amadey | bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
Size 1.8MB
Sample240929-bzbebaxerg
SHA256 bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f
MD5 4fb2d57ca858e8992808938bb23eef46
SHA1 14559e576016904d880b7c950a31c0c3945b3d19
SHA512 5f63f350133f4fcfe983fb8432f331fd5e7f4431fa3689eae9008a7d966208d4ffdd2b1152cd016623c33291c90a031c8947e04ae9419558b13a8c0ba6454340
SSDEEP 24576:aTVlLgIkhGeCxydsPxWdXpdO2kzq22vvWMCgrHOZ62GqXQ79HVFMQyddhMr3nAR+:glA0edsZkC2WMnQ6dpH0JDqr3cGlS6d
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

136.244.88.135:17615

Extracted

Family

redline

Botnet

@OLEH_PSP

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

http://91.202.233.158

Attributes

url_path
/e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29862

Extracted

Family

redline

Botnet

newbundle2

185.215.113.67:15206

Extracted

Family

xworm

Version

188.190.10.161:4444

Mutex

TSXTkO0pNBdN2KNw

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

save

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1048-1505-0x0000000000400000-0x000000000042E000-memory.dmp	family_xworm

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral2/memory/1220-43-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral2/memory/1004-109-0x0000000000070000-0x00000000000C2000-memory.dmp	family_redline
behavioral2/files/0x000700000002345b-107.dat	family_redline
behavioral2/memory/2024-338-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral2/files/0x000700000002348b-367.dat	family_redline
behavioral2/memory/1120-381-0x0000000000A20000-0x0000000000A72000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3444 created 3412	3444	rstxdhuj.exe	56
PID 7056 created 3412	7056	Waters.pif	56
PID 7056 created 3412	7056	Waters.pif	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e31b1570cf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8370b66f80.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b8c467be0c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e124b2872f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3340	powershell.exe
5684	powershell.exe
3100	powershell.exe
5624	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b8c467be0c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e31b1570cf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e124b2872f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e31b1570cf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8370b66f80.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b8c467be0c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8370b66f80.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e124b2872f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Nework.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Hkbsse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	e124b2872f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	splwow64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	processclass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	context.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	javumarfirst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost015.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Waters.pif
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	12dsvc.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe

Executes dropped EXE 34 IoCs

pid	Process
2944	axplong.exe
3240	gold.exe
4648	12dsvc.exe
4212	LScJFFnKeJ.exe
1004	AfCJz1bM5e.exe
4888	Nework.exe
2248	Hkbsse.exe
4992	stealc_default2.exe
740	needmoney.exe
4460	penis.exe
1016	svchost015.exe
4308	javumarfirst.exe
4380	crypted.exe
1120	newbundle2.exe
3444	rstxdhuj.exe
5912	e31b1570cf.exe
5500	Hkbsse.exe
4144	axplong.exe
2148	e124b2872f.exe
4556	skotes.exe
1060	lummetc.exe
3968	processclass.exe
5996	8370b66f80.exe
3124	splwow64.exe
1508	b8c467be0c.exe
3268	2.exe
3744	context.exe
6300	service123.exe
7056	Waters.pif
2940	Waters.pif
2988	skotes.exe
5184	axplong.exe
3268	Hkbsse.exe
6632	service123.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	e31b1570cf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	e124b2872f.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	b8c467be0c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	8370b66f80.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	axplong.exe

Loads dropped DLL 6 IoCs

pid	Process
4992	stealc_default2.exe
4992	stealc_default2.exe
6300	service123.exe
1016	svchost015.exe
1016	svchost015.exe
6632	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe"	rstxdhuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e31b1570cf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\e31b1570cf.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e124b2872f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\e124b2872f.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8370b66f80.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\8370b66f80.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b8c467be0c.exe = "C:\\Users\\Admin\\1000026002\\b8c467be0c.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
95	api64.ipify.org
98	ipinfo.io
99	ipinfo.io
94	api64.ipify.org

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
6980	tasklist.exe
5832	tasklist.exe
6480	tasklist.exe
6648	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
3256	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
2944	axplong.exe
5912	e31b1570cf.exe
4144	axplong.exe
2148	e124b2872f.exe
4556	skotes.exe
5996	8370b66f80.exe
1508	b8c467be0c.exe
2988	skotes.exe
5184	axplong.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3240 set thread context of 1220	3240	gold.exe	86
PID 740 set thread context of 1016	740	needmoney.exe	105
PID 4380 set thread context of 2024	4380	crypted.exe	109
PID 3444 set thread context of 1048	3444	rstxdhuj.exe	113
PID 3268 set thread context of 6116	3268	2.exe	138

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64.exe
File opened for modification	C:\Windows\HardlyAircraft	context.exe
File opened for modification	C:\Windows\BrandonBlind	context.exe
File opened for modification	C:\Windows\IpaqArthur	context.exe
File created	C:\Windows\Tasks\skotes.job	e124b2872f.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64.exe
File opened for modification	C:\Windows\ViewpictureKingdom	context.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e124b2872f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12dsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LScJFFnKeJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lummetc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8370b66f80.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javumarfirst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	penis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8c467be0c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AfCJz1bM5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rstxdhuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e31b1570cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javumarfirst.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javumarfirst.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost015.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost015.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2524	timeout.exe
2220	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5472	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133720473276355532"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6796	schtasks.exe
6404	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1048	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3256	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
3256	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
2944	axplong.exe
2944	axplong.exe
4992	stealc_default2.exe
4992	stealc_default2.exe
4212	LScJFFnKeJ.exe
1220	RegAsm.exe
1220	RegAsm.exe
1220	RegAsm.exe
1220	RegAsm.exe
1220	RegAsm.exe
4992	stealc_default2.exe
4992	stealc_default2.exe
1004	AfCJz1bM5e.exe
1004	AfCJz1bM5e.exe
1004	AfCJz1bM5e.exe
1004	AfCJz1bM5e.exe
1004	AfCJz1bM5e.exe
1004	AfCJz1bM5e.exe
3444	rstxdhuj.exe
3444	rstxdhuj.exe
2024	RegAsm.exe
2024	RegAsm.exe
2024	RegAsm.exe
2024	RegAsm.exe
2024	RegAsm.exe
2024	RegAsm.exe
5912	e31b1570cf.exe
5912	e31b1570cf.exe
1120	newbundle2.exe
1120	newbundle2.exe
1120	newbundle2.exe
1120	newbundle2.exe
4144	axplong.exe
4144	axplong.exe
3100	powershell.exe
3100	powershell.exe
3100	powershell.exe
2148	e124b2872f.exe
2148	e124b2872f.exe
4556	skotes.exe
4556	skotes.exe
5624	powershell.exe
5624	powershell.exe
5624	powershell.exe
1120	newbundle2.exe
1120	newbundle2.exe
1048	InstallUtil.exe
1048	InstallUtil.exe
5996	8370b66f80.exe
5996	8370b66f80.exe
1508	b8c467be0c.exe
1508	b8c467be0c.exe
3340	powershell.exe
3340	powershell.exe
3340	powershell.exe
5684	powershell.exe
5684	powershell.exe
5684	powershell.exe
5468	chrome.exe
5468	chrome.exe
2856	chrome.exe
2856	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
2856	chrome.exe
2856	chrome.exe
5468	chrome.exe
2856	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	LScJFFnKeJ.exe
Token: SeBackupPrivilege	4212	LScJFFnKeJ.exe
Token: SeSecurityPrivilege	4212	LScJFFnKeJ.exe
Token: SeSecurityPrivilege	4212	LScJFFnKeJ.exe
Token: SeSecurityPrivilege	4212	LScJFFnKeJ.exe
Token: SeSecurityPrivilege	4212	LScJFFnKeJ.exe
Token: SeDebugPrivilege	1220	RegAsm.exe
Token: SeDebugPrivilege	4460	penis.exe
Token: SeBackupPrivilege	4460	penis.exe
Token: SeSecurityPrivilege	4460	penis.exe
Token: SeSecurityPrivilege	4460	penis.exe
Token: SeSecurityPrivilege	4460	penis.exe
Token: SeSecurityPrivilege	4460	penis.exe
Token: SeDebugPrivilege	1004	AfCJz1bM5e.exe
Token: SeDebugPrivilege	3444	rstxdhuj.exe
Token: SeDebugPrivilege	3444	rstxdhuj.exe
Token: SeDebugPrivilege	2024	RegAsm.exe
Token: SeDebugPrivilege	1048	InstallUtil.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	1120	newbundle2.exe
Token: SeDebugPrivilege	1048	InstallUtil.exe
Token: SeBackupPrivilege	4460	penis.exe
Token: SeSecurityPrivilege	4460	penis.exe
Token: SeSecurityPrivilege	4460	penis.exe
Token: SeSecurityPrivilege	4460	penis.exe
Token: SeSecurityPrivilege	4460	penis.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	5684	powershell.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeDebugPrivilege	3968	processclass.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5468	chrome.exe
5468	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
7056	Waters.pif
7056	Waters.pif
7056	Waters.pif
2940	Waters.pif
2940	Waters.pif
2940	Waters.pif

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
7056	Waters.pif
7056	Waters.pif
7056	Waters.pif
2940	Waters.pif
2940	Waters.pif
2940	Waters.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1048	InstallUtil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 2944	3256	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe	82
PID 3256 wrote to memory of 2944	3256	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe	82
PID 3256 wrote to memory of 2944	3256	bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe	82
PID 2944 wrote to memory of 3240	2944	axplong.exe	83
PID 2944 wrote to memory of 3240	2944	axplong.exe	83
PID 2944 wrote to memory of 3240	2944	axplong.exe	83
PID 3240 wrote to memory of 4988	3240	gold.exe	85
PID 3240 wrote to memory of 4988	3240	gold.exe	85
PID 3240 wrote to memory of 4988	3240	gold.exe	85
PID 3240 wrote to memory of 1220	3240	gold.exe	86
PID 3240 wrote to memory of 1220	3240	gold.exe	86
PID 3240 wrote to memory of 1220	3240	gold.exe	86
PID 3240 wrote to memory of 1220	3240	gold.exe	86
PID 3240 wrote to memory of 1220	3240	gold.exe	86
PID 3240 wrote to memory of 1220	3240	gold.exe	86
PID 3240 wrote to memory of 1220	3240	gold.exe	86
PID 3240 wrote to memory of 1220	3240	gold.exe	86
PID 2944 wrote to memory of 4648	2944	axplong.exe	87
PID 2944 wrote to memory of 4648	2944	axplong.exe	87
PID 2944 wrote to memory of 4648	2944	axplong.exe	87
PID 4648 wrote to memory of 4212	4648	12dsvc.exe	88
PID 4648 wrote to memory of 4212	4648	12dsvc.exe	88
PID 4648 wrote to memory of 4212	4648	12dsvc.exe	88
PID 4648 wrote to memory of 1004	4648	12dsvc.exe	90
PID 4648 wrote to memory of 1004	4648	12dsvc.exe	90
PID 4648 wrote to memory of 1004	4648	12dsvc.exe	90
PID 2944 wrote to memory of 4888	2944	axplong.exe	92
PID 2944 wrote to memory of 4888	2944	axplong.exe	92
PID 2944 wrote to memory of 4888	2944	axplong.exe	92
PID 4888 wrote to memory of 2248	4888	Nework.exe	93
PID 4888 wrote to memory of 2248	4888	Nework.exe	93
PID 4888 wrote to memory of 2248	4888	Nework.exe	93
PID 2944 wrote to memory of 4992	2944	axplong.exe	94
PID 2944 wrote to memory of 4992	2944	axplong.exe	94
PID 2944 wrote to memory of 4992	2944	axplong.exe	94
PID 2944 wrote to memory of 740	2944	axplong.exe	100
PID 2944 wrote to memory of 740	2944	axplong.exe	100
PID 2944 wrote to memory of 740	2944	axplong.exe	100
PID 2944 wrote to memory of 4460	2944	axplong.exe	103
PID 2944 wrote to memory of 4460	2944	axplong.exe	103
PID 2944 wrote to memory of 4460	2944	axplong.exe	103
PID 740 wrote to memory of 1016	740	needmoney.exe	105
PID 740 wrote to memory of 1016	740	needmoney.exe	105
PID 740 wrote to memory of 1016	740	needmoney.exe	105
PID 740 wrote to memory of 1016	740	needmoney.exe	105
PID 740 wrote to memory of 1016	740	needmoney.exe	105
PID 740 wrote to memory of 1016	740	needmoney.exe	105
PID 740 wrote to memory of 1016	740	needmoney.exe	105
PID 740 wrote to memory of 1016	740	needmoney.exe	105
PID 2248 wrote to memory of 4308	2248	Hkbsse.exe	106
PID 2248 wrote to memory of 4308	2248	Hkbsse.exe	106
PID 2248 wrote to memory of 4308	2248	Hkbsse.exe	106
PID 2944 wrote to memory of 4380	2944	axplong.exe	107
PID 2944 wrote to memory of 4380	2944	axplong.exe	107
PID 2944 wrote to memory of 4380	2944	axplong.exe	107
PID 4380 wrote to memory of 2024	4380	crypted.exe	109
PID 4380 wrote to memory of 2024	4380	crypted.exe	109
PID 4380 wrote to memory of 2024	4380	crypted.exe	109
PID 4380 wrote to memory of 2024	4380	crypted.exe	109
PID 4380 wrote to memory of 2024	4380	crypted.exe	109
PID 4380 wrote to memory of 2024	4380	crypted.exe	109
PID 4380 wrote to memory of 2024	4380	crypted.exe	109
PID 4380 wrote to memory of 2024	4380	crypted.exe	109
PID 2944 wrote to memory of 1120	2944	axplong.exe	111

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3412
- C:\Users\Admin\AppData\Local\Temp\bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe
  "C:\Users\Admin\AppData\Local\Temp\bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
      "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:4988
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Users\Admin\AppData\Roaming\LScJFFnKeJ.exe
        
        "C:\Users\Admin\AppData\Roaming\LScJFFnKeJ.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4212
    - - C:\Users\Admin\AppData\Roaming\AfCJz1bM5e.exe
        
        "C:\Users\Admin\AppData\Roaming\AfCJz1bM5e.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\1000072001\javumarfirst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000072001\javumarfirst.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
      "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:1016
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\svchost015.exe" & del "C:\ProgramData\*.dll"" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
      "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
      "C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\1000354001\e31b1570cf.exe
      "C:\Users\Admin\AppData\Local\Temp\1000354001\e31b1570cf.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\1000355001\e124b2872f.exe
      "C:\Users\Admin\AppData\Local\Temp\1000355001\e124b2872f.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\1000023001\8370b66f80.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000023001\8370b66f80.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5996
      - C:\Users\Admin\1000026002\b8c467be0c.exe
        
        "C:\Users\Admin\1000026002\b8c467be0c.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1508
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000032042\ko.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CustomProfile --no-first-run --no-default-browser-check --disable-infobars
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5468
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff88ec4cc40,0x7ff88ec4cc4c,0x7ff88ec4cc58
        8⤵
        
        PID:2228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
        8⤵
        
        PID:3100
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=2112,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
        8⤵
        
        PID:3156
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=2144,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
        8⤵
        
        PID:5512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
        8⤵
        
        PID:5440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
        8⤵
        
        PID:5472
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4052,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
        8⤵
        
        PID:3872
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4248,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
        8⤵
        
        PID:5308
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4868,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
        8⤵
        
        PID:5536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4944,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
        8⤵
        
        PID:4940
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5204,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
        8⤵
        
        PID:2240
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3224,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
        8⤵
        
        PID:6352
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3332,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
        8⤵
        
        PID:5712
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3408,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
        8⤵
        
        PID:6088
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3384,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
        8⤵
        
        PID:5728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3708,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:8
        8⤵
        
        PID:5572
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5788,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
        8⤵
        
        PID:6800
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4772,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
        8⤵
        
        PID:6836
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5180,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
        8⤵
        
        PID:6796
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3280,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
        8⤵
        
        PID:5296
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3912,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
        8⤵
        
        PID:6652
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3040,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
        8⤵
        
        PID:6096
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5896,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
        8⤵
        
        PID:2912
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5464,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
        8⤵
        
        PID:7008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5300,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:2
        8⤵
        
        PID:6836
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=3388,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
        8⤵
        
        PID:6296
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4468,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
        8⤵
        
        PID:6808
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4516,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:8
        8⤵
        
        PID:6488
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=5348,i,7637845265736737595,8461823164238000098,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
        8⤵
        
        PID:3368
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --disable-infobars --no-first-run --no-default-browser-check --disable-session-crashed-bubble
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2856
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff88ec4cc40,0x7ff88ec4cc4c,0x7ff88ec4cc58
        8⤵
        
        PID:3812
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2320,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2316 /prefetch:2
        8⤵
        
        PID:3248
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1808,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2472 /prefetch:3
        8⤵
        
        PID:5780
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1584,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2528 /prefetch:8
        8⤵
        
        PID:1864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3156 /prefetch:1
        8⤵
        
        PID:5180
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3328 /prefetch:1
        8⤵
        
        PID:2436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3684,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4336 /prefetch:1
        8⤵
        
        PID:6552
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4612,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4656 /prefetch:8
        8⤵
        
        PID:7040
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4392,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4932 /prefetch:8
        8⤵
        
        PID:7096
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3752,i,768485350882970918,9999521974924923966,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4932 /prefetch:3
        8⤵
        
        PID:6464
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000033142\so.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5684
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CustomProfile --no-first-run --no-default-browser-check --disable-infobars
        7⤵
        
        PID:760
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xe8,0x10c,0x7ff88ec4cc40,0x7ff88ec4cc4c,0x7ff88ec4cc58
        8⤵
        
        PID:2876
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --disable-infobars --no-first-run --no-default-browser-check --disable-session-crashed-bubble
        7⤵
        
        PID:6428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff88ec4cc40,0x7ff88ec4cc4c,0x7ff88ec4cc58
        8⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        6⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
      "C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
      "C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3968
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start context.exe
        5⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2940
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:3124
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:6480
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:6648
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3932
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MaskBathroomCompositionInjection" Participants
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6924
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "Waters.pif"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:5472
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2524
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\1000373001\2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000373001\2.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3268
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6404
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:6360

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5500

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4144

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5184

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7160

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2988

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5184

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3268

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BAKJKFHC

Path C:\ProgramData\BAKJKFHC
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

FHCGCAAK

Path C:\ProgramData\FHCGCAAK
Size 114KB
SHA256 02f65483e90802c728726ce1d16f2b405158f666c36e2c63090e27877ae4e309
MD5 e228c51c082ab10d054c3ddc12f0d34c
SHA1 79b5574c9ce43d2195dcbfaf32015f473dfa4d2e
SHA512 233ca5e06591e1646edfadb84a31bdfc12632fb73c47240a2109020accfbd1e337371bcc3340eae7a1f04140bbdeb0b416ce2de00fa85671671bb5f6c04aa822
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cdqLVumf:I02m/lxhlnmhouH0Vumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

HJKECAAAFHJECAAAEBFC

Path C:\ProgramData\HJKECAAAFHJECAAAEBFC
Size 11KB
SHA256 55102bab99be74acbc42be728f0ba64e4c253d6e037a37e07c9e4b59f561d80e
MD5 f8ca24431008b2c56e2ce4c9acb20de2
SHA1 d0ef7bbc494de93b9d52982f3d8583ce2de77a41
SHA512 66b5181e7df3a2ffd73aa365b19a25af85c8846cf16e8f0d8b9174936c01936244ae5c895c7d40723eb49dd69485d2fbf10bf6b5bd1276f7b7185a82832033f0
SSDEEP 192:C5nxRjfijypGLf8tv1R1zcdjrf+tPDnjXl60eaXT84rYGBw8V6:kqLmv1AxrUPDnYY8cwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ko.ps1

Path C:\Users\Admin\1000032042\ko.ps1
Size 1KB
SHA256 30e153d5b22adf171901c59cda1cfc39aeaac521f10af17811be4c96314330ab
MD5 50d96e43e42b57edffe0c51170a8e741
SHA1 452579060a428c0ab725398a625a70aa18b2f8fa
SHA512 da6daa9a146d1bb4cf09c0cc00f0337196c9aac99b756521cdfb98607707a80bf86d50062a93e8ef753212a9e66a7edadc6c1b92871003a76fcce51215f91237
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 697823dc080aa64a46e109bd59afd675270f81dd04fbb5478819f1fcb468af06
MD5 b870c56c0f7b79daea142d4de0e41dcc
SHA1 3f429e1c540680465d03677f3e00dc2eac9d0f4a
SHA512 2cb9b1cf4ce41b286fb2f41e506cb20c991acc6b40e7660fa7202fd0addaf0c815c75739eb38d4959fbefed0f30b46977117f248bc4741a74d032833cda8633c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 875b42b2104e9f11c2ba1317411bd8e690aa4d500e98279dc89c6e262febf91c
MD5 c58be5a16e832b3c8e1f2419183403a7
SHA1 99928477d8f5c7334918a23ce2b45d694bd7e42e
SHA512 1f75c2d0d00edc8a0da4723a5784419496614219ec439a3dd4bc2a1c02b9ed7e6fdbf5b45b98035e2c06c400eb91d67260d4e6404435a49e0f3eb7484fb4b6ea
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ae6e80327a802f13b21a919eac764e867bb8964f2c8cdc716a76f58ba90bb397
MD5 9ff29f2bb73bda9e5533956366a97441
SHA1 cb5975c23231fcb480acd054b56b5dc38c57e9cc
SHA512 4dd4985e4e01a65daba792c6d3c8d2f16f2f75f181ab27a555dba92f5d35102256d1b7392e26abad97f0662ee4980cd9155d1ad0f9c43b10eabe8b8d733e805b
SSDEEP 192:5HHwu5XU9AeiFlHV+F+OET5Vkwu+Po6yIsnVdg4:5HQklGnEHO+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 b81fba5a7ec2a32e3656bdb4ad631b7adb48c109587ec11ddc3ef51f3f064032
MD5 119278e410cf2b0225bf21e6064847a3
SHA1 55465dd6f645974471fac55e15a7d2bbf05823af
SHA512 beb744b269ec74666934e72f15f71f7d5f0e865b548d248db96fc5af8342116523c6210773f95a75ffc43b1d4919b8e6bce23e2754d2121ecba5a4d41daf5240
SSDEEP 192:5HHwu5XU90eiFlHV+F+OEw5VkwU+Po6yIsnVdg4:5HQwlGnEi0+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8ddb89c803869ee5e3cb97a8c217b06e013b889ac8155bcc789660145df630da
MD5 c563c66b757ec85f4b5d95a704dd0ec3
SHA1 e119678adb23db41f55a38ec4175a7273164ab02
SHA512 34795867b80f44e58fd66d80fc73e3b02753aba6f1af4f8b8924641f8533f1f2630e5b4f9bf6681b286ccbf54f62b3d46b935a64461a6b1b0541e4f170ec6fc9
SSDEEP 192:5HHwu5XU90eiFlHV+F+OET5Vkwu+Po6yIsnVdg4:5HQQlGnEHO+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 59e02e96ab6b2a377667ab00f65f9ae49cfe6755679a0744a18d792f94c6d2a7
MD5 5eab027bb4cef8eb786f3d7d9ef887a9
SHA1 1555a2b774cf1d4a8227e609a2a9ccf70f315fe2
SHA512 4e95cc5b0cd22074598c380c65d0395b9ce3cf6e22fb1357e302b43d53bb04884524e8326b06d49b6bad50f23a29255f4a1307876cf4f0e36ad67f81a637adee
SSDEEP 192:5HHwu5XU9GseiFlHV+F+OE55VkwA+Po6yIsnVdg4:5HQeAlGnEBg+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 a2a3d907fbe49bd67e9700ceb3fb10d4bfa26754aed53015e1e7f00a74088991
MD5 028ef5987ccef92488b6b24008f0bb19
SHA1 09ef65676532c4bed8037d0da7b879585a8b3b77
SHA512 b3f55925b9f6c4184f14cf373315d6f2228e323e9523758abd2327aee9a223c4326ecc463cb36f31000f94abf61104dd73cd144eb0e6467e1d5768cbd999e4d2
SSDEEP 384:emmP7pLhLc+e2vXJp1kXqKf/pUZNCgVLH2HfSWnrUF4HGaGqOUH:ehP7pLhLnt/Jp1kXqKf/pUZNCgVLH2HP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 212KB
SHA256 43d0524bf436e977878e635aaf491e471bba323d2b9991fc02d238f7274247c8
MD5 509e7d3afb2c9b31ee00e9c449612937
SHA1 d6792361d0f187c1db578b3a8c3d65062919c66a
SHA512 f7d9bd85c6fb5640f4a0149f597c807e40db9496820f773be495b843b269d9bb53edd27e57231e6d9b651a749beeb462e6808faf27171c29a37e398e055ef52b
SSDEEP 6144:dWuVcadLLgS+h3ZRh8uIur4ZlTFqgImLhs6Cl:UccaRP4ZRhXl8ZZFqgImLw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 212KB
SHA256 a0fc71997b60820ef9e4250316dac3b733ad1e5def5a01fd5093fbf07f1b5fdd
MD5 e8a33f6fb9af92979332d5cdac484120
SHA1 a6104aebf278bfadae8adea9f2c138af3c48c2dd
SHA512 ab21b042a05cabb9b53e3d16907a2e730cae80769746908d43c7e7b2c866d009ffa78195ff61fe170148fc8e886a408a97c8d058dbc6554e91c85794d8f334ab
SSDEEP 6144:GWuVcadLLgS+h3ZRh8uIur4ZlTFqgImLhs6Cl:3ccaRP4ZRhXl8ZZFqgImLw
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 34c5428ab269f33daec54a675c7ebd0fc02599ee78e59abf74584ddeb48ce0c6
MD5 0c838cf962bb9b34c94ea52a69a12a28
SHA1 1d7a9400612ba70f5f1a59e3f3047300b27d6050
SHA512 9f95f99eac165eecc75f64d559e728cc88a143538002fcce05e3bd11b8c2122f91822e0e1040d0aa72ac9bf4a3d02084e93e2a934a2e2abc86b9b5c65b54002d
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5897a7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Code Cache\js\index-dir\the-real-index~RFe5897a7.TMP
Size 48B
SHA256 4bf4597aebe836697a466067c851b00d3aac84031dad03eb163195674ec7916a
MD5 3567ab78bba10c6b23c8885011272a11
SHA1 1a07c17ec1e313ea4064a8b02c8b5f2a00fe64d8
SHA512 4a6c6644981dcd25692ec26b20ea44583c5809ff300391af8335ef297f17196b14098eb0de24334461da739fdb6f46930867d06ed302c6cc0d96197b6e350ac6
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\Network Persistent State
Size 885B
SHA256 c52ef698d79ca5b7d31794673f90de9811ba14cd4f81abfdf595cdb6142bf4aa
MD5 25b7e583596bc7388c3a3d4a76fadc03
SHA1 fe824a211b087a4daad7d31ebb536232e2d4fbc5
SHA512 e56070da7d1cb28782a10a766bc584aede3fec23b606518bda83293833ad66e5d15d9fd2b7fbf48ae67b406801fc676137ffc4e4374c435e4cd71387dc1dfa32
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe5960b4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\Network Persistent State~RFe5960b4.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 7KB
SHA256 a5e25bedbc5fac2063abbeb07ecce15b4e8e739e843afad50b4f7ff05085f1b0
MD5 af7bf149f155f84d249ffadc50adab2e
SHA1 316818ac2f28154a0ddf1709c6bf5d7ea98ba488
SHA512 fd17bd4638e60e94f864503793fe4d64b86491fb501bfed63cdba968df38bee0f86f09710e07ba7d130e5e41ac41dba6039cbd79a4ec72d7776169eeb01c0285
SSDEEP 96:rWwuEuXfYCKRkkCPcGeY16ZOX7/x+6MhmuecVS2MoAy8yIsnVqAhgtpup:rWJEuQCxeGXV+FR0Po6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 7KB
SHA256 2d556b4b096e3dafdbd6303f1ca09e4c354e8c3d3d4f0ee761e58a89bf05e739
MD5 dde52043558a2c2650b0dfc0b09adf4f
SHA1 b691a28d9baf5156209583678c41e19af9111077
SHA512 f03cc4d95d63afe037291de39d900b3c7559b32371fcda989195d6accc57758bf6abd9ce1afd915c8b0aa34f611a319e3d66b1c7e2dc21e04bc440a798a2254b
SSDEEP 96:rWwuEuXfYCKRkkC1cGeY16ZOX7/x+6MhmuecVpX2MoAy8yIsnVqAhgtpup:rWJEuQCbeGXV+FRXPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 7KB
SHA256 8c4f8418b0b3dc3e2efed6d10a5fb8bb16fc91e41af89060f04ba30e0f3c896c
MD5 bcb260860f83fd997afa56f378edad50
SHA1 8a3afbd34ac01680809abf451ade1c2dfa9ac5ca
SHA512 aedded8547574c1082a9c633ffb99aa3b7dbdf4e8ff66bd941da9cc4782c236cc67b7c5b8d9f329dc4ec442f5597bbbeece1dee0e73869ee6b64824a61f6ad6b
SSDEEP 96:rWwuEuXfYCKRkkCUcGeY16ZOX7/x+6MhmuecVPX2MoAy8yIsnVqAhgtpup:rWJEuQCCeGXV+FRpPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 7KB
SHA256 a61e8b4af76fa963d683c19449d583758d0af2daf5601dc5f000d2da7fb61796
MD5 d7010b1448b626799f45e33b407a356e
SHA1 ebdc3f0ee5858c152e877c25e094e65576805bbc
SHA512 b13f59fdae3adfa2d0485e6594a13048a0714277558257cd4c5ef5a7e7a06200596fce9a933d51998a207bde092bf37ece4da893bc0e766cf09b331bf8583750
SSDEEP 96:rWwuEuXfYCKRkkChcGeY16ZOX7/x+6MhmuecVPX2MoAy8yIsnVqAhgtpup:rWJEuQCHeGXV+FRpPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 7KB
SHA256 89e0eaff16f9ffbf462a8f47f4853544ab372b6c23d04450066c8de4a26179df
MD5 3009f958441ff962b5b35c4c33514a01
SHA1 791a509f0284a74ead55d21720ff36aee4c24733
SHA512 f4cc45deab8c49b0a803bb58a93c9fb2307d7e79f31068be43eeca0a08a50bda0ea5fb94668d4f9284ce18104e017d4401f018a569c68efedd9d200189795e90
SSDEEP 96:rWwuEuXfYCKRkkCmcGeY16ZOX7/x+6MhmuecVpX2MoAy8yIsnVqAhgtpup:rWJEuQC4eGXV+FRXPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe5894aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences~RFe5894aa.TMP
Size 6KB
SHA256 e5bc2b7ee17bd39e22b17dba05ac8db41021dde4eecfec922b7816dc96cde6a1
MD5 1e2f41361b916c23b7a263e864736ac6
SHA1 485a410337f63cc81b00f926cc548ae19751988d
SHA512 5697795f62d8cbeadf24f6da865017e7f6ce88f2965b385bb31be54c57f0538d845eb4ed1ee3e6c5041cabd19fffee0d67a36eb4a5a0e8ad5266715695a19650
SSDEEP 96:rWwuEdkCxcYdeY16ZOX7/x+6MhmuecVS2MoAy8yIsnVqAhgtp:rWJEBeGXV+FR0Po6yIsnVdgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Secure Preferences
Size 13KB
SHA256 9db93024ba8f28946a6d6ddf0abbc13a7eae7255e6586a7e8d97ae5b3a92853c
MD5 ca18e34f1d7f9ae048b00dc063cf37e6
SHA1 b5f345cc05d6cf338f7e3ac756422e4ad6bf1523
SHA512 47d23fc899e01aa9efcf2f835137f8f852ae9d25fdcad49ed395219ebe79369f35ae18814163f12c49ef2eee07c029054e8862a9263592180c03cffe2c4540e6
SSDEEP 384:9pz+7pLuLcGQlIXC01kXqKf/pUZNCgVLH2HfSFgrUUyqOUsQG:9d+7pLuLLQyC01kXqKf/pUZNCgVLH2Hi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe589ad4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Secure Preferences~RFe589ad4.TMP
Size 10KB
SHA256 44c7d094bf39561961935fcd6613d0f1c18c34c43655212fa21c655153be0c10
MD5 6ea4c9c600abf1afbc29a8c28200261a
SHA1 2fdb1665cd994cdb6294d16462c0f1e39aebddae
SHA512 d9d5f381a42701d97197e5d2fc5ce79e97c520661f0b99dee5b9b33cd8079817e3978cb877da5fc55092386d32084a8d60ccd30f8fa3b0cb2a120463589d3921
SSDEEP 192:9p4m/IXzm01kXqK4I40pUZNCgVLHrKHfF8FgrUXQXMHUyqOAMUO+KHt:9prIXC01kXqKf/pUZNCgVLH2HfSFgrU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 09517698e5370be4830365471858b1fbc2d1caded7a64a065f722ddae84a1434
MD5 0338979f5c6a50672ab134cef2bafd13
SHA1 0b07d26e1b2bef3ab10d5b606220af6a01dd2bf6
SHA512 7c83cef9e9ebd50ee3cb4f6cb23a8302b11b67fcf7b9cb1e3ed707b42a3b1258c9e7b4fbb200b0dc008b01f17c4436f8cbec77687ea0b5733583ad0cb80b8136
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58c52f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c52f.TMP
Size 72B
SHA256 da76785c0d69f200c8c65f04b39b6cfc873efa5a2629c33fb3e9ca5de4459f37
MD5 62b87105c56d1e8bdb712281d39e8ee4
SHA1 fa44597f91aaef9fac54d2f67cc14fabb41c49b5
SHA512 998acf1a0910754effd4a685f1bcd6af230e397a6a9d447e532d2816db0a17b55f7602bc0f9f3acab40f0a3eca2e35c347af3155ac7a21c445cccab68f70937e
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 91289705a496311822aa52d067f2a029025293f1c22779f3a8bc483e211ce1d8
MD5 40c4ea664da063cccf37a00d0dea5f88
SHA1 f524c4c8544d5e8b7d5a29ba74fbe865c0fa303b
SHA512 bbe182958560fa196423bc1b50575b078e4a3b2b170427074442a42a3f21ae7d91d3115e75f38335c778070142d2d1bc929bfa22bf0fb2ae644c0478f6d58d51
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 102aeb88e02ce1cd5c91ce4ab3c5880be33b6a440ee7f24c9e38741e79b46273
MD5 9e1a6c45e7a5b26e6dfcb060fe4ec411
SHA1 8895839baaf4a6ce1189fd8c5572c3c8298ddcc0
SHA512 323180dbdb0ebed3f398d5e7233f681ec85bd0815ef463d8351e17e99ee6f9f47badc9bdd9ab197249fe85e2c0d2457760f7bb7550c9c55110f333d13bfbe8fb
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 dc78a4be5b92c40c32dbbd4bcc3c65057105db062c088fadcf835a5e161095a1
MD5 65e00211feede352e87ff869cd3d1b1e
SHA1 2ede8e165651f24a165f31bd2b4591d124d5fdde
SHA512 1fec808d0591868de3e27863e095ded619cfb825239eb05aab61f9ddb09bca28534e5a1a6f0d39a47affb7a3371d07cca9701b8dabcd297ff2fd116c9123fe61
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 890B
SHA256 280a7fc31d9ba2169f4d0801c7c52bb970061c17c7b4a7959a07e8313c055df0
MD5 e21251a768b30062a5cd8e0b01e512bc
SHA1 3fc0c1af7c6783f743021a145016023ee73a69bf
SHA512 f6104bcce1f2613b5f6baacd354fa6dfe448273b79e5579c7c93ab703e953e49711459bd6ef3d10ee449d9d69c4bf6bca62ac9d6e864670f4503a618425f389a
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 fe6cef43018dd0cf284366ab4c5bc75039274374a3654b58197bfe5ebb3dcc46
MD5 67e185e7131868c3af81ee10251a3205
SHA1 3f52bcd8f6dd96a2613d4e0023a6ca87f54d2bde
SHA512 d155a9e9ad4c0e85c97bc3ec8432213b3637cece3dafa8338662055c0c593e3ce10405b5adccfc92ee6da96d01f7cbf29623bff6204653f7960a84bc782aecb2
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 f5eb403a4afbb48114e67cb9eb55ae136b86a2c8644167d53006848c8efba562
MD5 ffd2836b1dfc3a7f5c24dcc4845f3b3a
SHA1 16b4d188780f05e0845014fb45ad6ebaa6b4d2b8
SHA512 810acdc6d1462416572b79b6e16cca23988a4bccb886db303b1dc1487d4a1abf36f94dbcf7fea7a22ae9892a3f9ebf98516ff2dfbbe424d82c735382f34adbde
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State
Size 118KB
SHA256 fc0e224d60f35edc100ed2f397cd1ba92c9ee0b9e704fa9b825dbe001ecf8c1b
MD5 18109d206109f93915b4b05062eb2434
SHA1 72ef9d9b15963cdcd0262b3ddbadd61198cbc966
SHA512 5d6928eb587af291f04cc12d7c30201f2ed642f4e34bb0d65a18c0a0010551688c79e5a01829035ab4cbdefc81b7d1d6a3af8e5d8141d5c998bbc9ecd960abd6
SSDEEP 3072:LSalRW/NDwandjDWYBLgtfcC/9hbTZR1Bd8uIFJ2:mauVcadLLgS+h3ZRh8uI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State
Size 118KB
SHA256 fb77a5330cd06f733141b96b29cca41d1481e5ac54a7d55df45a4f1938ca847e
MD5 06677fbad697b894e0ea9c0c558ca78d
SHA1 f3d2fcb1727bf210842214aee0432d18e49b397f
SHA512 cee94adc1aa40607b1a8bd7f66cc55dc5ccb00a77cd9d019975ca4d8195a0ffb3a0f7e38782168d23e878dfcc93ce2ea267e1ec61b849c3695d26f828b4a00ee
SSDEEP 3072:L4/lRW/NDwandjDWYBLgtfcC/9hbTZR1Bd8uIFJ2:0/uVcadLLgS+h3ZRh8uI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State
Size 117KB
SHA256 3696ff4cb146d4a0ff85302a41a87262a1a6ac625934673692564e70d842765d
MD5 0a45f004305a33daaa9951bf070324ca
SHA1 08d77812472842abdaaf3e20d45d6b6f6d1840b5
SHA512 60e83e2911d4203ee619b64c4afd63a37b68d7c4d549ef961134a0be81b9b23cb442f23cc1d0bd221c7a87313043babb367ebda5d4a0e7f66f0bfb51c81c29ea
SSDEEP 3072:LNlRW/NDwandjDWYBLgtfcC/9hbTZR1Bd8uIFJ2:ZuVcadLLgS+h3ZRh8uI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State
Size 117KB
SHA256 458f9005cc9d4159a1813ab9e14dd7c17b88ab83ff0d1861bb0a103fd1337789
MD5 f784e44df9f5cab66dd26b01d3fd10e1
SHA1 38fb5a094bd9afe9003b6cfdd1f33a2f95bf729a
SHA512 97fd7f104d3468aea801e25dd89e50bc98ed5ab62f5190995a828b23a4e72606f07d4abd0afee74583e9e8321c5278f7b13ac29448471ee4f41a202c9ad4f8ec
SSDEEP 3072:8NlRW/NDwandjDWYBLgtfcC/9hbTZR1Bd8uIFJ2:auVcadLLgS+h3ZRh8uI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe586c51.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State~RFe586c51.TMP
Size 922B
SHA256 a3246b3c874dbafd9fa49ad7cd24d0d30b5d5a115575add6bcda32cb75c8cd90
MD5 f038b8ef1c33f05fd7fb7a99ec60ddd7
SHA1 6b7c35a6848a9eefa17b5f2377b876bc51d87e92
SHA512 1dec84b094d458ed1fb4102f37ec2f2b8be2085b0a8bdea67a663a1f60015b004be05af79d8d90a6f27622805cd741cc0c916e16d362ef36a3738bb4e2bc5780
MD5 SHA1 SHA512

Submit Download

RegAsm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Size 2KB
SHA256 2bc71ddd63acfb9d101892e29033c75b4023727e1cadc489ecb2421c1960eaa8
MD5 e34b053c93dcb4160094249280888117
SHA1 bd7cd93042c200c5fb012bccf3cd9f72d7e79cef
SHA512 f8753ec3f9f413e1fac84caa1905509a978dfc63211dcd0a889a4283840ae2e6e9101e1f7ee7d582acc5e0ae722fdab8f6047aa02cee28869a094b4f494897f2
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c889707089357d9fc419911d985c03874dbe5d1dd1214a7d0454b9d5f91b83e8
MD5 2bf0182253ccf298adf7743f7407887c
SHA1 4f92857c21e32250b590d8c1dd97aa6821dca22f
SHA512 6d1e6c9fb20c1cd72d6a7f94e7e19fbd51527b7a02099f4e8df6e525ab9558c6021b592e9d621d4cd2ba0b5d2e49e0d5d6b3e6cb571591bb592054a5c93b2b08
SSDEEP 384:66+BY9i+5+MAgoN/T0yHYo9oJTVK6seYwME/F03SoZZfYSvojEDkSd0gdMtkKhD:nTw5TlNoJTVNfruSE52EDOCm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c7fecf8da1ced2b6d1580b9ecbcba65ba2e76cbac82016427fa035a77e505110
MD5 3a124df85594b2acbd3a66350eeeef67
SHA1 402d80603b4a6ef287662a2fe0f28137ce102e67
SHA512 baa9a36b32d5c39330c795a1b66b8b18d969e347bffaaabae69618bfd91d9934b3ff69fb82da4ce17cdee0879594520053f82b6ecaaaf95a2909d4ef2d79ee38
SSDEEP 384:7sf+Bh91evZ8SVrZASsFR1hvATYY19/GZcYEz+dIi9kpL+nUKVkki0SO1:gfSevZLRZ0bvATYAhYxdIi99UKiki0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

gold.exe

Path C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
Size 314KB
SHA256 d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3
MD5 f2d385ddbb2edafacd070f103f7f1576
SHA1 5ee6cb80bc943476067c148e5c16738b7b062029
SHA512 e6ee00d15483ef29fb7e48ed28833ce5059f7bfada96b92c350246f6032f85d318571950bf6d2ee557e417e87d24d90965aa1523782416792fa7eb7354266df5
SSDEEP 6144:8KNfu572RY1YNfnlxThJDfeDp7B9wNjudYHpHNHqQtb4qNp28Rrm:82Gt2RhNfz/u1B9wNSd0UQF4t8pm
MD5 SHA1 SHA512 SSDEEP

Submit Download

12dsvc.exe

Path C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
Size 1006KB
SHA256 799d10acbb0e2886c4d32c771964f4c2cb47f93c817cdc26a9acaefa3ba042cb
MD5 c005d4ffa3e28c22b41a9d222598260a
SHA1 57cc3a6540bc38c649ddfdd54fa4f3c8a2423677
SHA512 ce39903c46160deeee1c7b362000361a3f5a9243b2e180bbaafa5b8ab09cc09ca413ce32f4deb2074fa928110d25b3dae7465c849fc388a58ddf649a9caa3a68
SSDEEP 24576:WdZE+NmjQ5WymWeoSAj6YztpJF+6Xkb1rlNF:YZbAjQ5WZW2KNFNXmF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nework.exe

Path C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
Size 416KB
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
SSDEEP 12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealc_default2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
Size 187KB
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
SSDEEP 3072:QJlVTFj5qDao8KaxfE54HnnGSail+bOX8bX60UFHJKa:QJP5j5Ka2aOanGSabY860UFpKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

javumarfirst.exe

Path C:\Users\Admin\AppData\Local\Temp\1000072001\javumarfirst.exe
Size 9.5MB
SHA256 0fb82d8a8edd32ba4f80b129b228c9e74871f55f970b44c75af5aa4572b1b582
MD5 0603207308448ad82dc3d1fc17923ddb
SHA1 9c4f8f3e35d6404e22b50b7f1a0641a1b4195d94
SHA512 50595287ba90421dbb6fc612b69d2a2bffdad54ff79b04c50a05ea414af4e7deeb7101fb1b0638257cb28d3627ef8258e7cb039178b6d504d922774e91f95ba5
SSDEEP 49152:bDyQaXzVDlZO+jPtICKFgYvB+um+uWXHAEUk9Nd1aKXTjTgwpZp5m2GyP/UscElJ:iQQZDlBPtTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

needmoney.exe

Path C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
Size 4.1MB
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c
SSDEEP 98304:if7X0ZueTTPs6deIF+iHtcbBt2VSFjUCaZ:8bPeVdeIMiHmbeVS
MD5 SHA1 SHA512 SSDEEP

Submit Download

penis.exe

Path C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
Size 409KB
SHA256 87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
MD5 a21700718c70ec5e787ad373cb72a757
SHA1 027554ab5ff3245e7617f3b83d6548bf7919f92e
SHA512 ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b
SSDEEP 6144:hVPD7/k5hjsld/TWx3EY9lwXtaW1G4kM0u0b2KrqBDW:hVPHXM31SC4kVu0rGB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

crypted.exe

Path C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
Size 314KB
SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
MD5 ff5afed0a8b802d74af1c1422c720446
SHA1 7135acfa641a873cb0c4c37afc49266bfeec91d8
SHA512 11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac
SSDEEP 6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

newbundle2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
Size 304KB
SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
MD5 58e8b2eb19704c5a59350d4ff92e5ab6
SHA1 171fc96dda05e7d275ec42840746258217d9caf0
SHA512 e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
SSDEEP 3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rstxdhuj.exe

Path C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
Size 963KB
SHA256 0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
MD5 1ef39c8bc5799aa381fe093a1f2d532a
SHA1 57eabb02a7c43c9682988227dd470734cc75edb2
SHA512 13a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682
SSDEEP 24576:6MGVJ/Oap+Bh45LEwaV1QghDHm5GQTSmGg:6NJ/jpi5waVhjm5GQ2m7
MD5 SHA1 SHA512 SSDEEP

Submit Download

e31b1570cf.exe

Path C:\Users\Admin\AppData\Local\Temp\1000354001\e31b1570cf.exe
Size 1.7MB
SHA256 432129111f0cb21e66e21fa952f52294ccb131006a057fb866572fd424761365
MD5 a4d6bc751e412799af4ba121c3dea4d2
SHA1 e8c1ea99154555f4dbd36aca23077f07140f02e8
SHA512 45e2c86c48cae683a6db8aa979a594be77329f1b67ee3eb50415cd0dfb759e55674c971faa5f88b2dd6808e5496968d201f4292b1307ad8410cea1a6fbf24df7
SSDEEP 24576:UZLLQExSWktCilMytjUQqH6nTyHR3uNlfKuFa/PdKDaH3Y6kQc50Wmu+f:UZvqtT+panTytyfKuFa3dWAWmu
MD5 SHA1 SHA512 SSDEEP

Submit Download

e124b2872f.exe

Path C:\Users\Admin\AppData\Local\Temp\1000355001\e124b2872f.exe
Size 1.8MB
SHA256 e559b32ada8136d3ba5d2bd7ecac169d46b7f1bf94294455015f1addcd1cce6d
MD5 42e2475c56f9206da4d8579b1c58b17d
SHA1 bb5d9884275b0559951b1ad2b8dc07420937f961
SHA512 de5a5801e551a5e2a291f25eb73ddc54099261d5a5b38fb915ff0f8161b00abf2405a50daedc331f30b5b97d296e543ba25d9fc4e3e80f05f136cfd0d4cbea4e
SSDEEP 49152:BXMDJ+ImVWUvn1caonZYybyxzdiLtrcfLfUysTE4ZA:hM1+ImV51AgdiLt8UX1A
MD5 SHA1 SHA512 SSDEEP

Submit Download

lummetc.exe

Path C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
Size 352KB
SHA256 13167320a0e8266a56694be70a9560c83e2c645d6eeaa147b9ae585c2960ebb2
MD5 2fe92adf3fe6c95c045d07f3d2ecd2ed
SHA1 42d1d4b670b60ff3f27c3cc5b8134b67e9c4a138
SHA512 0af7b4a3ce3981707ca450b90829a4a8e933ea3cd3affbce738265a1a0647e96323117db325d0e5e3884f67f36b21b8c955b6c3c6dda21d9b01212e28ef88d65
SSDEEP 6144:hgyBZvU9zGoDa09h6Dp9LCFWmx7OeCZ3Uhj3lRnx:myBQKoDTP6F9Lw9kCjz
MD5 SHA1 SHA512 SSDEEP

Submit Download

processclass.exe

Path C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
Size 6KB
SHA256 a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6
MD5 c042782226565f89ce3954489075e516
SHA1 256dd5ba42837a33c7aa6cb71cef33d5617117ee
SHA512 9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd
SSDEEP 96:KR0JUnFk9YV0Y9btrzxSC6+1lcBrs4VvlrljlQ0ljhFEuxlSRjbumOLzNt:p396VLSN2GQEvlrljlQ0lj3lMHON
MD5 SHA1 SHA512 SSDEEP

Submit Download

splwow64.exe

Path C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
Size 1.3MB
SHA256 d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29
MD5 2b01c9b0c69f13da5ee7889a4b17c45e
SHA1 27f0c1ae0ddeddc9efac38bc473476b103fef043
SHA512 23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455
SSDEEP 24576:b9yEBs1ZKaxv6rRVO9VdLCjJehm4v2TeLUzguXpdQhgRQ7SoYafkW:bxqZK66rb4V0cxtQzv5dQhgRQ7SxID
MD5 SHA1 SHA512 SSDEEP

Submit Download

2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000373001\2.exe
Size 1.9MB
SHA256 b39525df56e9d5f26067add74133154b651ca91d4201302ce505444d00ac6693
MD5 731200ce89a30b22a5530838e57862f3
SHA1 0c86827c47e040d82869846c68bedb9d8afbcde0
SHA512 6c82f5949d05e3175e87d669447b90fec190b56b1317bcebbfb61fd52d434bf445e2d0c7b21eaa8de3859091a252128e3bf827943357cf6b10de36b071153a5d
SSDEEP 24576:amQnf57/NafVbxZe63ml3dpxzWwo5sryh5f9QfdiYratJbFJKdx2eZo1Ga7rjNk:FOTIdD29po5so5CfdiYrsbvKH2eta/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

axplong.exe

Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
Size 1.8MB
SHA256 bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f
MD5 4fb2d57ca858e8992808938bb23eef46
SHA1 14559e576016904d880b7c950a31c0c3945b3d19
SHA512 5f63f350133f4fcfe983fb8432f331fd5e7f4431fa3689eae9008a7d966208d4ffdd2b1152cd016623c33291c90a031c8947e04ae9419558b13a8c0ba6454340
SSDEEP 24576:aTVlLgIkhGeCxydsPxWdXpdO2kzq22vvWMCgrHOZ62GqXQ79HVFMQyddhMr3nAR+:glA0edsZkC2WMnQ6dpH0JDqr3cGlS6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\607698\Q
Size 794KB
SHA256 361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4
MD5 7b5632dcd418bcbae2a9009dbaf85f37
SHA1 32aaf06166854718f0bcbb2f7173c2732cfb4d33
SHA512 c834e90ccf2d35529c294319b8e9a49db7a7d67d0567e0739131d5af51170db32076d68147dc101f8047a75cb5b2275b25a9c8346a99a146a6798b9764316838
SSDEEP 12288:LtQJu7osksZQ7FuV65iFeG1bdMpX+rLvW6hwpos+s5E/RjyGF3tgO85c1XLwaMBO:LtOHrFuhF31iWB4zuNtIuXLuY9v1Pd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7fa5fd8a-55ce-4f9b-be7d-aa9df71915fa.tmp

Path C:\Users\Admin\AppData\Local\Temp\7fa5fd8a-55ce-4f9b-be7d-aa9df71915fa.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Emotions

Path C:\Users\Admin\AppData\Local\Temp\Emotions
Size 19KB
SHA256 2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4
MD5 b98d78c3abe777a5474a60e970a674ad
SHA1 079e438485e46aff758e2dff4356fdd2c7575d78
SHA512 6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d
SSDEEP 384:vLaGlKPODYuBO3zViP3suELSs/APtOSFaOMJJj0xJUb+OeFB2l5UWiSiSK:vLaVWYn3isuELD/OtOHTCOcBS59isK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tmp9710.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9710.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_a4gdwtft.3bo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4gdwtft.3bo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

f90b8088-c511-42e6-8317-504cf31370d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5468_364091538\f90b8088-c511-42e6-8317-504cf31370d7.tmp
Size 132KB
SHA256 e59d727ad2f2ea2612506af5418a2ebf5974f16f7aaa9f7497bc92d75a451624
MD5 e2d2f826a2253da9da88faea320734db
SHA1 17b24a01c01485399600196b6aa68456f070942f
SHA512 ad0686dab396d77cbf6a39628aca8a712793257232eaf43e4cd27a27b32a7411fd2755bcbd92d3a9a7acf32b0e7974ac65fbc5b28615d91f48558acac7af767d
SSDEEP 3072:UkRVM2UmpEnnqpVaA7OtL8JsHWrq9p8y9VF2mcNG6NQBqB0hUVkFCPznHQiCg8Cm:TRVpvKMVuL8GIq9uy9S7G6NvmPFCjHKh
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost015.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
Size 2.9MB
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
SSDEEP 49152:/INqIwJA7BYAzLOhHpB63X4oQaM35DhnSYf7bPZcYsO5+th1:wNqC7BZEHSQz5DhnSy7ujL
MD5 SHA1 SHA512 SSDEEP

Submit Download

AfCJz1bM5e.exe

Path C:\Users\Admin\AppData\Roaming\AfCJz1bM5e.exe
Size 304KB
SHA256 5a00e3718afb5bfb18a6b1c824b680015733f0403af0d5663289a17ba8206cc3
MD5 65c058e4a90d2ec70b03211d768b6ecc
SHA1 bf5af6f650759e5e612d42d72145660056737164
SHA512 3d9114409f8096ce8a1d134a48235fbbad0c6c53f820707a951bac42c4f7ba6a38e98a50c9d929f049042263a7c0e24da8368d3aa4e934f5da79e9bda4a930aa
SSDEEP 3072:Vq6EgY6iYrUjxQMbwPP9ktwT9N3TAVtYSK6VcZqf7D34teqiOLibBOc:cqY6i/wPCKN3TAbYgVcZqf7DIXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

LScJFFnKeJ.exe

Path C:\Users\Admin\AppData\Roaming\LScJFFnKeJ.exe
Size 490KB
SHA256 8707c03158ba6395a11bdfd8c1b11eeedc2e052d3b55d73d0a5c64417e5fbd3b
MD5 b473c40205c61dc4750bc49f779908dd
SHA1 88a0fc0962099f0ac2d827d2c4d691ed9cade251
SHA512 8fbaaa5bde30fe7c6e31a349c14e3bd710e92c4dbcca8cbdbaf34583887bc31e07e10a0223fc6c6c0d091787c296eba139ec91af44ec4ee6abbfb611493951d1
SSDEEP 6144:ChhuRs6j+uinO16pSuHugxyyyuf7CQHKCt/qXiZDo3xOxAAFQXNDHrg49/2CXfG:kuRR8YmpHug/7bXtiyZAcaAFyNR9Oqf
MD5 SHA1 SHA512 SSDEEP

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_acd03e19-89e2-40d7-b0f4-25b8a05635ee

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\76b53b3ec448f7ccdda2063b15d2bfc3_acd03e19-89e2-40d7-b0f4-25b8a05635ee
Size 2KB
SHA256 3398eea774596b625921446faebecbf6253f59dba59110f42288b693ce6c19f5
MD5 e1b57ae5139bd746cfe121005a34b9e7
SHA1 564caa2f274375003a1ce3698246272319611b5e
SHA512 68476565952726e1f58f62a9a7c7d49e788fe548f6d24a521652424c4edac94dad87f510bc93fa914f8a386541d2720107cf0cd6ff53fa640a384dab8baf49f9
MD5 SHA1 SHA512

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_acd03e19-89e2-40d7-b0f4-25b8a05635ee

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\76b53b3ec448f7ccdda2063b15d2bfc3_acd03e19-89e2-40d7-b0f4-25b8a05635ee
Size 2KB
SHA256 a857db441d8c231b6e4a4cc64d20295d0f4c9597ec8a469de86f9807c981f446
MD5 056b5fafce03cb67902a4720b552c633
SHA1 ed76df1f9560730ae42727b740ec5f4ed99c67e4
SHA512 e05752916b998112882d86b165b7ec347cf12d970d2900b4e1d48bd41c6375e8c9348e5b3d28b2267ee4978b4dfacf8f606b9f33acc45f7ef290a1fa69982001
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 616b1abe263f001ba7bf38ab4551954a582a11447ae3202bb34cd54fefcf8a41
MD5 433b80c1e71ce547923af4abf81d67da
SHA1 4949f8a32ff682f34b713acf58ef3a2aeabdaa4d
SHA512 c168527abe1123511fb862526b00df4a0a13fb580b3ad10fff77c56695e7b2ad1d24262b56ff9f9481901ba5915658d111e926e916214fdd8ebf1b6a65aeccc1
MD5 SHA1 SHA512

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 4bbb981784c9099b17d876f4379df91b1147b004753adcd3e186769e8ed9595f
MD5 34d22ac1786b0312a985379542ce15d0
SHA1 bfaa0d95f071ae8ae8b9f9e4619de406b9625f62
SHA512 4dc333ba85750529f3d7f862a5781eb658dd53a57806a0557d2e2991e3bb28766d4c54d418015403cd76d3b62fd0099216998cb4550c307342174f6de8d5c8de
MD5 SHA1 SHA512

Submit Download

memory/740-301-0x0000000000400000-0x000000000081B000-memory.dmp

Download

memory/1004-109-0x0000000000070000-0x00000000000C2000-memory.dmp

Download

memory/1016-296-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1016-300-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1016-2728-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1016-299-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1048-1506-0x0000000004E80000-0x0000000004F1C000-memory.dmp

Download

memory/1048-1505-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1120-381-0x0000000000A20000-0x0000000000A72000-memory.dmp

Download

memory/1220-95-0x0000000007610000-0x000000000764C000-memory.dmp

Download

memory/1220-80-0x0000000006D20000-0x0000000006D3E000-memory.dmp

Download

memory/1220-85-0x00000000076B0000-0x0000000007CC8000-memory.dmp

Download

memory/1220-87-0x00000000075B0000-0x00000000075C2000-memory.dmp

Download

memory/1220-72-0x0000000006560000-0x00000000065D6000-memory.dmp

Download

memory/1220-47-0x0000000005890000-0x000000000589A000-memory.dmp

Download

memory/1220-218-0x0000000007390000-0x00000000073E0000-memory.dmp

Download

memory/1220-86-0x0000000008F30000-0x000000000903A000-memory.dmp

Download

memory/1220-45-0x0000000005E30000-0x00000000063D4000-memory.dmp

Download

memory/1220-108-0x0000000007650000-0x000000000769C000-memory.dmp

Download

memory/1220-46-0x00000000057C0000-0x0000000005852000-memory.dmp

Download

memory/1220-43-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1508-1910-0x0000000000160000-0x00000000007F7000-memory.dmp

Download

memory/1508-2740-0x0000000000160000-0x00000000007F7000-memory.dmp

Download

memory/1508-1733-0x0000000000160000-0x00000000007F7000-memory.dmp

Download

memory/2024-338-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/2148-1565-0x0000000000AA0000-0x0000000000F5F000-memory.dmp

Download

memory/2148-1596-0x0000000000AA0000-0x0000000000F5F000-memory.dmp

Download

memory/2944-227-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/2944-159-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/2944-21-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/2944-20-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/2944-19-0x00000000001E1000-0x000000000020F000-memory.dmp

Download

memory/2944-18-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/2944-176-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/2944-209-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/2944-361-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/2988-2799-0x00000000002E0000-0x000000000079F000-memory.dmp

Download

memory/2988-2804-0x00000000002E0000-0x000000000079F000-memory.dmp

Download

memory/3100-1533-0x00000000027A0000-0x00000000027D6000-memory.dmp

Download

memory/3100-1547-0x0000000005D30000-0x0000000006084000-memory.dmp

Download

memory/3100-1583-0x0000000007630000-0x00000000076C6000-memory.dmp

Download

memory/3100-1613-0x00000000075E0000-0x00000000075EE000-memory.dmp

Download

memory/3100-1614-0x00000000075F0000-0x0000000007604000-memory.dmp

Download

memory/3100-1615-0x00000000076F0000-0x000000000770A000-memory.dmp

Download

memory/3100-1616-0x00000000076D0000-0x00000000076D8000-memory.dmp

Download

memory/3100-1582-0x0000000007420000-0x000000000742A000-memory.dmp

Download

memory/3100-1579-0x00000000079F0000-0x000000000806A000-memory.dmp

Download

memory/3100-1580-0x00000000073B0000-0x00000000073CA000-memory.dmp

Download

memory/3100-1566-0x0000000006650000-0x0000000006682000-memory.dmp

Download

memory/3100-1577-0x0000000006630000-0x000000000664E000-memory.dmp

Download

memory/3100-1578-0x0000000007250000-0x00000000072F3000-memory.dmp

Download

memory/3100-1567-0x000000006C930000-0x000000006C97C000-memory.dmp

Download

memory/3100-1548-0x00000000060A0000-0x00000000060BE000-memory.dmp

Download

memory/3100-1592-0x00000000075B0000-0x00000000075C1000-memory.dmp

Download

memory/3100-1546-0x00000000059B0000-0x0000000005A16000-memory.dmp

Download

memory/3100-1541-0x0000000005910000-0x0000000005932000-memory.dmp

Download

memory/3100-1535-0x0000000005250000-0x0000000005878000-memory.dmp

Download

memory/3240-41-0x0000000000580000-0x00000000005D4000-memory.dmp

Download

memory/3240-40-0x000000007327E000-0x000000007327F000-memory.dmp

Download

memory/3256-0-0x0000000000A60000-0x0000000000F0D000-memory.dmp

Download

memory/3256-17-0x0000000000A60000-0x0000000000F0D000-memory.dmp

Download

memory/3256-4-0x0000000000A60000-0x0000000000F0D000-memory.dmp

Download

memory/3256-3-0x0000000000A60000-0x0000000000F0D000-memory.dmp

Download

memory/3256-2-0x0000000000A61000-0x0000000000A8F000-memory.dmp

Download

memory/3256-1-0x0000000077664000-0x0000000077666000-memory.dmp

Download

memory/3268-1770-0x0000000000310000-0x00000000004F4000-memory.dmp

Download

memory/3340-1752-0x0000000005BD0000-0x0000000005F24000-memory.dmp

Download

memory/3340-1782-0x0000000006780000-0x00000000067A2000-memory.dmp

Download

memory/3444-460-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-1497-0x00000000055F0000-0x0000000005658000-memory.dmp

Download

memory/3444-421-0x0000000000800000-0x00000000008F8000-memory.dmp

Download

memory/3444-428-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-432-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-466-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-430-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-422-0x0000000005440000-0x000000000552E000-memory.dmp

Download

memory/3444-1502-0x00000000056F0000-0x0000000005744000-memory.dmp

Download

memory/3444-464-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-434-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-458-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-440-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-442-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-456-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-462-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-1498-0x00000000056A0000-0x00000000056EC000-memory.dmp

Download

memory/3444-444-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-446-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-436-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-450-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-448-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-454-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-453-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-438-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-426-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-424-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3444-423-0x0000000005440000-0x0000000005528000-memory.dmp

Download

memory/3968-1643-0x0000000000A00000-0x0000000000A08000-memory.dmp

Download

memory/4144-1531-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/4144-1534-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/4212-111-0x0000000000E50000-0x0000000000ED0000-memory.dmp

Download

memory/4212-179-0x0000000008A20000-0x0000000008A86000-memory.dmp

Download

memory/4212-180-0x000000000A1B0000-0x000000000A372000-memory.dmp

Download

memory/4212-181-0x000000000A8B0000-0x000000000ADDC000-memory.dmp

Download

memory/4380-336-0x0000000000FD0000-0x0000000001024000-memory.dmp

Download

memory/4460-293-0x0000000000A30000-0x0000000000A9C000-memory.dmp

Download

memory/4556-1735-0x00000000002E0000-0x000000000079F000-memory.dmp

Download

memory/4556-1597-0x00000000002E0000-0x000000000079F000-memory.dmp

Download

memory/4992-182-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4992-317-0x00000000006E0000-0x0000000000923000-memory.dmp

Download

memory/4992-175-0x00000000006E0000-0x0000000000923000-memory.dmp

Download

memory/5184-2800-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/5184-2806-0x00000000001E0000-0x000000000068D000-memory.dmp

Download

memory/5624-1649-0x000000006C930000-0x000000006C97C000-memory.dmp

Download

memory/5624-1659-0x0000000007570000-0x0000000007613000-memory.dmp

Download

memory/5624-1660-0x0000000007850000-0x0000000007861000-memory.dmp

Download

memory/5624-1661-0x0000000007880000-0x0000000007894000-memory.dmp

Download

memory/5912-1526-0x0000000000920000-0x0000000000FB7000-memory.dmp

Download

memory/5912-2742-0x0000000000920000-0x0000000000FB7000-memory.dmp

Download

memory/5912-1687-0x0000000000920000-0x0000000000FB7000-memory.dmp

Download

memory/5996-2731-0x0000000000450000-0x0000000000AE7000-memory.dmp

Download

memory/5996-1697-0x0000000000450000-0x0000000000AE7000-memory.dmp

Download

memory/5996-1796-0x0000000000450000-0x0000000000AE7000-memory.dmp

Download