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	53bb5484ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	53bb5484ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6c6b9fe6e7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6c6b9fe6e7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fb4c9a74e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	be7da0c89b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fb4c9a74e3.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	fb4c9a74e3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	splwow64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	PkContent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	processclass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	context.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	12dsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Waters.pif
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Nework.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Hkbsse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	skotes.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe

Executes dropped EXE 39 IoCs

pid	Process
212	axplong.exe
3712	gold.exe
4492	12dsvc.exe
2760	EzLcuMxgF5.exe
1504	jHuFRYRN7w.exe
3700	Nework.exe
4012	Hkbsse.exe
4028	stealc_default2.exe
4408	needmoney.exe
1412	penis.exe
3156	crypted.exe
5052	LummaC222222.exe
856	svchost015.exe
2796	newbundle2.exe
3892	rstxdhuj.exe
6120	e731f96cac.exe
6096	javumar2.exe
388	javumar2.tmp
5184	javtestnoreport.exe
5832	fb4c9a74e3.exe
2236	lummetc.exe
5392	skotes.exe
1708	processclass.exe
2032	splwow64.exe
5764	be7da0c89b.exe
920	PkContent.exe
6068	skotes.exe
4848	Hkbsse.exe
5420	axplong.exe
5172	6c6b9fe6e7.exe
7068	53bb5484ab.exe
6416	context.exe
5684	Waters.pif
7408	Thermal.pif
7592	Waters.pif
7976	RegAsm.exe
6880	Hkbsse.exe
1600	skotes.exe
6560	axplong.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	6c6b9fe6e7.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	e731f96cac.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	fb4c9a74e3.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	be7da0c89b.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	53bb5484ab.exe

Loads dropped DLL 4 IoCs

pid	Process
4028	stealc_default2.exe
4028	stealc_default2.exe
388	javumar2.tmp
388	javumar2.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe"	rstxdhuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e731f96cac.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\e731f96cac.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fb4c9a74e3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\fb4c9a74e3.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\be7da0c89b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\be7da0c89b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6c6b9fe6e7.exe = "C:\\Users\\Admin\\1000026002\\6c6b9fe6e7.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
6492	tasklist.exe
7392	tasklist.exe
7572	tasklist.exe
6344	tasklist.exe
2956	tasklist.exe
7000	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
212	axplong.exe
6120	e731f96cac.exe
5832	fb4c9a74e3.exe
5392	skotes.exe
5764	be7da0c89b.exe
6068	skotes.exe
5420	axplong.exe
5172	6c6b9fe6e7.exe
7068	53bb5484ab.exe
1600	skotes.exe
6560	axplong.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3712 set thread context of 1216	3712	gold.exe	85
PID 3156 set thread context of 4608	3156	crypted.exe	104
PID 4408 set thread context of 856	4408	needmoney.exe	109
PID 3892 set thread context of 3272	3892	rstxdhuj.exe	117

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	fb4c9a74e3.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64.exe
File opened for modification	C:\Windows\PgJune	PkContent.exe
File opened for modification	C:\Windows\IpaqArthur	context.exe
File created	C:\Windows\Tasks\axplong.job	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
File opened for modification	C:\Windows\ReceptorsTeeth	PkContent.exe
File opened for modification	C:\Windows\FirewireBros	PkContent.exe
File opened for modification	C:\Windows\BrandonBlind	context.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64.exe
File opened for modification	C:\Windows\PorcelainExhaust	PkContent.exe
File opened for modification	C:\Windows\ViewpictureKingdom	context.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64.exe
File opened for modification	C:\Windows\MonsterRaymond	PkContent.exe
File opened for modification	C:\Windows\PortugalCharges	PkContent.exe
File opened for modification	C:\Windows\HardlyAircraft	context.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4316	5052	WerFault.exe	107
5268	2236	WerFault.exe	125
7800	7976	WerFault.exe	244

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12dsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javumar2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb4c9a74e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lummetc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c6b9fe6e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javumar2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	penis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rstxdhuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53bb5484ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e731f96cac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC222222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PkContent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thermal.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be7da0c89b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5220	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5972	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133719617497208575"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7544	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3272	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
212	axplong.exe
212	axplong.exe
4028	stealc_default2.exe
4028	stealc_default2.exe
2760	EzLcuMxgF5.exe
1504	jHuFRYRN7w.exe
1504	jHuFRYRN7w.exe
1504	jHuFRYRN7w.exe
1504	jHuFRYRN7w.exe
1504	jHuFRYRN7w.exe
1216	RegAsm.exe
1216	RegAsm.exe
1216	RegAsm.exe
1216	RegAsm.exe
1216	RegAsm.exe
1216	RegAsm.exe
1412	penis.exe
1412	penis.exe
4028	stealc_default2.exe
4028	stealc_default2.exe
3892	rstxdhuj.exe
3892	rstxdhuj.exe
6120	e731f96cac.exe
6120	e731f96cac.exe
5184	javtestnoreport.exe
5184	javtestnoreport.exe
4608	RegAsm.exe
4608	RegAsm.exe
4608	RegAsm.exe
4608	RegAsm.exe
2796	newbundle2.exe
2796	newbundle2.exe
2796	newbundle2.exe
2796	newbundle2.exe
5832	fb4c9a74e3.exe
5832	fb4c9a74e3.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
2796	newbundle2.exe
2796	newbundle2.exe
5392	skotes.exe
5392	skotes.exe
4608	RegAsm.exe
4608	RegAsm.exe
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
3060	msedge.exe
3060	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
5764	be7da0c89b.exe
5764	be7da0c89b.exe
6068	skotes.exe
6068	skotes.exe
5420	axplong.exe
5420	axplong.exe
3272	InstallUtil.exe
3272	InstallUtil.exe
5172	6c6b9fe6e7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
4140	msedge.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	EzLcuMxgF5.exe
Token: SeBackupPrivilege	2760	EzLcuMxgF5.exe
Token: SeSecurityPrivilege	2760	EzLcuMxgF5.exe
Token: SeSecurityPrivilege	2760	EzLcuMxgF5.exe
Token: SeSecurityPrivilege	2760	EzLcuMxgF5.exe
Token: SeSecurityPrivilege	2760	EzLcuMxgF5.exe
Token: SeDebugPrivilege	1504	jHuFRYRN7w.exe
Token: SeDebugPrivilege	1412	penis.exe
Token: SeBackupPrivilege	1412	penis.exe
Token: SeSecurityPrivilege	1412	penis.exe
Token: SeSecurityPrivilege	1412	penis.exe
Token: SeSecurityPrivilege	1412	penis.exe
Token: SeSecurityPrivilege	1412	penis.exe
Token: SeDebugPrivilege	1216	RegAsm.exe
Token: SeDebugPrivilege	3892	rstxdhuj.exe
Token: SeDebugPrivilege	3892	rstxdhuj.exe
Token: SeDebugPrivilege	3272	InstallUtil.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeDebugPrivilege	2796	newbundle2.exe
Token: SeDebugPrivilege	4608	RegAsm.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	3272	InstallUtil.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	6260	powershell.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeDebugPrivilege	1708	processclass.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeDebugPrivilege	6344	tasklist.exe
Token: SeDebugPrivilege	2956	tasklist.exe
Token: SeDebugPrivilege	7000	tasklist.exe
Token: SeDebugPrivilege	6492	tasklist.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeDebugPrivilege	7392	tasklist.exe
Token: SeDebugPrivilege	7572	tasklist.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
5832	fb4c9a74e3.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6972	chrmstp.exe
5684	Waters.pif
5684	Waters.pif
5684	Waters.pif
7408	Thermal.pif
7408	Thermal.pif
7408	Thermal.pif
7592	Waters.pif
7592	Waters.pif
7592	Waters.pif

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
5684	Waters.pif
5684	Waters.pif
5684	Waters.pif
7408	Thermal.pif
7408	Thermal.pif
7408	Thermal.pif
7592	Waters.pif
7592	Waters.pif
7592	Waters.pif

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3272	InstallUtil.exe
7976	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 212	2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe	82
PID 2928 wrote to memory of 212	2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe	82
PID 2928 wrote to memory of 212	2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe	82
PID 212 wrote to memory of 3712	212	axplong.exe	83
PID 212 wrote to memory of 3712	212	axplong.exe	83
PID 212 wrote to memory of 3712	212	axplong.exe	83
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 212 wrote to memory of 4492	212	axplong.exe	86
PID 212 wrote to memory of 4492	212	axplong.exe	86
PID 212 wrote to memory of 4492	212	axplong.exe	86
PID 4492 wrote to memory of 2760	4492	12dsvc.exe	87
PID 4492 wrote to memory of 2760	4492	12dsvc.exe	87
PID 4492 wrote to memory of 2760	4492	12dsvc.exe	87
PID 4492 wrote to memory of 1504	4492	12dsvc.exe	89
PID 4492 wrote to memory of 1504	4492	12dsvc.exe	89
PID 4492 wrote to memory of 1504	4492	12dsvc.exe	89
PID 212 wrote to memory of 3700	212	axplong.exe	90
PID 212 wrote to memory of 3700	212	axplong.exe	90
PID 212 wrote to memory of 3700	212	axplong.exe	90
PID 3700 wrote to memory of 4012	3700	Nework.exe	92
PID 3700 wrote to memory of 4012	3700	Nework.exe	92
PID 3700 wrote to memory of 4012	3700	Nework.exe	92
PID 212 wrote to memory of 4028	212	axplong.exe	93
PID 212 wrote to memory of 4028	212	axplong.exe	93
PID 212 wrote to memory of 4028	212	axplong.exe	93
PID 212 wrote to memory of 4408	212	axplong.exe	98
PID 212 wrote to memory of 4408	212	axplong.exe	98
PID 212 wrote to memory of 4408	212	axplong.exe	98
PID 212 wrote to memory of 1412	212	axplong.exe	100
PID 212 wrote to memory of 1412	212	axplong.exe	100
PID 212 wrote to memory of 1412	212	axplong.exe	100
PID 212 wrote to memory of 3156	212	axplong.exe	102
PID 212 wrote to memory of 3156	212	axplong.exe	102
PID 212 wrote to memory of 3156	212	axplong.exe	102
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 212 wrote to memory of 5052	212	axplong.exe	107
PID 212 wrote to memory of 5052	212	axplong.exe	107
PID 212 wrote to memory of 5052	212	axplong.exe	107
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 212 wrote to memory of 2796	212	axplong.exe	110
PID 212 wrote to memory of 2796	212	axplong.exe	110
PID 212 wrote to memory of 2796	212	axplong.exe	110
PID 212 wrote to memory of 3892	212	axplong.exe	113

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484
- C:\Users\Admin\AppData\Local\Temp\c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
  "C:\Users\Admin\AppData\Local\Temp\c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
      "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Users\Admin\AppData\Roaming\EzLcuMxgF5.exe
        
        "C:\Users\Admin\AppData\Roaming\EzLcuMxgF5.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Users\Admin\AppData\Roaming\jHuFRYRN7w.exe
        
        "C:\Users\Admin\AppData\Roaming\jHuFRYRN7w.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\is-IEKS9.tmp\javumar2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IEKS9.tmp\javumar2.tmp" /SL5="$80290,12434628,845824,C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
      "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:856
  - - C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
      "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
      "C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1256
        5⤵
        Program crash
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yoodrabodoln.beget.app/Px5rcr?&se_referrer=&default_keyword=&
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7c7746f8,0x7ffd7c774708,0x7ffd7c774718
        6⤵
        
        PID:5516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:5936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
        6⤵
        
        PID:1292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
        6⤵
        
        PID:3548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3436 /prefetch:8
        6⤵
        
        PID:4812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
        6⤵
        
        PID:6052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
        6⤵
        
        PID:1216
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        6⤵
        
        PID:5784
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        6⤵
        
        PID:3276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
        6⤵
        
        PID:5332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        6⤵
        
        PID:3568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
        6⤵
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
      "C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\1000354001\e731f96cac.exe
      "C:\Users\Admin\AppData\Local\Temp\1000354001\e731f96cac.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\1000355001\fb4c9a74e3.exe
      "C:\Users\Admin\AppData\Local\Temp\1000355001\fb4c9a74e3.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\1000023001\be7da0c89b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000023001\be7da0c89b.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5764
      - C:\Users\Admin\1000026002\6c6b9fe6e7.exe
        
        "C:\Users\Admin\1000026002\6c6b9fe6e7.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5172
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000032042\ko.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:6116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd795fcc40,0x7ffd795fcc4c,0x7ffd795fcc58
        8⤵
        
        PID:6136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1648,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:2
        8⤵
        
        PID:4328
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=1884,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
        8⤵
        
        PID:4408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=2200,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
        8⤵
        
        PID:5180
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
        8⤵
        
        PID:6120
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
        8⤵
        
        PID:2000
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3344,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        8⤵
        
        PID:5024
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4440,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:2
        8⤵
        
        PID:3052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4640,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:2
        8⤵
        
        PID:5668
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4880,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
        8⤵
        
        PID:6320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3964,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
        8⤵
        
        PID:6668
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4444,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
        8⤵
        
        PID:6676
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5452,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
        8⤵
        
        PID:6788
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4940,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
        8⤵
        
        PID:7116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4984,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
        8⤵
        
        PID:5512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5012,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
        8⤵
        
        PID:5300
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3968,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
        8⤵
        
        PID:6476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=6064,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
        8⤵
        
        PID:6528
        
        C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        8⤵
        Drops file in Program Files directory
        
        PID:6556
        
        C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff61b214698,0x7ff61b2146a4,0x7ff61b2146b0
        9⤵
        Drops file in Program Files directory
        
        PID:6656
        
        C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        9⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:6972
        
        C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff61b214698,0x7ff61b2146a4,0x7ff61b2146b0
        10⤵
        Drops file in Program Files directory
        
        PID:6988
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6204,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
        8⤵
        
        PID:6560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5972,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
        8⤵
        
        PID:6548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6304,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
        8⤵
        
        PID:6400
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6700,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
        8⤵
        
        PID:6212
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3224,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
        8⤵
        
        PID:4360
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=5556,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
        8⤵
        
        PID:6452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=6828,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
        8⤵
        
        PID:6512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=3292,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:2
        8⤵
        
        PID:3936
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000033142\so.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:6260
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
        7⤵
        
        PID:6592
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0x100,0xdc,0x7ffd795fcc40,0x7ffd795fcc4c,0x7ffd795fcc58
        8⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\1000034001\53bb5484ab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000034001\53bb5484ab.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
      "C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1280
        5⤵
        Program crash
        
        PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
      "C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1708
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start context.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7392
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7572
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7592
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7000
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MaskBathroomCompositionInjection" Participants
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "Waters.pif"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:5972
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5220
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe
      "C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:920
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6344
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:6492
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        
        PID:6264
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 724598
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "WowLiberalCalOfficer" Weight
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
        
        Thermal.pif y
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7976 -s 2472
        8⤵
        Program crash
        
        PID:7800
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3272
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7544
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:7512
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\Admin\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:7620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5052 -ip 5052
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2236 -ip 2236
1⤵
PID:5336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6068

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4848

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5420

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6868

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:6880

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6560

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7976 -ip 7976
1⤵
PID:7772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\SetupMetrics\0008c97c-66c6-400f-ae19-769430631996.tmp

Filesize
520B

MD5
d7bdecbddac6262e516e22a4d6f24f0b

SHA1
1a633ee43641fa78fbe959d13fa18654fd4a90be

SHA256
db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9

SHA512
1e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\1000032042\ko.ps1

Filesize
912B

MD5
fd20fbea11d956f653e48e57533f16b1

SHA1
a852c78bb32389fb4c5abd7d7e748e4ddc4a3695

SHA256
ac8a8901a5dd0728c8626015e509a856c257b2a0e5405d41f7cc0563c7ed28a5

SHA512
fbdae6b8dca3cd596afa8cb54846fb704a89033d34ba8cf7983dd6c288fa318120a09e12b244a1d8b43fa028873f036464fdac05e8f66bff1571d933bde94b53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad\settings.dat

Filesize
40B

MD5
3b5f5d896eb76e2a67cbd04f7073ca21

SHA1
c1e570beaad51430794054997d706d7d7abad775

SHA256
caf2fd97129bead8490c81f7fe25f8c82adacc2b586115b50ad25d2f45a0ecf0

SHA512
d26f5b70578f11bc66ad48534f7dfb743d04c8e534d9a7e574084f3401ae8135ab8ab86ef7b12519cb3b4affd39858d1b73a500ab35071e7be2d8c884c387717

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
571be346748c851f3ed686a393935037

SHA1
6f7b32def9662df0d196e6def154369efda67901

SHA256
4bcb1c90d57662480bc1071a69137826b36ffdb694b8ce762d3f7337840d4c91

SHA512
111d36a48d8bdadf50e0b75593259592800e75b205632571f16c412ed8c659551f9cfa14781b9caf0a7bc0d0586db6eb8b5230bd7ce969d5d01091c2e248d23d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
5fbc86b83a42bace2691956d4c9bde69

SHA1
b4ce5cec8cbfa160aa5551275511c548ae30f44b

SHA256
55ce8f1a0e1ef6f014425a10ff750e15e4fc5e099683fffeec0f380983cd5748

SHA512
8723154914579b2f8a260ee1e7257048ee075f8b97ea030801b55aa87747fb37d2f7528f837838a77794c844b6250070a2aa5187c244287fde9d4f17289cef9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\Network Persistent State

Filesize
2KB

MD5
23a470172b144130f0e40c642bdb9039

SHA1
02083ed58b7b62120f8bb55b7795a41b7e2c9009

SHA256
f149d79c268e14e8de33fd54bc57642a200262e5b67ea1a821200de6df2f8cd4

SHA512
1b1bd6a1b5473315cb3444a5e4729009f89c65ca8bb473e1860fc90777b297e29f29dc78fc648410a8ed92a9598f103c80cdbd8269b3514327820d6ecefebe4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\Network Persistent State~RFe5935eb.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences

Filesize
9KB

MD5
61b59026586a8ad1e807540e50994f2e

SHA1
81ec7414812dadb4848a933e82cf4c798fd51f56

SHA256
e34577b6ecff11934e8f5737e908ec6446ea77c876ed54737f146a1b76798578

SHA512
c92ff29e3d8c4a90b7c029e037218bbe6eb9f6c9a010cadb5718778494f5338f37e4f83755c9095220f4d543c461fdcf34090e0b5e45ed47c62adb9fe7273bf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences

Filesize
8KB

MD5
c5102a2a9bdb288b78a8b7ad8b08c3b8

SHA1
d770e033dfbf146faaf5db0c48421f47f193d3b6

SHA256
639da1936be6942db707be0fc330a6d59d3ecebbf668cb5a3de44037a1247ddc

SHA512
08c695e2cee220479e6e03fb0e981e619446a6646f1cc0d43d2572c974674a5944f56f7e1058f42c7594a21ecb229b2e5da0af4c9016dbf41cd4f5f092d95627

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences

Filesize
9KB

MD5
afc64ed87c53f19c1e9f47b4b620b8c2

SHA1
353060b71abe5a4c9addc07ba106249390fab126

SHA256
0b54e4753855ffba780e52ae5d75ddcc1aef7ce140396d557ce43f6fe46000f0

SHA512
6ac81300e4c9b701209261815432576717448c46f61ea9e48ee717e21763d142a4c9ac1ba39c09e96f01852b2db825e5ce8827b9158ddad8d121c6ea2b126985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences

Filesize
9KB

MD5
362c509d527c08b2603594669339c185

SHA1
daad2109d3df5a8dd07eb16f8aaec5d905e33ace

SHA256
4a4e2e4094a19d08f141728f7dbbf9b33d1f1355ba3fce665bb7eeb33bab465d

SHA512
561d5cf01631ccdfe4638ec3f4ee31f24e4ce054c83f7b20aedfaf228e66959f55de232b6499ea3b398bb100993415f288654d5f0918f061f2a8485d5bbd36aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences~RFe58414a.TMP

Filesize
1KB

MD5
23bb023b6adac4f5f18c89712847c051

SHA1
1024fc50d254d66a2db93c8aba065e240357976a

SHA256
f43fde6f54ef360492c2f86144e14fc7da2a0793464876b0db7d794b14a6d9dd

SHA512
186f7c9f0048704cfbf27bcb37d312ed960f2b2509bab9d4e577b0927f415e9fc9aaa6a7d325c8231628fa7f043192a636438f1805481977a22d7ed0b2f336e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Secure Preferences

Filesize
13KB

MD5
69d28688f05219284cd49e7faa0c1850

SHA1
441c5dd72354a200ad8ca22d0e20705cc6f21aa0

SHA256
987dd8da43cb8167aec8006d2197e6d30520d8032ce6866241b061d738b31f29

SHA512
d844d6e55c4c85809d1a1a5435a83a2f9028406378f59a1543524c38b6095f5481ec83c4af58d05b4afc905ddad8305bd5e303df80b7ffeffeca46d4c2ed3dd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Secure Preferences~RFe5868c7.TMP

Filesize
10KB

MD5
e6c5015b42dad7bad369a926b8961b67

SHA1
c475035ae9e86d4f4ac6c0306b72d46fba7ec61c

SHA256
a4564597b4004053c84f04086a15418de30a84344a20c6f525ae27fb5f9f1392

SHA512
413ec858fea0efe0faf0a8dacd05be4411f6c57121c2524c0135eff23dae728de76655bcaa92dc1c22f429e83267d8ac49410df6225159d52fbc573e31bed0ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
caaf293a258b7ea4023895f02d5942c8

SHA1
a93d3cdf7348c8517f5bc72b2f79badaaf960ebe

SHA256
87770b794ba6a0314decb5aefecbae1806bed907db68c146b12ca1a1d3150926

SHA512
2895c2a10f7177737dc1a6ad3604db8f9aa837947e278369ca54c84517ba4549bf52d9e320263f1724068462031feafafa0c81e695786654c13ea96918724676

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589258.TMP

Filesize
72B

MD5
9a135483e1f1992a687132f1c18056ad

SHA1
69a21b35bf325ffcc0398db0f4b9558f9c0abfe8

SHA256
439299c4b7bb09f1b865d1ea4e4d6f1d6a8cc3215bb9ed540c21d6b9785bcb37

SHA512
d6b92f105b3810cfea08e06a58a82ef48a7cce4edc22df9b85c40f3774d4600d41f1047851a89d7756ebe675e5aa3e1171ef2effffd857cab584ca052c2a3161

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png

Filesize
1KB

MD5
40c4ea664da063cccf37a00d0dea5f88

SHA1
f524c4c8544d5e8b7d5a29ba74fbe865c0fa303b

SHA256
91289705a496311822aa52d067f2a029025293f1c22779f3a8bc483e211ce1d8

SHA512
bbe182958560fa196423bc1b50575b078e4a3b2b170427074442a42a3f21ae7d91d3115e75f38335c778070142d2d1bc929bfa22bf0fb2ae644c0478f6d58d51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png

Filesize
2KB

MD5
9e1a6c45e7a5b26e6dfcb060fe4ec411

SHA1
8895839baaf4a6ce1189fd8c5572c3c8298ddcc0

SHA256
102aeb88e02ce1cd5c91ce4ab3c5880be33b6a440ee7f24c9e38741e79b46273

SHA512
323180dbdb0ebed3f398d5e7233f681ec85bd0815ef463d8351e17e99ee6f9f47badc9bdd9ab197249fe85e2c0d2457760f7bb7550c9c55110f333d13bfbe8fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png

Filesize
3KB

MD5
65e00211feede352e87ff869cd3d1b1e

SHA1
2ede8e165651f24a165f31bd2b4591d124d5fdde

SHA256
dc78a4be5b92c40c32dbbd4bcc3c65057105db062c088fadcf835a5e161095a1

SHA512
1fec808d0591868de3e27863e095ded619cfb825239eb05aab61f9ddb09bca28534e5a1a6f0d39a47affb7a3371d07cca9701b8dabcd297ff2fd116c9123fe61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png

Filesize
1024B

MD5
ca6289a7d8f9ecc17f8de717faf1af27

SHA1
4ccf3c6a9291f0a8a3090c22aca6f1872c860073

SHA256
3d7283090cf1a87baae4032266e4d144f7ec2ea465e7b2bf02728aa394c678f0

SHA512
100fb108d3eb74eea016af82a5a6758f22173b3d9a60c5237e9a570aa14549397b224d9d4234661855ffec47930a33536d05c0eb56ac61c551184fa89b18697c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png

Filesize
1KB

MD5
06c47df56a44e6ec6ed68a0c1b13fcf1

SHA1
d081069ab4c69925e2c5a8e7bb9a683f620dadb2

SHA256
6e21221baad8ccd2b71542f9d3194dc5868c0f424fea640cd4915fbdb32f4804

SHA512
e23731119c43850604eaa83c7fc17cff43681890ba3e144cc0b97cc8b33dc3f90a5370c7ae599c5469e33fcffed6492308451a0f3699bca51df665a70329a569

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png

Filesize
1KB

MD5
fa9b6bd6c167dc772018d4105b7f3afd

SHA1
5a8b1a8bec14f864d559667c79683735508a8036

SHA256
2a8f1a1cfac4fbe96a6cb69e9e621201875cc45b2e60bc75b08ea193c759e346

SHA512
db8b36ed049e357346a6c249dacf54a78bf7395ab8a3c8f8d2aa8d575193f59959cddfc7e1ec18b32a029aa1cfd42ffe30149d74de56d88baa0583a6c00d9a9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png

Filesize
1KB

MD5
cfd1c4fa219ea739c219d4fb8c9ccf8d

SHA1
1bd9c4a0c08a594966efe48802af8cdd46aa724c

SHA256
36670568a87c7b3cd1a4448ffe5bde9b6fd3d65b58e6dca38cc4ea2e9e8c11b3

SHA512
59918179057447aa18668abbdaacd11ee3f5e83c25a93f916a050a559ea1457d6ab61abd3db9def22b5214a1767911e9cf9fa8e638852032cca3696424c6a903

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png

Filesize
2KB

MD5
f484337ddad3b425b5788e5ce7082bc8

SHA1
79c7e4c0202a06ef3a287cc76ea498fcf26009c2

SHA256
fa58e3209e408e4f0d60a7ed330d6f62884ccf9b593e37cde03e7916c116dd1f

SHA512
518a8e3d53fe86dc714a59cc70f8f0c44396d7569d25837c1cfe6212a10204080e0c4d19c43729f1815093af9f075693decbb9496700a2f00bd57dd3ed0b0a3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png

Filesize
2KB

MD5
9ca95e4d4941acee74cd1bef23eaba35

SHA1
1717e5136bf97a89b5dca5178f4d4d320b21fb48

SHA256
80c1e2f4d89d5266f82dc0295f232eda894812820c5c625a036adf980536e5a8

SHA512
9fb11e36e626b0d9eb43548ba0e90cda27e70d027361c52437f01287e94f07d07da01a385ee2466963e305516f56e37020644ce03d1132322d7e796440c633b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Temp\scoped_dir6116_1244472094\Icons\128.png

Filesize
5KB

MD5
c592b8809b071c071577fff963bd1ad5

SHA1
f628a6edd48da4aebdfdc05ee3ce852b27706cee

SHA256
8a9434f0ede8c6edf65f8d5750852be574847a62a4534e1b6b372078463b6d04

SHA512
418f074fe6b91e4393bc670a75d26db28ddfa370e3b33c17db2a402dd008175be910c3fe9714051d55c13fb28d3901fc6e7e81f73587144d053d8b25bf9c8c90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State

Filesize
116KB

MD5
26bc6855c89b496cc400551466796726

SHA1
7ad11057cb765dc85f532ae9e61f506652c4ee4a

SHA256
481bcce9052426a1986a132c83960d60022017316582f3efd7f4f3f2248d81bc

SHA512
a79d53af499c337e17803e72f64548fc0ab9eb75b73cd1d74d292d95ad992cd12f8666946e86af79b3b6d6020a06ca5ad86d7650baa358d4dab304562e145c78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State

Filesize
116KB

MD5
b401785cacd79de77f57609668cba40b

SHA1
90d675a74d414588124cd8ce5e2bf7fdcc66aa94

SHA256
e6b70fe2890ecd78ca8a95745fdbc89532873fb20da8746f67441d8343b24126

SHA512
b586942a4efdffbbaa43a0bcf4475dbbb765bbfaae1b387b131e0802b8c644794dcff4120627bb97291b4a360829b04787dbc135a8c16123f1ca32f8fe379a2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State~RFe58414a.TMP

Filesize
932B

MD5
89f78f343da3b828b16b5da50b218ea4

SHA1
7d19d60a08319c9dea4de11d91d371fadca744b2

SHA256
e2355400e32a52d33352e6761fa1e5bcb67c1cc7582c7764d6f33775a364945b

SHA512
178cb7c962c5f22bd0fa5d78fb8f2ef736fc5c8122203bb8352b3e0ddeb72499c636ee19b21b729e67602233e4ded2db85a1a2f948fe158adc1788eea8f9b53c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Filesize
2KB

MD5
e34b053c93dcb4160094249280888117

SHA1
bd7cd93042c200c5fb012bccf3cd9f72d7e79cef

SHA256
2bc71ddd63acfb9d101892e29033c75b4023727e1cadc489ecb2421c1960eaa8

SHA512
f8753ec3f9f413e1fac84caa1905509a978dfc63211dcd0a889a4283840ae2e6e9101e1f7ee7d582acc5e0ae722fdab8f6047aa02cee28869a094b4f494897f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
311B

MD5
f6f887439a6937f627ce546146328158

SHA1
e5e5f407d19a4ab14a7dc4aacb589cfbbc189702

SHA256
aaa7a547737c57102e6795bdb0e0079d77265cf0b6ecf9f02a9c796ac45c7c02

SHA512
88d8d26541cae3724caec753906aff1be490cf9be923d9fb14bef4e23fd273874628b650ec8f5c7fee74180e029b5c2f871ab87c1d9d3ae04b7af3aa3cd2b89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64b91e3c8d249635ce71e1646d8207f4

SHA1
9c35b9d44cc03ba30f92faa9c87b0222db44603a

SHA256
02a908b337d32d895ba327f385f4f088e7cf57d6e7a2dc1b455914aa259381fe

SHA512
9a3a7f5ce1962101c1eea9250d453283db9ddf04bf631580c823ec102f5e69822c8cb5c7dac8f1fb9a2ba5877c95b9bb3c57296af69cc517bd02cce724d0ac1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
204fa74f07413fc5c3040bdae143ef8a

SHA1
93eb7aa5f194f657773b859c4a821a59cfaf1328

SHA256
98e762288c0cd64cff48fe768334c1d816bacc02e71026f16037846c0b1e1389

SHA512
5f3062de980b7aa4f8da8f6768775b1bf4fb2f0339b0884dcdb15d7d00be6f4436a5338501b36c20ea9e02e440e723cdb2a432384d2bc75601e56b7af6f8abfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b245d7cdf57dbb0d165828687262dbd

SHA1
eb48e4010b36ff4b1d0c2133d07f9796b00cfc2a

SHA256
9b18d4dde887bd3c9f8f73ae68de93103d1bb37ee1217e3c9577f3e2eeae2c25

SHA512
d64ea32b301d750b3697189bfbbd712259818cacb2862fc96831d7b881333aea37fb4f84023335e3264869f697fee11ebecd3209008b2b73fe2875d9e4a879cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
7c5a89b056702550d0bcaf83366c9ea9

SHA1
d82f0869adeb3f480a352116b0ab09e20783253b

SHA256
816cdfcdc659bc4acba1715e95335b792c1a2934b8357fdc4f96b8ea9d2f2da0

SHA512
cb3c37feb7301deb473781f9da11a399fe67a09b49c11db010cc5ed08c8d68a1425bf8c40186ff0485037a250e0abfe2b15859dce9c6b04428cd89659bc8cec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

Filesize
314KB

MD5
f2d385ddbb2edafacd070f103f7f1576

SHA1
5ee6cb80bc943476067c148e5c16738b7b062029

SHA256
d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3

SHA512
e6ee00d15483ef29fb7e48ed28833ce5059f7bfada96b92c350246f6032f85d318571950bf6d2ee557e417e87d24d90965aa1523782416792fa7eb7354266df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

Filesize
1006KB

MD5
c005d4ffa3e28c22b41a9d222598260a

SHA1
57cc3a6540bc38c649ddfdd54fa4f3c8a2423677

SHA256
799d10acbb0e2886c4d32c771964f4c2cb47f93c817cdc26a9acaefa3ba042cb

SHA512
ce39903c46160deeee1c7b362000361a3f5a9243b2e180bbaafa5b8ab09cc09ca413ce32f4deb2074fa928110d25b3dae7465c849fc388a58ddf649a9caa3a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000034001\53bb5484ab.exe

Filesize
1.8MB

MD5
4fb2d57ca858e8992808938bb23eef46

SHA1
14559e576016904d880b7c950a31c0c3945b3d19

SHA256
bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f

SHA512
5f63f350133f4fcfe983fb8432f331fd5e7f4431fa3689eae9008a7d966208d4ffdd2b1152cd016623c33291c90a031c8947e04ae9419558b13a8c0ba6454340

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
187KB

MD5
7a02aa17200aeac25a375f290a4b4c95

SHA1
7cc94ca64268a9a9451fb6b682be42374afc22fd

SHA256
836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

SHA512
f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe

Filesize
12.8MB

MD5
534704bd30b2d7af9e4537980a8474b1

SHA1
e4c78f68d7cb4e7c7ded41bf952044a9b5a8d8f0

SHA256
ea8f9e43b89dd8c9ecd7d5413fe82ca75e5acd0d99ea00b9841117361676df0a

SHA512
44e51dacdeffc57f968724cc10111499b6cad4a824393241daa4337e6d614ff097bd0b905e04edda7de9a066cc6b7b4994dd077e3c84db522270e0431f6ce989

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe

Filesize
989KB

MD5
f0cb6a0555896e017b2f778a847b0196

SHA1
918e72af4ce78588f2d6fad65a91256ad69e1d8c

SHA256
8c3c459481bb940ad69a704a041516f42012775c60f288c731a394954e3eda3c

SHA512
af5ab34ba0faad80926c39bd97ae9e7521e1ae7a94ef7e71c20a837797cceaa01d728e186c8f75f754e535ff92a7c46e721aad43076fd6b855520971e4251e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

Filesize
4.1MB

MD5
7fa5c660d124162c405984d14042506f

SHA1
69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

SHA256
fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

SHA512
d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

Filesize
409KB

MD5
a21700718c70ec5e787ad373cb72a757

SHA1
027554ab5ff3245e7617f3b83d6548bf7919f92e

SHA256
87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6

SHA512
ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

Filesize
314KB

MD5
ff5afed0a8b802d74af1c1422c720446

SHA1
7135acfa641a873cb0c4c37afc49266bfeec91d8

SHA256
17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

SHA512
11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

Filesize
352KB

MD5
2f1d09f64218fffe7243a8b44345b27e

SHA1
72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe

SHA256
4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2

SHA512
5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

Filesize
304KB

MD5
58e8b2eb19704c5a59350d4ff92e5ab6

SHA1
171fc96dda05e7d275ec42840746258217d9caf0

SHA256
07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834

SHA512
e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe

Filesize
963KB

MD5
1ef39c8bc5799aa381fe093a1f2d532a

SHA1
57eabb02a7c43c9682988227dd470734cc75edb2

SHA256
0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4

SHA512
13a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000354001\e731f96cac.exe

Filesize
1.8MB

MD5
e904093ef887cb372b3fe7ab75e6c6c7

SHA1
aece57bd3cbb0bc1818fe026100f30783a6e3f55

SHA256
b99711aa1ee5a0ca9cfcc53dff0ffcab9f2800afad74a0633b1488fe2afa47b7

SHA512
6876fa64ce5fc0f7a2b80368d2128b96262cf2dc9889bb2f5d3068c20dfd04f37fecd3095e941535cbc1de9be996411b3f617062f7364bf2ad28b404843dfd2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000355001\fb4c9a74e3.exe

Filesize
1.8MB

MD5
2f8c50a4814ec4de08e5db7de9c21f7e

SHA1
7bbb4f3e09eabfa9db6763832ab6a1223d3854fe

SHA256
c194ede82aef96a80956563d18eef70e2a13d68d544f740f0c5ea058e7f2e029

SHA512
3ce6312c0d7505412f2701e83601cff924413e4ed32ce094b727353edd3634d3933415fbe2ca6b0d45fff746d71b8204a92f1346f785acc116c4c64a074788ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe

Filesize
352KB

MD5
2fe92adf3fe6c95c045d07f3d2ecd2ed

SHA1
42d1d4b670b60ff3f27c3cc5b8134b67e9c4a138

SHA256
13167320a0e8266a56694be70a9560c83e2c645d6eeaa147b9ae585c2960ebb2

SHA512
0af7b4a3ce3981707ca450b90829a4a8e933ea3cd3affbce738265a1a0647e96323117db325d0e5e3884f67f36b21b8c955b6c3c6dda21d9b01212e28ef88d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe

Filesize
6KB

MD5
c042782226565f89ce3954489075e516

SHA1
256dd5ba42837a33c7aa6cb71cef33d5617117ee

SHA256
a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

SHA512
9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe

Filesize
1.3MB

MD5
2b01c9b0c69f13da5ee7889a4b17c45e

SHA1
27f0c1ae0ddeddc9efac38bc473476b103fef043

SHA256
d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

SHA512
23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe

Filesize
810KB

MD5
87c051a77edc0cc77a4d791ef72367d1

SHA1
5d5bab642235f0af7d9afe3cacec5ae2a4cfc8e5

SHA256
b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c

SHA512
259a3f823d5051fcc9e87ceacf25557ab17f5d26ff4f0c17801d9ef83a23d2a51261a73e5ba9c3caf1ca2feb18a569458f17a2a5d56b542b86d6a124a42d4c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1fd46f3f-face-45be-8c19-7fcb2e08d167.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.9MB

MD5
b8fc8a5801e3c0172a199430c7dba1d6

SHA1
2a53f4961410bea07de2259fd7875b30ae6a7856

SHA256
c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5

SHA512
b6a2e23babec64712408dbf0e1a9ce5720a4aff14c6de3e90a756c00ec97d01f394a18608de1cb2a90f87ce6c6fa8b4829ca57f77b8c110462b65af10e9ba3ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\607698\Q

Filesize
794KB

MD5
7b5632dcd418bcbae2a9009dbaf85f37

SHA1
32aaf06166854718f0bcbb2f7173c2732cfb4d33

SHA256
361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4

SHA512
c834e90ccf2d35529c294319b8e9a49db7a7d67d0567e0739131d5af51170db32076d68147dc101f8047a75cb5b2275b25a9c8346a99a146a6798b9764316838

Download Submit
C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
C:\Users\Admin\AppData\Local\Temp\862842986254

Filesize
81KB

MD5
9add9d09ddf9608863526d8d7045d6b5

SHA1
9db417169d41724373d03ac5448c447452882723

SHA256
e43d8e716df518091e91b2d6edce993d7ccf2a7b448cdabf3fb9e8eb99b753d7

SHA512
3876377af541349f709b827e6e8e0545de340d3ee98f7c17b348d14bd2d347af95f127d953f6859423776093ccb70e968439e259a1b857a71a912699f0405d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Emotions

Filesize
19KB

MD5
b98d78c3abe777a5474a60e970a674ad

SHA1
079e438485e46aff758e2dff4356fdd2c7575d78

SHA256
2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4

SHA512
6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp9451.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3y124i3.ahs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c9f4ea81-cd58-40e9-a43c-e7ee6f5a3d9d.tmp

Filesize
132KB

MD5
e2d2f826a2253da9da88faea320734db

SHA1
17b24a01c01485399600196b6aa68456f070942f

SHA256
e59d727ad2f2ea2612506af5418a2ebf5974f16f7aaa9f7497bc92d75a451624

SHA512
ad0686dab396d77cbf6a39628aca8a712793257232eaf43e4cd27a27b32a7411fd2755bcbd92d3a9a7acf32b0e7974ac65fbc5b28615d91f48558acac7af767d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IEKS9.tmp\javumar2.tmp

Filesize
3.2MB

MD5
97dce6295efe4b54ef6cf3e7d344530d

SHA1
037df420c8dfb42cb7566f1435ba7d31c33ac0e9

SHA256
37a2fe2fe9edf836698d72ba673bdcc648c09d75e7000be7fca7dda8b61f2be4

SHA512
f4ab1e15f3334de9b499e475a2608bc0d864dccf2f40f7b92421b21cc9d368c2305ba0be8e06152bb42570d2adabdb96c76713cc9d1fe54b4d4c75843fdc6b20

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IJB5F.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir6116_1888033682\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5F7B.tmp.dat

Filesize
114KB

MD5
f0b6304b7b1d85d077205e5df561164a

SHA1
186d8f4596689a9a614cf47fc85f90f0b8704ffe

SHA256
c3aa800492bc1e5ff4717db8c82d1f3772b24579cde51058bdd73a9cc9822dc7

SHA512
d672ea182ddf56a331d3209dcf7b9af8c3ffad0b787b224fe9e3e4c80205e474a66914358fa253c170c85a8366da2f2c3aa9d42e1f6f3291a9e6bdd9ba51fb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5F91.tmp.dat

Filesize
5.0MB

MD5
199d82d11c3c57b35976685dd2c6135f

SHA1
b95c80c6766745ca4049acd19d25e9e60d55871c

SHA256
d1e83b9f571cdd8087d0ba5e2de31ad98ebf2c1156eea86de6ef8dea5fc2adcb

SHA512
972db73c22a683a2a68043f53a388978b72f20b2c1411bc69b662b1e66c31dbcb60f142748c6960242da7c58dcabac46b056f6c612612d062b54e38dbf44c14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp60AB.tmp.dat

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Roaming\EzLcuMxgF5.exe

Filesize
490KB

MD5
b473c40205c61dc4750bc49f779908dd

SHA1
88a0fc0962099f0ac2d827d2c4d691ed9cade251

SHA256
8707c03158ba6395a11bdfd8c1b11eeedc2e052d3b55d73d0a5c64417e5fbd3b

SHA512
8fbaaa5bde30fe7c6e31a349c14e3bd710e92c4dbcca8cbdbaf34583887bc31e07e10a0223fc6c6c0d091787c296eba139ec91af44ec4ee6abbfb611493951d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625

Filesize
2KB

MD5
86d788b3e4aaa98f0d7a16dbcbd4b259

SHA1
9848195e062265188dc3a2e8e962daaef6f53ab2

SHA256
484336adfdfd133c6336a221e6bffbaa613074f20172bb32695c9375dfcc6374

SHA512
d851792eb34fcdba002550ed7a85bd50e6ee987c44de0baab23173144af3cfa9ccde8a00b0abf716d2536c3609f007870b03c25e8aa15913c3a24a63231223bb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625

Filesize
2KB

MD5
24f5958180f4a200364d3e928dc0e170

SHA1
c4bd6d4e5a3fc3280ccd69f589c464c2db6810ce

SHA256
ab44c347cdb2075bf7d10e5d8fee60ab4ff0e5771db60357798d4d1e3176bf85

SHA512
f8cf846a4ca880c3c654d7ff69746564e542ca68df580dbb9b5f4af0311bab7ef90392ddb5580e8dd86d4f7c919870e871ca4036ec5057151192720529a3c06a

Download Submit
C:\Users\Admin\AppData\Roaming\jHuFRYRN7w.exe

Filesize
304KB

MD5
65c058e4a90d2ec70b03211d768b6ecc

SHA1
bf5af6f650759e5e612d42d72145660056737164

SHA256
5a00e3718afb5bfb18a6b1c824b680015733f0403af0d5663289a17ba8206cc3

SHA512
3d9114409f8096ce8a1d134a48235fbbad0c6c53f820707a951bac42c4f7ba6a38e98a50c9d929f049042263a7c0e24da8368d3aa4e934f5da79e9bda4a930aa

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
aa60d7755d5a23aaba15d7e1555aa410

SHA1
86161ac3fc74599ef77c21e6d4525d4d2407a330

SHA256
a9d7cb990c537410262c28d8017bd8c2ffbdcc9850133a81bf3cc5100f090e4e

SHA512
2e51315c3704d082686ee84b93ea15e623e785280051e6482e172ddd9fa76c0234303132dbdff4174972877c00b004c43289782e1b27417ab863d852c8ae35e2

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
fba612eeb015040e2746998f014d48bb

SHA1
6a0b6255fd631eeb7a3e5c8378e71410464608a6

SHA256
efed14402dbda73ef60c40cde4d6095269dd87531980a735f3bb35ad4b598a89

SHA512
3370be0f65c58366664475d361be58253ad5eb8e8924f820c36b7f5a6980f420548152e2962efd4e2f20435b7e1003c896cc00f2df2185947edcb4ca6d34d1db

Download Submit
memory/212-19-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/212-200-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/212-175-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/212-174-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/212-199-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/212-20-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/212-18-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/212-17-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/856-327-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/856-1550-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/856-330-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1216-63-0x0000000005700000-0x000000000570A000-memory.dmp

Filesize
40KB

Download
memory/1216-139-0x0000000008F20000-0x0000000008F6C000-memory.dmp

Filesize
304KB

Download
memory/1216-125-0x0000000008D50000-0x0000000008D62000-memory.dmp

Filesize
72KB

Download
memory/1216-124-0x0000000008E10000-0x0000000008F1A000-memory.dmp

Filesize
1.0MB

Download
memory/1216-203-0x0000000009900000-0x0000000009950000-memory.dmp

Filesize
320KB

Download
memory/1216-119-0x0000000006C30000-0x0000000006C4E000-memory.dmp

Filesize
120KB

Download
memory/1216-123-0x0000000007480000-0x0000000007A98000-memory.dmp

Filesize
6.1MB

Download
memory/1216-57-0x0000000005770000-0x0000000005802000-memory.dmp

Filesize
584KB

Download
memory/1216-42-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1216-126-0x0000000008DB0000-0x0000000008DEC000-memory.dmp

Filesize
240KB

Download
memory/1216-102-0x00000000065B0000-0x0000000006626000-memory.dmp

Filesize
472KB

Download
memory/1216-52-0x0000000005C80000-0x0000000006224000-memory.dmp

Filesize
5.6MB

Download
memory/1412-258-0x0000000000740000-0x00000000007AC000-memory.dmp

Filesize
432KB

Download
memory/1504-84-0x00000000009A0000-0x00000000009F2000-memory.dmp

Filesize
328KB

Download
memory/1600-2862-0x0000000000910000-0x0000000000DCC000-memory.dmp

Filesize
4.7MB

Download
memory/1600-2859-0x0000000000910000-0x0000000000DCC000-memory.dmp

Filesize
4.7MB

Download
memory/1708-1655-0x00000000006D0000-0x00000000006D8000-memory.dmp

Filesize
32KB

Download
memory/2420-1859-0x0000000006A60000-0x0000000006A82000-memory.dmp

Filesize
136KB

Download
memory/2420-1847-0x0000000005E50000-0x00000000061A4000-memory.dmp

Filesize
3.3MB

Download
memory/2420-1857-0x0000000006AC0000-0x0000000006B0C000-memory.dmp

Filesize
304KB

Download
memory/2760-179-0x00000000096B0000-0x0000000009872000-memory.dmp

Filesize
1.8MB

Download
memory/2760-180-0x0000000009DB0000-0x000000000A2DC000-memory.dmp

Filesize
5.2MB

Download
memory/2760-101-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download
memory/2760-178-0x0000000007F20000-0x0000000007F86000-memory.dmp

Filesize
408KB

Download
memory/2796-350-0x00000000002C0000-0x0000000000312000-memory.dmp

Filesize
328KB

Download
memory/2928-4-0x0000000000BE0000-0x00000000010B2000-memory.dmp

Filesize
4.8MB

Download
memory/2928-15-0x0000000000BE0000-0x00000000010B2000-memory.dmp

Filesize
4.8MB

Download
memory/2928-3-0x0000000000BE0000-0x00000000010B2000-memory.dmp

Filesize
4.8MB

Download
memory/2928-0-0x0000000000BE0000-0x00000000010B2000-memory.dmp

Filesize
4.8MB

Download
memory/2928-2-0x0000000000BE1000-0x0000000000C0F000-memory.dmp

Filesize
184KB

Download
memory/2928-1-0x0000000077AD4000-0x0000000077AD6000-memory.dmp

Filesize
8KB

Download
memory/3156-280-0x0000000000E70000-0x0000000000EC4000-memory.dmp

Filesize
336KB

Download
memory/3272-1543-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3272-1545-0x0000000004F80000-0x000000000501C000-memory.dmp

Filesize
624KB

Download
memory/3712-39-0x00000000736EE000-0x00000000736EF000-memory.dmp

Filesize
4KB

Download
memory/3712-40-0x0000000000200000-0x0000000000254000-memory.dmp

Filesize
336KB

Download
memory/3892-437-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-419-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-1536-0x00000000065B0000-0x0000000006604000-memory.dmp

Filesize
336KB

Download
memory/3892-424-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-1521-0x0000000006560000-0x00000000065AC000-memory.dmp

Filesize
304KB

Download
memory/3892-1520-0x00000000062A0000-0x0000000006308000-memory.dmp

Filesize
416KB

Download
memory/3892-432-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-446-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-456-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-417-0x0000000000FB0000-0x00000000010A8000-memory.dmp

Filesize
992KB

Download
memory/3892-418-0x0000000005D30000-0x0000000005E1E000-memory.dmp

Filesize
952KB

Download
memory/3892-434-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-426-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-442-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-464-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-429-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-462-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-460-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-422-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-430-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-420-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-438-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-440-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-444-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-449-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-450-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-452-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-458-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/3892-454-0x0000000005D30000-0x0000000005E18000-memory.dmp

Filesize
928KB

Download
memory/4028-632-0x0000000000DC0000-0x0000000001003000-memory.dmp

Filesize
2.3MB

Download
memory/4028-207-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4028-173-0x0000000000DC0000-0x0000000001003000-memory.dmp

Filesize
2.3MB

Download
memory/4408-331-0x0000000000400000-0x000000000081B000-memory.dmp

Filesize
4.1MB

Download
memory/4608-282-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5172-1836-0x0000000000030000-0x00000000006CA000-memory.dmp

Filesize
6.6MB

Download
memory/5172-1819-0x0000000000030000-0x00000000006CA000-memory.dmp

Filesize
6.6MB

Download
memory/5392-1636-0x0000000000910000-0x0000000000DCC000-memory.dmp

Filesize
4.7MB

Download
memory/5392-1834-0x0000000000910000-0x0000000000DCC000-memory.dmp

Filesize
4.7MB

Download
memory/5420-1812-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/5420-1801-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/5764-1798-0x00000000001C0000-0x000000000085A000-memory.dmp

Filesize
6.6MB

Download
memory/5764-1775-0x00000000001C0000-0x000000000085A000-memory.dmp

Filesize
6.6MB

Download
memory/5832-1591-0x00000000004C0000-0x000000000097C000-memory.dmp

Filesize
4.7MB

Download
memory/5832-1635-0x00000000004C0000-0x000000000097C000-memory.dmp

Filesize
4.7MB

Download
memory/5920-1771-0x00000000075B0000-0x0000000007653000-memory.dmp

Filesize
652KB

Download
memory/5920-1817-0x00000000078C0000-0x00000000078D4000-memory.dmp

Filesize
80KB

Download
memory/5920-1761-0x000000006CC30000-0x000000006CC7C000-memory.dmp

Filesize
304KB

Download
memory/5920-1796-0x0000000007880000-0x0000000007891000-memory.dmp

Filesize
68KB

Download
memory/5960-1669-0x0000000007E80000-0x00000000084FA000-memory.dmp

Filesize
6.5MB

Download
memory/5960-1679-0x0000000007B30000-0x0000000007B38000-memory.dmp

Filesize
32KB

Download
memory/5960-1676-0x0000000007A40000-0x0000000007A4E000-memory.dmp

Filesize
56KB

Download
memory/5960-1673-0x0000000007A90000-0x0000000007B26000-memory.dmp

Filesize
600KB

Download
memory/5960-1593-0x0000000002BC0000-0x0000000002BF6000-memory.dmp

Filesize
216KB

Download
memory/5960-1671-0x0000000007880000-0x000000000788A000-memory.dmp

Filesize
40KB

Download
memory/5960-1594-0x00000000055B0000-0x0000000005BD8000-memory.dmp

Filesize
6.2MB

Download
memory/5960-1670-0x0000000007820000-0x000000000783A000-memory.dmp

Filesize
104KB

Download
memory/5960-1668-0x0000000007750000-0x00000000077F3000-memory.dmp

Filesize
652KB

Download
memory/5960-1667-0x0000000006A70000-0x0000000006A8E000-memory.dmp

Filesize
120KB

Download
memory/5960-1657-0x000000006CC30000-0x000000006CC7C000-memory.dmp

Filesize
304KB

Download
memory/5960-1656-0x0000000006A30000-0x0000000006A62000-memory.dmp

Filesize
200KB

Download
memory/5960-1677-0x0000000007A50000-0x0000000007A64000-memory.dmp

Filesize
80KB

Download
memory/5960-1596-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/5960-1678-0x0000000007B50000-0x0000000007B6A000-memory.dmp

Filesize
104KB

Download
memory/5960-1674-0x0000000007A10000-0x0000000007A21000-memory.dmp

Filesize
68KB

Download
memory/5960-1627-0x00000000064E0000-0x00000000064FE000-memory.dmp

Filesize
120KB

Download
memory/5960-1595-0x0000000005D60000-0x0000000005D82000-memory.dmp

Filesize
136KB

Download
memory/5960-1607-0x0000000006050000-0x00000000063A4000-memory.dmp

Filesize
3.3MB

Download
memory/6068-1803-0x0000000000910000-0x0000000000DCC000-memory.dmp

Filesize
4.7MB

Download
memory/6068-1800-0x0000000000910000-0x0000000000DCC000-memory.dmp

Filesize
4.7MB

Download
memory/6120-1535-0x0000000000D70000-0x000000000140A000-memory.dmp

Filesize
6.6MB

Download
memory/6120-1576-0x0000000000D70000-0x000000000140A000-memory.dmp

Filesize
6.6MB

Download
memory/6560-2864-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/6560-2860-0x0000000000770000-0x0000000000C42000-memory.dmp

Filesize
4.8MB

Download
memory/7068-2052-0x0000000000CF0000-0x000000000119D000-memory.dmp

Filesize
4.7MB

Download
memory/7068-2169-0x0000000000CF0000-0x000000000119D000-memory.dmp

Filesize
4.7MB

Download
memory/7976-2792-0x0000000001190000-0x00000000011A8000-memory.dmp

Filesize
96KB

Download
memory/7976-2917-0x00000000076C0000-0x00000000077E2000-memory.dmp

Filesize
1.1MB

Download
memory/7976-2941-0x0000000007C00000-0x0000000007F54000-memory.dmp

Filesize
3.3MB

Download
memory/7976-2942-0x00000000074B0000-0x00000000074FC000-memory.dmp

Filesize
304KB

Download