Overview

overview

10

Static

static

3

08cd0ca2c4...52.exe

windows7-x64

10

08cd0ca2c4...52.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752.exe
  • Size 1.8MB
  • Sample240928-bdymqa1dmc
  • SHA256 08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyasyncratlummaredlinestealcxworm9c9aa5@oleh_pspdefaultdefault2fed3aalivetrafficnewbundle2savetg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasionexecutioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.41

Botnet

  • fed3aa

C2

  • http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 136.244.88.135:17615

Extracted

Family

  • redline

Botnet

  • @OLEH_PSP

C2

  • 65.21.18.51:45580

Extracted

Family

  • stealc

Botnet

  • default2

C2

  • http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

  • stealc

Botnet

  • default

C2

  • http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

  • redline

Botnet

  • TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

  • 89.105.223.196:29862

Extracted

Family

  • redline

Botnet

  • newbundle2

C2

  • 185.215.113.67:15206

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 188.190.10.161:4444

Mutex

  • TSXTkO0pNBdN2KNw

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

  • amadey

Version

  • 4.42

Botnet

  • 9c9aa5

C2

  • http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

  • stealc

Botnet

  • save

C2

  • http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

  • asyncrat

Version

  • Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

  • Default

C2

  • 47.238.55.14:4449

Mutex

  • rqwcncaesrdtlckoweu

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • lumma

C2

  • https://defenddsouneuw.shop/api

  • https://reinforcenh.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detect Xworm Payload 1 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 39 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 6 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752.exe
        "C:\Users\Admin\AppData\Local\Temp\08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:732
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1560
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:3720
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1996
            • C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
              "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2472
              • C:\Users\Admin\AppData\Roaming\8jLZkDmSbR.exe
                "C:\Users\Admin\AppData\Roaming\8jLZkDmSbR.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2860
              • C:\Users\Admin\AppData\Roaming\Qk8pdtwZu1.exe
                "C:\Users\Admin\AppData\Roaming\Qk8pdtwZu1.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1348
            • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
              "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2892
              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3664
                • C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2040
                  • C:\Users\Admin\AppData\Local\Temp\is-05R03.tmp\javumar2.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-05R03.tmp\javumar2.tmp" /SL5="$B0070,12434628,845824,C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3932
                • C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5064
            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:1128
            • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
              "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:408
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4588
            • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
              "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2668
            • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
              "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2320
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1648
            • C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
              "C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
              4⤵
              • Executes dropped EXE
              PID:4912
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 1228
                5⤵
                • Program crash
                PID:5660
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 1248
                5⤵
                • Program crash
                PID:2544
            • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4728
            • C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
              "C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1884
            • C:\Users\Admin\AppData\Local\Temp\1000354001\722aad513f.exe
              "C:\Users\Admin\AppData\Local\Temp\1000354001\722aad513f.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:5660
            • C:\Users\Admin\AppData\Local\Temp\1000355001\0df1533442.exe
              "C:\Users\Admin\AppData\Local\Temp\1000355001\0df1533442.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1768
              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5508
                • C:\Users\Admin\AppData\Local\Temp\1000023001\0e7ffba7f0.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000023001\0e7ffba7f0.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4608
                • C:\Users\Admin\1000026002\e3c47b358f.exe
                  "C:\Users\Admin\1000026002\e3c47b358f.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4512
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000032042\ko.ps1"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5572
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
                    7⤵
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:5604
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc9fc7cc40,0x7ffc9fc7cc4c,0x7ffc9fc7cc58
                      8⤵
                        PID:6088
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
                        8⤵
                          PID:3092
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=2116,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
                          8⤵
                            PID:3808
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=2236,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
                            8⤵
                              PID:4980
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
                              8⤵
                                PID:5512
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
                                8⤵
                                  PID:5312
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3420,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
                                  8⤵
                                    PID:264
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4124,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
                                    8⤵
                                      PID:4200
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4448,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:2
                                      8⤵
                                        PID:5232
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3892,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
                                        8⤵
                                          PID:5640
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4976,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
                                          8⤵
                                            PID:5560
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5272,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
                                            8⤵
                                              PID:5248
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=5448,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
                                              8⤵
                                                PID:5664
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5464,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
                                                8⤵
                                                  PID:2816
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5680,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
                                                  8⤵
                                                    PID:5636
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5700,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
                                                    8⤵
                                                      PID:6000
                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                                      8⤵
                                                      • Drops file in Program Files directory
                                                      PID:2260
                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x250,0x274,0x7ff64a1d4698,0x7ff64a1d46a4,0x7ff64a1d46b0
                                                        9⤵
                                                        • Drops file in Program Files directory
                                                        PID:5700
                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
                                                        9⤵
                                                        • Drops file in Program Files directory
                                                        • Modifies registry class
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:6276
                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff64a1d4698,0x7ff64a1d46a4,0x7ff64a1d46b0
                                                          10⤵
                                                          • Drops file in Program Files directory
                                                          PID:6312
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5856,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
                                                      8⤵
                                                        PID:6252
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6052,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
                                                        8⤵
                                                          PID:6452
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6312,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
                                                          8⤵
                                                            PID:6700
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6452,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
                                                            8⤵
                                                              PID:6840
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3184,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
                                                              8⤵
                                                                PID:6964
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=5424,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
                                                                8⤵
                                                                  PID:7124
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=5992,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
                                                                  8⤵
                                                                    PID:6172
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=6936,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
                                                                    8⤵
                                                                      PID:6056
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=6924,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
                                                                      8⤵
                                                                        PID:7060
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6032,i,1499500132127520949,1404865561382531556,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:2
                                                                        8⤵
                                                                          PID:7016
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000033142\so.ps1"
                                                                      6⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5844
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
                                                                        7⤵
                                                                          PID:5624
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc9fc7cc40,0x7ffc9fc7cc4c,0x7ffc9fc7cc58
                                                                            8⤵
                                                                              PID:5572
                                                                        • C:\Users\Admin\AppData\Local\Temp\1000034001\13eac78bb9.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\1000034001\13eac78bb9.exe"
                                                                          6⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:6056
                                                                    • C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe"
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3192
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1308
                                                                        5⤵
                                                                        • Program crash
                                                                        PID:5276
                                                                    • C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe"
                                                                      4⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5628
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c start context.exe
                                                                        5⤵
                                                                          PID:6244
                                                                          • C:\Users\Admin\AppData\Local\Temp\context.exe
                                                                            context.exe
                                                                            6⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6256
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                                                                              7⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:6772
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                8⤵
                                                                                • Enumerates processes with tasklist
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:6480
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /I "wrsa opssvc"
                                                                                8⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:6684
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                8⤵
                                                                                • Enumerates processes with tasklist
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:5200
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                                                                                8⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5172
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c md 607698
                                                                                8⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:6808
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                                                                                8⤵
                                                                                  PID:5592
                                                                                • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                                                                                  Waters.pif Q
                                                                                  8⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  PID:5868
                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                  choice /d y /t 5
                                                                                  8⤵
                                                                                    PID:6860
                                                                          • C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe"
                                                                            4⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5748
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                                                                              5⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5240
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                6⤵
                                                                                • Enumerates processes with tasklist
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:5924
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /I "wrsa opssvc"
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5640
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                6⤵
                                                                                • Enumerates processes with tasklist
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1860
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5304
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c md 607698
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1768
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /V "MaskBathroomCompositionInjection" Participants
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2800
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5704
                                                                              • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                                                                                Waters.pif Q
                                                                                6⤵
                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:5456
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
                                                                                  7⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3916
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /f /im "Waters.pif"
                                                                                    8⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Kills process with taskkill
                                                                                    PID:6420
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout 1
                                                                                    8⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:6652
                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                choice /d y /t 5
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3488
                                                                          • C:\Users\Admin\AppData\Local\Temp\1000369001\PkContent.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\1000369001\PkContent.exe"
                                                                            4⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4012
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
                                                                              5⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4196
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                6⤵
                                                                                • Enumerates processes with tasklist
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3468
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /I "wrsa opssvc"
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5840
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                6⤵
                                                                                • Enumerates processes with tasklist
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3916
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:100
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c md 724598
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:6068
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /V "WowLiberalCalOfficer" Weight
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5860
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5560
                                                                              • C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
                                                                                Thermal.pif y
                                                                                6⤵
                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:5864
                                                                                • C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
                                                                                  7⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:6972
                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                choice /d y /t 5
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5716
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:5752
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
                                                                          3⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3124
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
                                                                          3⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5980
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                                                                        2⤵
                                                                          PID:2596
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:5468
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
                                                                          2⤵
                                                                          • Drops startup file
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5708
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\Admin\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
                                                                          2⤵
                                                                          • Drops startup file
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5796
                                                                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                        1⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:808
                                                                      • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5060
                                                                      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                        1⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5404
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3192 -ip 3192
                                                                        1⤵
                                                                          PID:528
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4912 -ip 4912
                                                                          1⤵
                                                                            PID:5684
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4912 -ip 4912
                                                                            1⤵
                                                                              PID:5764
                                                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                              1⤵
                                                                                PID:1260
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                1⤵
                                                                                  PID:5228
                                                                                • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:5868
                                                                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                  1⤵
                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                  • Checks BIOS information in registry
                                                                                  • Executes dropped EXE
                                                                                  • Identifies Wine through registry keys
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  PID:4620
                                                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                  1⤵
                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                  • Checks BIOS information in registry
                                                                                  • Executes dropped EXE
                                                                                  • Identifies Wine through registry keys
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  PID:5728

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Reconnaissance

                                                                                      Resource Development

                                                                                      Initial Access

                                                                                      Execution

                                                                                      Command and Scripting Interpreter

                                                                                      1
                                                                                      T1059

                                                                                      PowerShell

                                                                                      1
                                                                                      T1059.001

                                                                                      Scheduled Task/Job

                                                                                      1
                                                                                      T1053

                                                                                      Scheduled Task

                                                                                      1
                                                                                      T1053.005

                                                                                      Persistence

                                                                                      Boot or Logon Autostart Execution

                                                                                      1
                                                                                      T1547

                                                                                      Registry Run Keys / Startup Folder

                                                                                      1
                                                                                      T1547.001

                                                                                      Scheduled Task/Job

                                                                                      1
                                                                                      T1053

                                                                                      Scheduled Task

                                                                                      1
                                                                                      T1053.005

                                                                                      Privilege Escalation

                                                                                      Boot or Logon Autostart Execution

                                                                                      1
                                                                                      T1547

                                                                                      Registry Run Keys / Startup Folder

                                                                                      1
                                                                                      T1547.001

                                                                                      Scheduled Task/Job

                                                                                      1
                                                                                      T1053

                                                                                      Scheduled Task

                                                                                      1
                                                                                      T1053.005

                                                                                      Defense Evasion

                                                                                      Modify Registry

                                                                                      2
                                                                                      T1112

                                                                                      Subvert Trust Controls

                                                                                      1
                                                                                      T1553

                                                                                      Install Root Certificate

                                                                                      1
                                                                                      T1553.004

                                                                                      Virtualization/Sandbox Evasion

                                                                                      2
                                                                                      T1497

                                                                                      Credential Access

                                                                                      Credentials from Password Stores

                                                                                      1
                                                                                      T1555

                                                                                      Credentials from Web Browsers

                                                                                      1
                                                                                      T1555.003

                                                                                      Unsecured Credentials

                                                                                      4
                                                                                      T1552

                                                                                      Credentials In Files

                                                                                      4
                                                                                      T1552.001

                                                                                      Discovery

                                                                                      Process Discovery

                                                                                      1
                                                                                      T1057

                                                                                      Query Registry

                                                                                      7
                                                                                      T1012

                                                                                      System Information Discovery

                                                                                      5
                                                                                      T1082

                                                                                      System Location Discovery

                                                                                      1
                                                                                      T1614

                                                                                      System Language Discovery

                                                                                      1
                                                                                      T1614.001

                                                                                      Virtualization/Sandbox Evasion

                                                                                      2
                                                                                      T1497

                                                                                      Lateral Movement

                                                                                      Collection

                                                                                      Data from Local System

                                                                                      3
                                                                                      T1005

                                                                                      Command and Control

                                                                                      Exfiltration

                                                                                      Impact

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      7d418d8e-ba25-417e-acc0-8701d502efdc.tmp
                                                                                      • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\7d418d8e-ba25-417e-acc0-8701d502efdc.tmp
                                                                                      • Size 520B
                                                                                      • SHA256 db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      mozglue.dll
                                                                                      • Path C:\ProgramData\mozglue.dll
                                                                                      • Size 593KB
                                                                                      • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      nss3.dll
                                                                                      • Path C:\ProgramData\nss3.dll
                                                                                      • Size 2.0MB
                                                                                      • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      ko.ps1
                                                                                      • Path C:\Users\Admin\1000032042\ko.ps1
                                                                                      • Size 912B
                                                                                      • SHA256 ac8a8901a5dd0728c8626015e509a856c257b2a0e5405d41f7cc0563c7ed28a5
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      settings.dat
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad\settings.dat
                                                                                      • Size 40B
                                                                                      • SHA256 738b5c79528f2b3cf9bb7c27107ad94c08c621311efb372ba5232ce0f82fe4d8
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 48B
                                                                                      • SHA256 d6090de8f83edf4f71748d9e3e4158565d3d4ef7621f8614fcd267d9b11dd69c
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 408B
                                                                                      • SHA256 1ec126cb6972c773ff87fa20134980a71b3e2634ac23deef77229f550a64360e
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      messages.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\_locales\en_CA\messages.json
                                                                                      • Size 851B
                                                                                      • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      dasherSettingSchema.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\dasherSettingSchema.json
                                                                                      • Size 854B
                                                                                      • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      SCT Auditing Pending Reports
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\SCT Auditing Pending Reports
                                                                                      • Size 2B
                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
                                                                                      • Size 9KB
                                                                                      • SHA256 38708ec564d8f0d25bb04f88731edf2050ac296dc1cc77f639cc1eff843a516c
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
                                                                                      • Size 9KB
                                                                                      • SHA256 3e1b42431039fea39a4f692f3aca3dc43cfb20d3ceaac7f54678dc11ba8c4bd1
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Preferences~RFe586637.TMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences~RFe586637.TMP
                                                                                      • Size 1KB
                                                                                      • SHA256 675798f0351377aedc7fc5c3b5c50515d97921d4b527785acfdc375885196431
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                      • Size 72B
                                                                                      • SHA256 8cd9e713ddf8ea23cb7114b5a58c8e461dbb84ca30335b9bed2fbaa8612933a2
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      the-real-index~RFe58a0df.TMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a0df.TMP
                                                                                      • Size 72B
                                                                                      • SHA256 7b4c510e6018916fa7e8790750f5a6df87ab173c0d8567c96b034c64edd02409
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      000001.dbtmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Site Characteristics Database\000001.dbtmp
                                                                                      • Size 16B
                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      MANIFEST-000001
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Site Characteristics Database\MANIFEST-000001
                                                                                      • Size 41B
                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      32.png
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
                                                                                      • Size 1KB
                                                                                      • SHA256 91289705a496311822aa52d067f2a029025293f1c22779f3a8bc483e211ce1d8
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      48.png
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
                                                                                      • Size 2KB
                                                                                      • SHA256 102aeb88e02ce1cd5c91ce4ab3c5880be33b6a440ee7f24c9e38741e79b46273
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      64.png
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
                                                                                      • Size 3KB
                                                                                      • SHA256 dc78a4be5b92c40c32dbbd4bcc3c65057105db062c088fadcf835a5e161095a1
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      32.png
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
                                                                                      • Size 1KB
                                                                                      • SHA256 36670568a87c7b3cd1a4448ffe5bde9b6fd3d65b58e6dca38cc4ea2e9e8c11b3
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      48.png
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
                                                                                      • Size 2KB
                                                                                      • SHA256 fa58e3209e408e4f0d60a7ed330d6f62884ccf9b593e37cde03e7916c116dd1f
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      64.png
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
                                                                                      • Size 2KB
                                                                                      • SHA256 80c1e2f4d89d5266f82dc0295f232eda894812820c5c625a036adf980536e5a8
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      128.png
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Temp\scoped_dir5604_621478499\Icons\128.png
                                                                                      • Size 5KB
                                                                                      • SHA256 8a9434f0ede8c6edf65f8d5750852be574847a62a4534e1b6b372078463b6d04
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      data_0
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_0
                                                                                      • Size 8KB
                                                                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      data_1
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_1
                                                                                      • Size 264KB
                                                                                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      data_2
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_2
                                                                                      • Size 8KB
                                                                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      data_3
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_3
                                                                                      • Size 8KB
                                                                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State
                                                                                      • Size 116KB
                                                                                      • SHA256 f40d4a528651e51453c0d1806a2ef0ae221927f3782336b3b440e1a6c05d962b
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State
                                                                                      • Size 116KB
                                                                                      • SHA256 52dbb3fa7cc17d976103014d017cb7f668eaf88e924749e513d1a843fecbf04b
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Local State~RFe586627.TMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State~RFe586627.TMP
                                                                                      • Size 932B
                                                                                      • SHA256 cfee9cd2d525be9df34bb0d34a20ee5942cb89ae1f453a20132331d950035608
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      powershell.exe.log
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                      • Size 2KB
                                                                                      • SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      StartupProfileData-NonInteractive
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • Size 18KB
                                                                                      • SHA256 feb3f3d34d79b67309d5606815867aca53dbdaa2ddc0ab4b7ce402d0fd04808a
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      gold.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
                                                                                      • Size 314KB
                                                                                      • SHA256 d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      12dsvc.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
                                                                                      • Size 1006KB
                                                                                      • SHA256 799d10acbb0e2886c4d32c771964f4c2cb47f93c817cdc26a9acaefa3ba042cb
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Nework.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
                                                                                      • Size 416KB
                                                                                      • SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      13eac78bb9.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000034001\13eac78bb9.exe
                                                                                      • Size 1.8MB
                                                                                      • SHA256 b73c5385cfdddcf6d05fb95c7fae6dc567ae7dc5f33f6613032b4eaf9599e52f
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      stealc_default2.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                                                                      • Size 187KB
                                                                                      • SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      javumar2.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe
                                                                                      • Size 12.8MB
                                                                                      • SHA256 ea8f9e43b89dd8c9ecd7d5413fe82ca75e5acd0d99ea00b9841117361676df0a
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      javtestnoreport.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
                                                                                      • Size 989KB
                                                                                      • SHA256 8c3c459481bb940ad69a704a041516f42012775c60f288c731a394954e3eda3c
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      needmoney.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
                                                                                      • Size 4.1MB
                                                                                      • SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      penis.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
                                                                                      • Size 409KB
                                                                                      • SHA256 87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      crypted.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
                                                                                      • Size 314KB
                                                                                      • SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      LummaC222222.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
                                                                                      • Size 352KB
                                                                                      • SHA256 4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      newbundle2.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
                                                                                      • Size 304KB
                                                                                      • SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      rstxdhuj.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
                                                                                      • Size 963KB
                                                                                      • SHA256 0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      722aad513f.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000354001\722aad513f.exe
                                                                                      • Size 1.7MB
                                                                                      • SHA256 73af3e47903a40fa3af542f93cfc15f1c1063ee623ddc7a42453ef5212630fcf
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      0df1533442.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000355001\0df1533442.exe
                                                                                      • Size 1.8MB
                                                                                      • SHA256 030c6acd1111f6faa765abce0786582e86f4cc98b3880cf030d8cbd61730d004
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      lummetc.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
                                                                                      • Size 352KB
                                                                                      • SHA256 13167320a0e8266a56694be70a9560c83e2c645d6eeaa147b9ae585c2960ebb2
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      processclass.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
                                                                                      • Size 6KB
                                                                                      • SHA256 a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      splwow64.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
                                                                                      • Size 1.3MB
                                                                                      • SHA256 d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      PkContent.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000369001\PkContent.exe
                                                                                      • Size 810KB
                                                                                      • SHA256 b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      11ddf092-e196-4586-b982-606f1f9f0603.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\11ddf092-e196-4586-b982-606f1f9f0603.tmp
                                                                                      • Size 132KB
                                                                                      • SHA256 e59d727ad2f2ea2612506af5418a2ebf5974f16f7aaa9f7497bc92d75a451624
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      axplong.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                      • Size 1.8MB
                                                                                      • SHA256 08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Q
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\607698\Q
                                                                                      • Size 794KB
                                                                                      • SHA256 361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Thermal.pif
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
                                                                                      • Size 7KB
                                                                                      • SHA256 50d12b8e5a353b9565c6d059dac223c2b4ac5f8a57462db44a7dd814eaa3a254
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Tmp9F4D.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Tmp9F4D.tmp
                                                                                      • Size 2KB
                                                                                      • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      __PSScriptPolicyTest_lhzswfgx.tve.ps1
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhzswfgx.tve.ps1
                                                                                      • Size 60B
                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      javumar2.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-05R03.tmp\javumar2.tmp
                                                                                      • Size 3.2MB
                                                                                      • SHA256 37a2fe2fe9edf836698d72ba673bdcc648c09d75e7000be7fca7dda8b61f2be4
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      _isdecmp.dll
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-P746C.tmp\_isetup\_isdecmp.dll
                                                                                      • Size 28KB
                                                                                      • SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      messages.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5604_1324860419\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                      • Size 711B
                                                                                      • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      svchost015.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                      • Size 2.9MB
                                                                                      • SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      8jLZkDmSbR.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\8jLZkDmSbR.exe
                                                                                      • Size 490KB
                                                                                      • SHA256 8707c03158ba6395a11bdfd8c1b11eeedc2e052d3b55d73d0a5c64417e5fbd3b
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      76b53b3ec448f7ccdda2063b15d2bfc3_6f95b8b4-c02b-43c9-8cd4-016780936b63
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-656926755-4116854191-210765258-1000\76b53b3ec448f7ccdda2063b15d2bfc3_6f95b8b4-c02b-43c9-8cd4-016780936b63
                                                                                      • Size 2KB
                                                                                      • SHA256 2e8cf10f0a022c03abdb9eaeeb33ab1b276348f303ded68f5d7bbb1a6087fd49
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      76b53b3ec448f7ccdda2063b15d2bfc3_6f95b8b4-c02b-43c9-8cd4-016780936b63
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-656926755-4116854191-210765258-1000\76b53b3ec448f7ccdda2063b15d2bfc3_6f95b8b4-c02b-43c9-8cd4-016780936b63
                                                                                      • Size 2KB
                                                                                      • SHA256 ddfd740b9d7b70f85d6ebb9f4438914ff5b8533adf8a28e11c88635783aba922
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      Qk8pdtwZu1.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Qk8pdtwZu1.exe
                                                                                      • Size 304KB
                                                                                      • SHA256 5a00e3718afb5bfb18a6b1c824b680015733f0403af0d5663289a17ba8206cc3
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      Microsoft Edge.lnk
                                                                                      • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                      • Size 2KB
                                                                                      • SHA256 ddb193b9f536f198e49f2012af111b1ba550aed39335ef9fbde34c2fcc2768f8
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      Google Chrome.lnk
                                                                                      • Path C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                      • Size 2KB
                                                                                      • SHA256 7ee148ccfcbcc0df2996f45503cc8d379bf98441cb84ccf7f9a549d75b6c1e42
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      memory/408-340-0x0000000000400000-0x000000000081B000-memory.dmp
                                                                                      Download

                                                                                      memory/732-186-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-18-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-180-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-21-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-185-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-22-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-20-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-19-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-362-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/732-176-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/808-1740-0x0000000000DC0000-0x0000000001292000-memory.dmp
                                                                                      Download

                                                                                      memory/1128-711-0x00000000006A0000-0x00000000008E3000-memory.dmp
                                                                                      Download

                                                                                      memory/1128-189-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                      Download

                                                                                      memory/1128-175-0x00000000006A0000-0x00000000008E3000-memory.dmp
                                                                                      Download

                                                                                      memory/1348-110-0x0000000000630000-0x0000000000682000-memory.dmp
                                                                                      Download

                                                                                      memory/1560-42-0x0000000000B80000-0x0000000000BD4000-memory.dmp
                                                                                      Download

                                                                                      memory/1560-41-0x000000007301E000-0x000000007301F000-memory.dmp
                                                                                      Download

                                                                                      memory/1648-344-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                                      Download

                                                                                      memory/1768-1599-0x0000000000F80000-0x0000000001452000-memory.dmp
                                                                                      Download

                                                                                      memory/1768-1584-0x0000000000F80000-0x0000000001452000-memory.dmp
                                                                                      Download

                                                                                      memory/1880-15-0x00000000004F0000-0x00000000009BA000-memory.dmp
                                                                                      Download

                                                                                      memory/1880-4-0x00000000004F0000-0x00000000009BA000-memory.dmp
                                                                                      Download

                                                                                      memory/1880-3-0x00000000004F0000-0x00000000009BA000-memory.dmp
                                                                                      Download

                                                                                      memory/1880-2-0x00000000004F1000-0x000000000051F000-memory.dmp
                                                                                      Download

                                                                                      memory/1880-1-0x0000000077404000-0x0000000077406000-memory.dmp
                                                                                      Download

                                                                                      memory/1880-0-0x00000000004F0000-0x00000000009BA000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-487-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-468-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-1543-0x00000000062D0000-0x0000000006338000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-1544-0x0000000006380000-0x00000000063CC000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-1548-0x00000000063D0000-0x0000000006424000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-493-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-505-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-471-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-473-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-476-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-477-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-479-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-481-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-483-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-485-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-489-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-491-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-495-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-497-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-499-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-501-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-503-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-507-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-469-0x0000000005B30000-0x0000000005C18000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-467-0x0000000005B30000-0x0000000005C1E000-memory.dmp
                                                                                      Download

                                                                                      memory/1884-466-0x0000000000ED0000-0x0000000000FC8000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-228-0x0000000009400000-0x0000000009450000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-89-0x0000000008960000-0x0000000008A6A000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-44-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-46-0x0000000005870000-0x0000000005E14000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-47-0x0000000005200000-0x0000000005292000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-48-0x00000000052E0000-0x00000000052EA000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-80-0x00000000060A0000-0x0000000006116000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-81-0x0000000006750000-0x000000000676E000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-86-0x00000000070E0000-0x00000000076F8000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-96-0x0000000006FE0000-0x0000000006FF2000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-108-0x0000000007040000-0x000000000707C000-memory.dmp
                                                                                      Download

                                                                                      memory/1996-109-0x0000000007080000-0x00000000070CC000-memory.dmp
                                                                                      Download

                                                                                      memory/2040-385-0x0000000000D40000-0x0000000000E1C000-memory.dmp
                                                                                      Download

                                                                                      memory/2040-223-0x0000000000D40000-0x0000000000E1C000-memory.dmp
                                                                                      Download

                                                                                      memory/2320-342-0x0000000000EE0000-0x0000000000F34000-memory.dmp
                                                                                      Download

                                                                                      memory/2668-315-0x00000000005C0000-0x000000000062C000-memory.dmp
                                                                                      Download

                                                                                      memory/2860-128-0x0000000000E60000-0x0000000000EE0000-memory.dmp
                                                                                      Download

                                                                                      memory/2860-179-0x0000000009090000-0x00000000090F6000-memory.dmp
                                                                                      Download

                                                                                      memory/2860-181-0x000000000A450000-0x000000000A612000-memory.dmp
                                                                                      Download

                                                                                      memory/2860-182-0x000000000AB50000-0x000000000B07C000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1616-0x0000000002740000-0x0000000002776000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1664-0x0000000007240000-0x00000000072E3000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1666-0x0000000007360000-0x000000000737A000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1667-0x00000000073D0000-0x00000000073DA000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1668-0x00000000075E0000-0x0000000007676000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1671-0x0000000007560000-0x0000000007571000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1672-0x0000000007590000-0x000000000759E000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1639-0x0000000006020000-0x000000000603E000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1673-0x00000000075A0000-0x00000000075B4000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1674-0x00000000076A0000-0x00000000076BA000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1629-0x0000000005CA0000-0x0000000005FF4000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1628-0x0000000005970000-0x00000000059D6000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1675-0x0000000007680000-0x0000000007688000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1618-0x00000000058A0000-0x00000000058C2000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1617-0x0000000005130000-0x0000000005758000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1665-0x00000000079A0000-0x000000000801A000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1663-0x00000000065E0000-0x00000000065FE000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1653-0x000000006C6D0000-0x000000006C71C000-memory.dmp
                                                                                      Download

                                                                                      memory/3124-1652-0x0000000007200000-0x0000000007232000-memory.dmp
                                                                                      Download

                                                                                      memory/3932-415-0x0000000000BE0000-0x0000000000F23000-memory.dmp
                                                                                      Download

                                                                                      memory/4512-1801-0x00000000002A0000-0x0000000000939000-memory.dmp
                                                                                      Download

                                                                                      memory/4512-1804-0x00000000002A0000-0x0000000000939000-memory.dmp
                                                                                      Download

                                                                                      memory/4588-335-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                      Download

                                                                                      memory/4588-1869-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                      Download

                                                                                      memory/4588-339-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                      Download

                                                                                      memory/4588-338-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                      Download

                                                                                      memory/4608-1783-0x0000000000E50000-0x00000000014E9000-memory.dmp
                                                                                      Download

                                                                                      memory/4608-1780-0x0000000000E50000-0x00000000014E9000-memory.dmp
                                                                                      Download

                                                                                      memory/4620-2738-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/4620-2741-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/4728-426-0x0000000000B00000-0x0000000000B52000-memory.dmp
                                                                                      Download

                                                                                      memory/5404-1692-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/5404-1738-0x00000000004E0000-0x00000000009AA000-memory.dmp
                                                                                      Download

                                                                                      memory/5508-1779-0x0000000000DC0000-0x0000000001292000-memory.dmp
                                                                                      Download

                                                                                      memory/5508-1600-0x0000000000DC0000-0x0000000001292000-memory.dmp
                                                                                      Download

                                                                                      memory/5572-1830-0x0000000006DF0000-0x0000000006E12000-memory.dmp
                                                                                      Download

                                                                                      memory/5572-1820-0x00000000055F0000-0x0000000005944000-memory.dmp
                                                                                      Download

                                                                                      memory/5628-1650-0x0000000000770000-0x0000000000778000-memory.dmp
                                                                                      Download

                                                                                      memory/5660-1766-0x0000000000330000-0x00000000009C9000-memory.dmp
                                                                                      Download

                                                                                      memory/5660-1567-0x0000000000330000-0x00000000009C9000-memory.dmp
                                                                                      Download

                                                                                      memory/5660-1741-0x0000000000330000-0x00000000009C9000-memory.dmp
                                                                                      Download

                                                                                      memory/5728-2739-0x0000000000DC0000-0x0000000001292000-memory.dmp
                                                                                      Download

                                                                                      memory/5728-2743-0x0000000000DC0000-0x0000000001292000-memory.dmp
                                                                                      Download

                                                                                      memory/5752-1552-0x0000000004B40000-0x0000000004BDC000-memory.dmp
                                                                                      Download

                                                                                      memory/5752-1551-0x0000000000360000-0x000000000038E000-memory.dmp
                                                                                      Download

                                                                                      memory/5844-1974-0x00000000056F0000-0x0000000005A44000-memory.dmp
                                                                                      Download

                                                                                      memory/5980-1727-0x000000006C6D0000-0x000000006C71C000-memory.dmp
                                                                                      Download

                                                                                      memory/5980-1742-0x0000000006FE0000-0x0000000006FF1000-memory.dmp
                                                                                      Download

                                                                                      memory/5980-1743-0x0000000007160000-0x0000000007174000-memory.dmp
                                                                                      Download

                                                                                      memory/6056-2575-0x0000000000F60000-0x0000000001416000-memory.dmp
                                                                                      Download

                                                                                      memory/6056-2571-0x0000000000F60000-0x0000000001416000-memory.dmp
                                                                                      Download

                                                                                      memory/6972-2670-0x0000000000B20000-0x0000000000B38000-memory.dmp
                                                                                      Download