amadey | 50a84a2dd1d813612773f1f60aa8718f594c6938e8e9982e065e4413672def25

Resubmissions

04-10-2024 13:23

241004-qmrm4azgrc 10

04-10-2024 13:12

241004-qfzp5awbmk 10

Analysis

max time kernel
303s
max time network
310s
platform
windows10-1703_x64
resource
win10-20240404-it
resource tags

arch:x64arch:x86image:win10-20240404-itlocale:it-itos:windows10-1703-x64systemwindows
submitted
04-10-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xfer records serum keygen torrent.exe
Size

812.6MB
MD5

76b063d4e93b1a531aa8229fcd040fdc
SHA1

455dca4bca7bba9a58fe3da8a2009ffbfea9d564
SHA256

947044214ba2361dd254cc28914c493c503c8adf2168e49ac3d2a4c456e7ec1f
SHA512

677b60a35fc3d20473e7800bd7dd34916cea1400e6c6a04256eba12ac27bc2049e39c635bc835d12f866e9594188f262996bde6c9fe533131d5f1d0974f868ac
SSDEEP

393216:SjSaYvGcXONtlftAzaSPekmWfYErCqbNlHqu0mnCNlCKbxd/9e5L/Ua:SuNu9DlftudGju5nqnJAz

Score

10^/10

amadey lumma stealc vidar 9c9aa5 default default5_doz doma credential_access discovery evasion execution persistence spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

default5_doz

http://62.204.41.159

Attributes

url_path
/edd20096ecef326d.php

Extracted

Family

vidar

http://proxy.johnmccrea.com/

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

stealc

Botnet

default

http://46.8.231.109

Attributes

url_path
/c4754d4f680ead72.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

doma

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

lumma

https://clearancek.site/api

https://mobbipenju.store/api

https://eaglepawnoy.store/api

https://dissapoiznw.store/api

https://studennotediw.store/api

https://bathdoomgaz.store/api

https://spirittunek.store/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/2840-217-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2840-216-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2840-331-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	Confirmation.pif

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 320 created 572	320	ALF17ItoAx1HtWeujR75iYV8.exe	5

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	t6_uhlogzSrBEq37BCObfdmz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0dd4c092dc.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0dd4c092dc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0dd4c092dc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	t6_uhlogzSrBEq37BCObfdmz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	t6_uhlogzSrBEq37BCObfdmz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	Confirmation.pif

Drops startup file 64 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_989128862b38475ba650d8e362ea9dff.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk	QChuxpihTR0xsV5tFcIYYbfP.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ea18bacabfec4e6daaa0a8bdf1f84630.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e7015deb843e4aa5840eeb3f51ec8dcc.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_57bb13ab8ceb4c4b926f59dedc21b742.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d36a045efb9a4c85a89aa4f6d151cf58.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0991d202ed494226ab6e220b92173698.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3394afc5d5064ae0b8634433cfe316b3.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_43aa519f49a54879b697ea5ad8eb243d.lnk	eZlTLSyI1U1yTHHX7jxlvDkb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9ee12f57ee0d400a8702f5d3da2508f4.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3e835d6fb1ef45cda53e86a21cbec0da.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_95c21d4e24174e62ae90a679fefca3e3.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_115b6a6e854d40a1a11ab8052d04dcb3.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5f038894cb614cb198ae91f00d5210d4.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4c1ba5ef3bbd47469cad9a940391954c.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_08fad1fce009415d9bb581844beb8386.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_05eb6d1b62384b86ba5ae9fba65cec00.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_16f6c102649f464ab8cd92264c21613a.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ecefa7fc930d48988f6f2754f2099bca.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_fff83a4a453b448081e974c2e1f0ee84.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_2f96ab5e7efb47a9b85d79a9b15d246b.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_999353992efc45668ec284212faea698.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_957853c24142465693ed97e8fa8937b6.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_2244723454e54802a059f9fb8808e90c.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dc0246af5e3e4b6aa65b52d567a0d230.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4586a8a781a1489abcaf1932f60666a9.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0fc8713b20ba4cbc8f75aaeb8fd4a2aa.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3ad2cabe1cb24e28a0d36afc409a3c2e.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_17666a2d8a3c40c7b750103253427c50.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_757685aad74645eaa5e4eaa3cc6ec250.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a04c76f13d28485f9d362a5520271ffe.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_560facfd3f5a4432b5e027525fedc67f.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8ae393a4e466404b861bfd05ee3cfa03.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_057f4164fb28456cb0e879a6d3a22cb5.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4d459ecd28ff47ef958669f3e8ad0d62.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5ed64fe8af97443789c1d3668364d394.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c131f188c5f943e889eafe240ab08756.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_737b09329bc84284a98f8217a8895a0d.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_850705e745fe41efbdbae9d286cdc4ca.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_452ef1d3a2d148f287983a0a266e391a.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_267ce3ad8ac747038e54867eb087a808.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0c1fe77072bc431985410a57df67f3cd.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b776c8566e0a4a5a82bf1f95b469e102.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f0cea4d9330c4e0198a66a28192845ea.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_864c4dca230346be923255fc2b2a5a3b.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_49c763a2db804f0abfeaa50bbe4f0e43.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d86477cf44db4a14bc8c0dfae4efdb2b.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_aa3d3eac36c24cd6bdcffe7b6af8a360.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0c8f3f30b5244cd78d4a9e5a44d7dceb.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ca7d8d0891db4e59a923b8c1f919789e.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e5678e1923ff4417b691f607d6757f37.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_12934944958042bd9d2655b1e5b65899.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6fe34795d99b48a4b68d0bc6770dfe4f.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bd260393485c442bbd7ce5ab0feaa7fc.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8e6d9f50940c403c8c4faab7a4dbd28c.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9a3d343a1b084407816a04a373da0e27.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d42e49f1dbc048d2aa9eabea1fcf802e.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a89a74623d334f749c27db05fbb20fb2.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c1333b114df64b64a1ae465c773ce66a.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7ae90d9e90c6422f941b6ef079cac369.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_54b2c77581e2473aa296381b6bbad89e.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b2af94cef1f4494594cb9cd77e81b492.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_684e30c3a3384daf847ed9fc16a762eb.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ef85a28e87904ad1b8c237f7c71cb323.lnk	LKMService.exe

Executes dropped EXE 24 IoCs

pid	Process
4716	Confirmation.pif
5068	Confirmation.pif
3452	eZlTLSyI1U1yTHHX7jxlvDkb.exe
824	icWLwA8fbUrgBuqPXz8Knm3C.exe
4844	NnPoAFDdOAavVExhQU9pVBI8.exe
216	AdxAGfHlcbhPudPjREBjcZVa.exe
320	ALF17ItoAx1HtWeujR75iYV8.exe
2576	B4JdRzbsRG5GwFEYllm0Nx_K.exe
828	QChuxpihTR0xsV5tFcIYYbfP.exe
2168	t6_uhlogzSrBEq37BCObfdmz.exe
3100	wZDiGH0zvSPFoycipHvysKO6.exe
5096	ALF17ItoAx1HtWeujR75iYV8.exe
2672	NnPoAFDdOAavVExhQU9pVBI8.tmp
8	LKMService.exe
2192	gepardfixmp3_32.exe
3236	GoogleUpdater.exe
1104	skotes.exe
4244	AdminHIEHDHCFIJ.exe
3520	ef37c36b71.exe
1928	DBFIDGIIIJ.exe
4476	0dd4c092dc.exe
5300	hutopimmbtzg.exe
5996	num.exe
1436	skotes.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	t6_uhlogzSrBEq37BCObfdmz.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	0dd4c092dc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	skotes.exe

Loads dropped DLL 5 IoCs

pid	Process
2672	NnPoAFDdOAavVExhQU9pVBI8.tmp
920	MSBuild.exe
920	MSBuild.exe
2840	MSBuild.exe
2840	MSBuild.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\LKMService_87b08b7d65c64097a6fcc2d02a8b3dd0 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EdgeUpdater\\LKMService.exe"	eZlTLSyI1U1yTHHX7jxlvDkb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\LKMService_b994de67c96c4990bf19dfa8d18fdd86 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EdgeUpdater\\GoogleUpdater.exe"	LKMService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV6 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV6\\ExtreamFanV6.exe"	QChuxpihTR0xsV5tFcIYYbfP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\ef37c36b71.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000332001\\ef37c36b71.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\0dd4c092dc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000333001\\0dd4c092dc.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\num.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000336001\\num.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
42	iplogger.org
43	iplogger.org

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api64.ipify.org
5	api64.ipify.org
7	ipinfo.io
8	ipinfo.io
55	api.ipify.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5380	powercfg.exe
5372	powercfg.exe
5364	powercfg.exe
320	powercfg.exe
4116	powercfg.exe
784	powercfg.exe
1584	powercfg.exe
5388	powercfg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000900000001acfc-492.dat	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	Confirmation.pif
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Confirmation.pif
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Confirmation.pif
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Confirmation.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
224	tasklist.exe
3448	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2168	t6_uhlogzSrBEq37BCObfdmz.exe
1104	skotes.exe
4476	0dd4c092dc.exe
1436	skotes.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 5068	4716	Confirmation.pif	85
PID 824 set thread context of 920	824	icWLwA8fbUrgBuqPXz8Knm3C.exe	97
PID 2576 set thread context of 2840	2576	B4JdRzbsRG5GwFEYllm0Nx_K.exe	99
PID 3100 set thread context of 4772	3100	wZDiGH0zvSPFoycipHvysKO6.exe	105
PID 4244 set thread context of 4236	4244	AdminHIEHDHCFIJ.exe	122
PID 1928 set thread context of 3772	1928	DBFIDGIIIJ.exe	134
PID 5300 set thread context of 5396	5300	hutopimmbtzg.exe	172
PID 5300 set thread context of 5476	5300	hutopimmbtzg.exe	177

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AnaheimHostel	xfer records serum keygen torrent.exe
File opened for modification	C:\Windows\ClusterOccasions	xfer records serum keygen torrent.exe
File opened for modification	C:\Windows\ThrillerLocate	xfer records serum keygen torrent.exe
File opened for modification	C:\Windows\BoomStrictly	xfer records serum keygen torrent.exe
File created	C:\Windows\Tasks\skotes.job	t6_uhlogzSrBEq37BCObfdmz.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2516	sc.exe
5188	sc.exe
5228	sc.exe
5236	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2084	824	WerFault.exe
4140	2576	WerFault.exe
2764	3100	WerFault.exe
356	4244	WerFault.exe	121

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBFIDGIIIJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Confirmation.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wZDiGH0zvSPFoycipHvysKO6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gepardfixmp3_32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef37c36b71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NnPoAFDdOAavVExhQU9pVBI8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	num.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Confirmation.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NnPoAFDdOAavVExhQU9pVBI8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t6_uhlogzSrBEq37BCObfdmz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xfer records serum keygen torrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminHIEHDHCFIJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0dd4c092dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B4JdRzbsRG5GwFEYllm0Nx_K.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QChuxpihTR0xsV5tFcIYYbfP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LKMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eZlTLSyI1U1yTHHX7jxlvDkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icWLwA8fbUrgBuqPXz8Knm3C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5624	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4984	taskkill.exe
4040	taskkill.exe
3524	taskkill.exe
5052	taskkill.exe
2480	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133725222161714546"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3564	schtasks.exe
3172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
2840	MSBuild.exe
2840	MSBuild.exe
320	ALF17ItoAx1HtWeujR75iYV8.exe
320	ALF17ItoAx1HtWeujR75iYV8.exe
2168	t6_uhlogzSrBEq37BCObfdmz.exe
2168	t6_uhlogzSrBEq37BCObfdmz.exe
2672	NnPoAFDdOAavVExhQU9pVBI8.tmp
2672	NnPoAFDdOAavVExhQU9pVBI8.tmp
216	AdxAGfHlcbhPudPjREBjcZVa.exe
216	AdxAGfHlcbhPudPjREBjcZVa.exe
920	MSBuild.exe
920	MSBuild.exe
8	LKMService.exe
2840	MSBuild.exe
2840	MSBuild.exe
3236	GoogleUpdater.exe
8	LKMService.exe
828	QChuxpihTR0xsV5tFcIYYbfP.exe
828	QChuxpihTR0xsV5tFcIYYbfP.exe
3236	GoogleUpdater.exe
8	LKMService.exe
2840	MSBuild.exe
2840	MSBuild.exe
3236	GoogleUpdater.exe
8	LKMService.exe
920	MSBuild.exe
920	MSBuild.exe
8	LKMService.exe
3236	GoogleUpdater.exe
1104	skotes.exe
1104	skotes.exe
3236	GoogleUpdater.exe
3236	GoogleUpdater.exe
8	LKMService.exe
8	LKMService.exe
3236	GoogleUpdater.exe
8	LKMService.exe
8	LKMService.exe
3236	GoogleUpdater.exe
2840	MSBuild.exe
2840	MSBuild.exe
8	LKMService.exe
3236	GoogleUpdater.exe
8	LKMService.exe
3236	GoogleUpdater.exe
8	LKMService.exe
3236	GoogleUpdater.exe
2840	MSBuild.exe
2840	MSBuild.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
4176	chrome.exe
4176	chrome.exe
8	LKMService.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3520	ef37c36b71.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	224	tasklist.exe
Token: SeDebugPrivilege	3448	tasklist.exe
Token: SeDebugPrivilege	320	ALF17ItoAx1HtWeujR75iYV8.exe
Token: SeDebugPrivilege	8	LKMService.exe
Token: SeDebugPrivilege	3236	GoogleUpdater.exe
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeDebugPrivilege	5052	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	4984	taskkill.exe
Token: SeDebugPrivilege	4040	taskkill.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	320	powercfg.exe
Token: SeCreatePagefilePrivilege	320	powercfg.exe
Token: SeShutdownPrivilege	4116	powercfg.exe
Token: SeCreatePagefilePrivilege	4116	powercfg.exe
Token: SeShutdownPrivilege	784	powercfg.exe
Token: SeCreatePagefilePrivilege	784	powercfg.exe
Token: SeShutdownPrivilege	1584	powercfg.exe
Token: SeCreatePagefilePrivilege	1584	powercfg.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeLockMemoryPrivilege	5476	svchost.exe
Token: SeShutdownPrivilege	5380	powercfg.exe
Token: SeCreatePagefilePrivilege	5380	powercfg.exe
Token: SeShutdownPrivilege	5388	powercfg.exe
Token: SeCreatePagefilePrivilege	5388	powercfg.exe
Token: SeShutdownPrivilege	5372	powercfg.exe
Token: SeCreatePagefilePrivilege	5372	powercfg.exe
Token: SeShutdownPrivilege	5364	powercfg.exe
Token: SeCreatePagefilePrivilege	5364	powercfg.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
2672	NnPoAFDdOAavVExhQU9pVBI8.tmp
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
3520	ef37c36b71.exe
4176	chrome.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4716	Confirmation.pif
4716	Confirmation.pif
4716	Confirmation.pif
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe
3520	ef37c36b71.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 5052	1236	xfer records serum keygen torrent.exe	73
PID 1236 wrote to memory of 5052	1236	xfer records serum keygen torrent.exe	73
PID 1236 wrote to memory of 5052	1236	xfer records serum keygen torrent.exe	73
PID 5052 wrote to memory of 224	5052	cmd.exe	75
PID 5052 wrote to memory of 224	5052	cmd.exe	75
PID 5052 wrote to memory of 224	5052	cmd.exe	75
PID 5052 wrote to memory of 3064	5052	cmd.exe	76
PID 5052 wrote to memory of 3064	5052	cmd.exe	76
PID 5052 wrote to memory of 3064	5052	cmd.exe	76
PID 5052 wrote to memory of 3448	5052	cmd.exe	78
PID 5052 wrote to memory of 3448	5052	cmd.exe	78
PID 5052 wrote to memory of 3448	5052	cmd.exe	78
PID 5052 wrote to memory of 1172	5052	cmd.exe	79
PID 5052 wrote to memory of 1172	5052	cmd.exe	79
PID 5052 wrote to memory of 1172	5052	cmd.exe	79
PID 5052 wrote to memory of 592	5052	cmd.exe	80
PID 5052 wrote to memory of 592	5052	cmd.exe	80
PID 5052 wrote to memory of 592	5052	cmd.exe	80
PID 5052 wrote to memory of 2036	5052	cmd.exe	81
PID 5052 wrote to memory of 2036	5052	cmd.exe	81
PID 5052 wrote to memory of 2036	5052	cmd.exe	81
PID 5052 wrote to memory of 1996	5052	cmd.exe	82
PID 5052 wrote to memory of 1996	5052	cmd.exe	82
PID 5052 wrote to memory of 1996	5052	cmd.exe	82
PID 5052 wrote to memory of 4716	5052	cmd.exe	83
PID 5052 wrote to memory of 4716	5052	cmd.exe	83
PID 5052 wrote to memory of 4716	5052	cmd.exe	83
PID 5052 wrote to memory of 3340	5052	cmd.exe	84
PID 5052 wrote to memory of 3340	5052	cmd.exe	84
PID 5052 wrote to memory of 3340	5052	cmd.exe	84
PID 4716 wrote to memory of 5068	4716	Confirmation.pif	85
PID 4716 wrote to memory of 5068	4716	Confirmation.pif	85
PID 4716 wrote to memory of 5068	4716	Confirmation.pif	85
PID 4716 wrote to memory of 5068	4716	Confirmation.pif	85
PID 4716 wrote to memory of 5068	4716	Confirmation.pif	85
PID 5068 wrote to memory of 3452	5068	Confirmation.pif	88
PID 5068 wrote to memory of 3452	5068	Confirmation.pif	88
PID 5068 wrote to memory of 3452	5068	Confirmation.pif	88
PID 5068 wrote to memory of 824	5068	Confirmation.pif	90
PID 5068 wrote to memory of 824	5068	Confirmation.pif	90
PID 5068 wrote to memory of 824	5068	Confirmation.pif	90
PID 5068 wrote to memory of 4844	5068	Confirmation.pif	89
PID 5068 wrote to memory of 4844	5068	Confirmation.pif	89
PID 5068 wrote to memory of 4844	5068	Confirmation.pif	89
PID 5068 wrote to memory of 216	5068	Confirmation.pif	91
PID 5068 wrote to memory of 216	5068	Confirmation.pif	91
PID 5068 wrote to memory of 320	5068	Confirmation.pif	92
PID 5068 wrote to memory of 320	5068	Confirmation.pif	92
PID 5068 wrote to memory of 2168	5068	Confirmation.pif	93
PID 5068 wrote to memory of 2168	5068	Confirmation.pif	93
PID 5068 wrote to memory of 2168	5068	Confirmation.pif	93
PID 5068 wrote to memory of 2576	5068	Confirmation.pif	95
PID 5068 wrote to memory of 2576	5068	Confirmation.pif	95
PID 5068 wrote to memory of 2576	5068	Confirmation.pif	95
PID 5068 wrote to memory of 3100	5068	Confirmation.pif	96
PID 5068 wrote to memory of 3100	5068	Confirmation.pif	96
PID 5068 wrote to memory of 3100	5068	Confirmation.pif	96
PID 5068 wrote to memory of 828	5068	Confirmation.pif	94
PID 5068 wrote to memory of 828	5068	Confirmation.pif	94
PID 5068 wrote to memory of 828	5068	Confirmation.pif	94
PID 824 wrote to memory of 920	824	icWLwA8fbUrgBuqPXz8Knm3C.exe	97
PID 824 wrote to memory of 920	824	icWLwA8fbUrgBuqPXz8Knm3C.exe	97
PID 824 wrote to memory of 920	824	icWLwA8fbUrgBuqPXz8Knm3C.exe	97
PID 2576 wrote to memory of 3324	2576	B4JdRzbsRG5GwFEYllm0Nx_K.exe	98

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:572
- C:\Users\Admin\Documents\iofolko5\ALF17ItoAx1HtWeujR75iYV8.exe
  C:\Users\Admin\Documents\iofolko5\ALF17ItoAx1HtWeujR75iYV8.exe
  2⤵
  - Executes dropped EXE
  PID:5096

C:\Users\Admin\AppData\Local\Temp\xfer records serum keygen torrent.exe
"C:\Users\Admin\AppData\Local\Temp\xfer records serum keygen torrent.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Newbie Newbie.bat & Newbie.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3064
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 705685
    3⤵
    - System Location Discovery: System Language Discovery
    PID:592
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "LadderAllenChiSocial" Dependence
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Cholesterol + ..\Mart + ..\Pretty + ..\Consequently + ..\Latter + ..\An + ..\Hungarian + ..\Pod + ..\Publishers + ..\Termination + ..\Auto + ..\Names + ..\Bad + ..\Book + ..\Contribution + ..\Trunk + ..\Dollar + ..\Viewer + ..\Montgomery + ..\Accounts + ..\Forwarding + ..\Columns + ..\Incident + ..\D + ..\Innovation + ..\Pair + ..\Own h
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\705685\Confirmation.pif
    Confirmation.pif h
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\705685\Confirmation.pif
      C:\Users\Admin\AppData\Local\Temp\705685\Confirmation.pif
      4⤵
      Modifies firewall policy service
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Users\Admin\Documents\iofolko5\eZlTLSyI1U1yTHHX7jxlvDkb.exe
        
        C:\Users\Admin\Documents\iofolko5\eZlTLSyI1U1yTHHX7jxlvDkb.exe
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\LKMService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\LKMService.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" --checker
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3236
    - - C:\Users\Admin\Documents\iofolko5\NnPoAFDdOAavVExhQU9pVBI8.exe
        
        C:\Users\Admin\Documents\iofolko5\NnPoAFDdOAavVExhQU9pVBI8.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\is-DRA0L.tmp\NnPoAFDdOAavVExhQU9pVBI8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DRA0L.tmp\NnPoAFDdOAavVExhQU9pVBI8.tmp" /SL5="$60224,4095961,54272,C:\Users\Admin\Documents\iofolko5\NnPoAFDdOAavVExhQU9pVBI8.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Gepard Fix MP3\gepardfixmp3_32.exe
        
        "C:\Users\Admin\AppData\Local\Gepard Fix MP3\gepardfixmp3_32.exe" -i
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2192
    - - C:\Users\Admin\Documents\iofolko5\icWLwA8fbUrgBuqPXz8Knm3C.exe
        
        C:\Users\Admin\Documents\iofolko5\icWLwA8fbUrgBuqPXz8Knm3C.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:824
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminHIEHDHCFIJ.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Users\AdminHIEHDHCFIJ.exe
        
        "C:\Users\AdminHIEHDHCFIJ.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 256
        9⤵
        Program crash
        
        PID:356
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 244
        6⤵
        Program crash
        
        PID:2084
    - - C:\Users\Admin\Documents\iofolko5\AdxAGfHlcbhPudPjREBjcZVa.exe
        
        C:\Users\Admin\Documents\iofolko5\AdxAGfHlcbhPudPjREBjcZVa.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:216
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:784
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "QTXSWVVV"
        6⤵
        Launches sc.exe
        
        PID:2516
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "QTXSWVVV" binpath= "C:\ProgramData\aevrrerqmhcb\hutopimmbtzg.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:5188
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:5228
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "QTXSWVVV"
        6⤵
        Launches sc.exe
        
        PID:5236
    - - C:\Users\Admin\Documents\iofolko5\ALF17ItoAx1HtWeujR75iYV8.exe
        
        C:\Users\Admin\Documents\iofolko5\ALF17ItoAx1HtWeujR75iYV8.exe
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
    - - C:\Users\Admin\Documents\iofolko5\t6_uhlogzSrBEq37BCObfdmz.exe
        
        C:\Users\Admin\Documents\iofolko5\t6_uhlogzSrBEq37BCObfdmz.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\1000332001\ef37c36b71.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000332001\ef37c36b71.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3520
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3524
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4984
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
        8⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4176
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb3e1a9758,0x7ffb3e1a9768,0x7ffb3e1a9778
        9⤵
        
        PID:4428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:2
        9⤵
        
        PID:3448
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:8
        9⤵
        
        PID:4224
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:8
        9⤵
        
        PID:1540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:1
        9⤵
        
        PID:1756
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:1
        9⤵
        
        PID:2824
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4344 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:1
        9⤵
        
        PID:1204
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:8
        9⤵
        
        PID:5588
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:8
        9⤵
        
        PID:5720
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:8
        9⤵
        
        PID:5808
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:8
        9⤵
        
        PID:5600
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1892,i,12854313736006232569,11079385330150989008,131072 /prefetch:8
        9⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\1000333001\0dd4c092dc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000333001\0dd4c092dc.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5996
    - - C:\Users\Admin\Documents\iofolko5\QChuxpihTR0xsV5tFcIYYbfP.exe
        
        C:\Users\Admin\Documents\iofolko5\QChuxpihTR0xsV5tFcIYYbfP.exe
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:828
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3564
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3172
    - - C:\Users\Admin\Documents\iofolko5\B4JdRzbsRG5GwFEYllm0Nx_K.exe
        
        C:\Users\Admin\Documents\iofolko5\B4JdRzbsRG5GwFEYllm0Nx_K.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2576
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:3324
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2840
        
        C:\ProgramData\DBFIDGIIIJ.exe
        
        "C:\ProgramData\DBFIDGIIIJ.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        8⤵
        
        PID:4092
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        8⤵
        
        PID:2592
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        8⤵
        
        PID:1580
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BKKKFCFIIJJK" & exit
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 232
        6⤵
        Program crash
        
        PID:4140
    - - C:\Users\Admin\Documents\iofolko5\wZDiGH0zvSPFoycipHvysKO6.exe
        
        C:\Users\Admin\Documents\iofolko5\wZDiGH0zvSPFoycipHvysKO6.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3100
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:3436
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:2812
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 260
        6⤵
        Program crash
        
        PID:2764
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3340

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3604

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4444

C:\ProgramData\aevrrerqmhcb\hutopimmbtzg.exe
C:\ProgramData\aevrrerqmhcb\hutopimmbtzg.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5300
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5364
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5380
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5388
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5396
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5476

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BKKKFCFIIJJK\BKKKFC

Filesize
6KB

MD5
f0995df5daef55d27ff2905aa7863807

SHA1
54a00246d8da6381a522b59571f6d12b31f0524f

SHA256
8212432d9a5510afcf5dca71500c63fdafb1c2f11a57b777a9e1efb547b9c10f

SHA512
50064f90a1cbd7dbe1b7a155931dff3cc0bacf040d69337b428e42a78e70fad81b5835451ce2836ddb0166b5f9b3bba1070edca847c25b48b625a06007472450

Download Submit
C:\ProgramData\BKKKFCFIIJJK\ECGDHI

Filesize
92KB

MD5
f0764eecc2d52e7c433725edd7f6e17a

SHA1
2b6c1165e7ca5c433b29db548ac2624037c8cb38

SHA256
6764736d2bd111036bea0eeb890cd75a5bb4114275abfffe615d9f79049f0ffc

SHA512
3cb2f0abc6925907488de7ecef46d60106efb98cec3c63e24e531bbf94dcd8c89ad57e0a88084eaa5083265f32134e6636f23808622db5cb3f5c83faaba96ef0

Download Submit
C:\ProgramData\DBFIDGIIIJ.exe

Filesize
518KB

MD5
36158b1ffc53e8542578a1c4094d9c4e

SHA1
c88449e11b7b6c48f927c6de411d554b10799e2d

SHA256
56e236b52b0077e19600cf660590bf8bea10b79d74c04097fe0b6b52df17d714

SHA512
b4cf513d0f7d93257a37603f6eabcff692e07f4b8bc238f3f2aeb9f80c850a209981230af226f16b246a41cae51cdffef9ba7f21e10046e7d09b48daeb92b92e

Download Submit
C:\Users\Admin\AppData\Local\Gepard Fix MP3\gepardfixmp3_32.exe

Filesize
2.8MB

MD5
4425996737f3a586dbb97d96f0455ca3

SHA1
d1c8816a1e98b1af441882fde58e26b63b69ad53

SHA256
0e645de45143178e5857ca259a06f55d6579a98f51d517179ba04e4dca5e3a2e

SHA512
42c1d7f66e80ba849917fc4366b6dd38d3416f89c93fbc62371a8735e32746c19588a7d8d69a821a037ed474abb6ba580f89487204915da4ccfeb036352b4307

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
324dacbef11ebb4a8b0616860b0384af

SHA1
01ef3ba179316711ed1c6faf32e4fb1d6ba0d3a0

SHA256
c0ceb71da17d49c39d1f5b50fbecbfe09d26c4c844f54dda464f1df7c498af46

SHA512
e093ccfe703571b85fcfee430f5ea46ac2ce72353d2b0c109148bd68d402bd849f10d58dd6fb926b9608590ff1f13d66c2bc24b2d68b361d4351c25766b470bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
c5a78bbda4f4cc0666c9b7cc93c77d17

SHA1
7dd98311e48d849fee048a92b3a2e725d5bb2fec

SHA256
b1c994f174baf4d7f16a36e5d7f57a04e00388ce8b54d23ac12065b11af8be0e

SHA512
cb3e1159f17b8d9b94ac69bf5d9b693082ea32d3eb5e1b50bafb2d330824ebd7eb9acc77b08137fc2f6dab61af1d29b30ddd6e5ccd43ab4536878ce9f40b5036

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
404c86c060bd96e5bf94107aee56a578

SHA1
01d0b73d8b13a2828600c3cc8f440f5256a2b736

SHA256
2147ba9675aefc7d5e10b2ba7ef66ebe8de355b32cfa2f2f700d7d7929b69539

SHA512
8cb6f1175b3dfce8c26b6bdd5077af38eb29e26f1659855a7852d08f7eef08d816862a028e054d99c75f05b702b127fa39fea263b69146130626b8a8afd66888

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
35069ab52fc05f9ff477886a116a2378

SHA1
52d78a51ca3161732aaa31e496501d7b7b874100

SHA256
630213e1cf33804f3113682a4df5185c492aef629d40cadd35c5a31bfcc65966

SHA512
9d94f7eaf9704463cebddedf73ec298b18a1cc3daaa18f440e411b3b1d0673f317c64645bcd03b200f80fc9833dbbb42088acad1c085484ea327ac3e8a2416a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
99ed314ec9032bd12660e3a542efc274

SHA1
80125906a3205521742ad7c904cb5e63ad5a50fa

SHA256
11fb465ef48473cb39cadf1909037a05ec6596f25ccd5ee72a35c803fc2d9b23

SHA512
64aeeed5cdcab5c671aaa4fcfe20599f8638b60769322da9d903e004a520bac32026c409aeb01e5a361d92c7f369dee79b29d0787e0ebad6ed04a2076019eb36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
fd4c2454ae890160ca8c8f1acb11823c

SHA1
d46136fd3707d342514bc505b06d998cd580d647

SHA256
8b8699ff3ac351b0b1c4cd988630e57edb7f88bfb790129e281a70240f5fec37

SHA512
40adc7130c0391236bab0ea238bc42fb1141cb30839ad2640534c2855a9df01376e9fc449fafc0e003570dc38e08a10b1a76616aedaf11c3ecc13ca1dcc82376

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
c884d49a8e43beb3317564caf228e8b0

SHA1
b932b529c65ce486a297bed85588ed1d2067e347

SHA256
aa948f1fdafa930afdc60a48c2d7da47dc6f02d031dd69cfa8d9acb835ab9d78

SHA512
cd6f43491732f2e503140691a62c2ead43dd0b0adcae152254c536d916563ef02b9a022801823dc496bd8a2a8f16004687c54ee3262f8101304dd193a62e6676

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
310KB

MD5
6fb19b3881ee7eda2d817e750f50cc33

SHA1
31331fa271e3217140898acae85baf4ac3df51de

SHA256
4e7b55bdb55414486c40cbd4adec5e9bb44c0fab6fb4855b539a25aadb9e1d23

SHA512
6e3e790e3cef84a122cf7e3e1f9f9ef878376cdeaecb18dc705d0caf3ea344d902ce975d7e579075223ae27057393726a108ab7f48ac5240dd8539d496e0ffd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
344KB

MD5
497f5459d336399a82de97a00c55dbaf

SHA1
db6a2eada3866ab7916ca9f99cd69ae11d682370

SHA256
b8252e69ac13ba14a851f55b4b9b14ae1a20a22814633a152a0ac775999b95f0

SHA512
11077908d73c6eb0d04ee59cf4a5cb11f84398c2e88e07476b20a40c8e6ed4c29abba011ed909ca934d967bfdf9972f4a250569b25e4ead763a70524fe4c7fd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000332001\ef37c36b71.exe

Filesize
897KB

MD5
d9f8c3112fa16b9c170a349c0aa6285f

SHA1
793ad3149d3d4eafe1036b3b381596bcd8f4e54b

SHA256
5366197d4e722f7a297555268aba3a03310e73056c3a9152fcc48b0c4f71336b

SHA512
fc2803deed529e75cb7d97cc7abc1bee10ce2538aa9e7d7953d7a0a66b4721bae2ca5e1515e02da11fa236f1938cb14ff7adcc8beef97e5a8e4fe015098c221f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000333001\0dd4c092dc.exe

Filesize
1.7MB

MD5
8baeb58f65c1b9077a14792bd25a17f3

SHA1
9908569a2920d3693bb0eba3692c48132a5b25a9

SHA256
f9c5550df902ffa0b701eb230cb26c712d35688efcae92636488915de920c6a8

SHA512
00b3182acb2fd6ad034057eb35d6030bb4765c38ef0ad0cd0d7a424943ef5ce642aa171a02988d403921286c15175738cd9dfebdb161940e41d4e18f4f31b5e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe

Filesize
307KB

MD5
791fcee57312d4a20cc86ae1cea8dfc4

SHA1
04a88c60ae1539a63411fe4765e9b931e8d2d992

SHA256
27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d

SHA512
2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\705685\Confirmation.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
C:\Users\Admin\AppData\Local\Temp\705685\h

Filesize
1.9MB

MD5
cc7a8aeef189d5d3b73ef5f925107d00

SHA1
8035bae2fd84c9bf1e1455cd1c9178e31c5a7885

SHA256
68ef046a83320974ab117c14e1d6f445cabbcfcfdbff037dd344b4198f7e4f6f

SHA512
2ff7978a02573b6467f1ad6e2a328b9b1f567a28190aef5984e579420b7268bcbebbb47578bbe5161a7193953eab7fd48714d135efde7f77c96080d96806fd98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Accounts

Filesize
76KB

MD5
9bab97cdffb7bbdfe74bd30cbd1eaef6

SHA1
97fec5799dfdebc5627a481b311f634557f3d6aa

SHA256
336d5af1df844eab930cd6a65fcea4dfa895ff465dc18adbd7b65add7f8c0d56

SHA512
a434068e0f3c69e911c1a678b49ef37378532ae900d1e603b16875530cbcd52095cb0080d9230ad966c7f495cc2debfabd2ae85861663a84f7572327ffdad795

Download Submit
C:\Users\Admin\AppData\Local\Temp\An

Filesize
67KB

MD5
f7c2147a96c7ceff920cdf8d7ba2c41a

SHA1
40bd65cd077c6ec2068c34d6a6210f56a681c8f0

SHA256
2ce3441be7ef60f42c32cdea702fdef8424afdf63d04df78c2cc12e4d07ad370

SHA512
20261b3a25f1456391b98a2f3ff07ba650021495b8337d98a59d770556406dd429085ff67319c59215f96740ee5590927720bc21a7ead20c60d3970b52d42f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Auto

Filesize
53KB

MD5
e5cf813fd0b4a67dc95f61a18c45fdc3

SHA1
41156af7456f50f4efb6397db974891a605587ea

SHA256
6ca17f468b33577dfa31ec11374591268e4d2dee6071aebb1bf370d4d1221218

SHA512
8d12f1ce0fc5285c9ae1124ab1aa5feb375007f700f69eedcc1e3f0540a1717e9d246fb63679af1b087b95b5ae000a0456d41475c4b05bfc64f4f016c8d71f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bad

Filesize
51KB

MD5
7df19ed322c890772903197caf80ae37

SHA1
8e347272daae4e9397b21b2c628e9397708c5ff2

SHA256
8a1ab4dba26b101261b6ad5c9654718a69ce3610719977af3c7d0c4cd7e432d2

SHA512
8c1113a9269bc5973a4b21338a25eae535a7d47679d5badf092f260b19d65f2436ede07ce847f99e8a80058f68015eec24840c2cb29d8bb1e335220b4c3eb4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Book

Filesize
50KB

MD5
9f1fd1c8dd619d82d6765b702486984e

SHA1
f8b9bcae0864699eb11431de29183f8ff839df18

SHA256
71963eab0dc18e4b7ab67d48f514c5fab3ebf1004bf1311fa2964963cb8e3f27

SHA512
e86c95f03512f37c6e8f5adbd0803343b2a9791ce44d494422ed1ad1380e986457ac2d4c25d90be3e867842f1a084765ee40fa703319ed52ef6b9820b22e2734

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cholesterol

Filesize
58KB

MD5
cd96b4863f697f41f60fe1d5f7aa2958

SHA1
272043393f93d90c051793b2edb18f142b57e8c2

SHA256
901119c87ac00f1394dba5f99d02f8cf53f4f3868562a255d6ea16a6358d1da6

SHA512
f8da02c973cd8d148a19553b85b1e3c329b3d3eb7bd6c8f622729e7eb0f72b5c8d24c86deb53da1051cb490fc21209906ddf8d5bd917552e84c35bb7ed9efe6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Columns

Filesize
95KB

MD5
c06e45b2b7b81f8671590708bf240f71

SHA1
cd1c65d4262e13dba3f4e7d3126efd0abad8ff27

SHA256
537c0d2b5de595cb390a5f9b996af785e94048436f53fa79e16a992fb153ce03

SHA512
d6374b53063d1d815ca0167e1884c4cbebfd896250bcc952303dfeb1b5d3383d049178db5c2843069fb9a1b6b3365d59a49bbbe23c2355d96fa85ab90f7a4713

Download Submit
C:\Users\Admin\AppData\Local\Temp\Consequently

Filesize
83KB

MD5
d94e99b3fe12d0adc81d3235fdf35ede

SHA1
f5512fb99f35b9f136dc025466aadf30a233e1c2

SHA256
6aff44a7ffc9e68ddf9e83762a1ee54a95c908fa44f7aff571c70ea1b68d5d8c

SHA512
74f989f27491bf4a1e6b934463b10b143adac6b0171432b4acb5549d026674553c485232fb5f6d914a6301efb9060071de35118856938a4b6d0613e0f194b22b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Contribution

Filesize
82KB

MD5
77fe9ace744ea5090f60c91e0f35e232

SHA1
9b8f6c2d2d2bae9a5b97c36f238251ecc3bc4eb4

SHA256
50a10473e5659812016e2fbe16740d09e25aba4590483ff37ca2b79bcbfad888

SHA512
73f381a503c579ea54c5f755abb5323ab8e94311227489bc194a3dfa91b425cf1478bb634fceaeb1ff25938ba6d5a643c27a5de0c7df172c06e4f50a3009719f

Download Submit
C:\Users\Admin\AppData\Local\Temp\D

Filesize
73KB

MD5
46a05962148668c2eab300841c246d0b

SHA1
cd899d60d0773ce1641f28f11255f08883f57c4a

SHA256
10eeb06915f4f2c3b3545d5570df38fa89a633ef41d24d51f758bf183dd890fe

SHA512
dda4a3794b641e42d65ac033e26b83ef45cfd9411e2ed09328b9aff1924611c9f018aad65ead6458f332e83af375f67e2cf7ebe14b596bc086713cbdbd3bebff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dependence

Filesize
6KB

MD5
44d3d34ebe8fcd06a1e36f3c52eb029f

SHA1
d5ea64f3e680a385928f6e7b59f759d2a9363e5e

SHA256
261130e99004776150ed5700d12be8164998c2d4f8545b773afcfd7623a7882c

SHA512
ac2d9e84c8f4e3ce60e3a3548db6c16a681559d2fef11b572a819a1f03ed47577c7afe649ceb3e102fcd9ae7a7e3735e66eb7cfbf1e98269f275ce1251cb5cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dollar

Filesize
74KB

MD5
7a260353296373d18688959ec639481c

SHA1
dec75bfce0274b77b630d84b90d42203262f5945

SHA256
97f47aad3b772a61eb33146c3ad884fa98a62ba74f721c5c385a1752639f28b4

SHA512
f16a938613403149453294de62ba381d3303256b8a292faa9e60ddc15b9b1691ebde2021fd7330683b350250236f77689ec76036fa9d2562c04a51f199a1f154

Download Submit
C:\Users\Admin\AppData\Local\Temp\Forwarding

Filesize
97KB

MD5
8158c9ef2b8c79ed8ff700a7fcf2046a

SHA1
44eca002690aa07cdffa9624aed883eba0c7bb8c

SHA256
026c51576201a0db9c97c92459bcdaf375fc1c16762df36ddef7cc95f2ec3bbc

SHA512
27b25e1d594eedf07a6bab19b813714b45be345426d91ba6ac2faa7f5806bc1799c8fee2412efb59313d0517be1a107c01a12a17ab81161800b0e57e17392690

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hungarian

Filesize
52KB

MD5
fb5e25f08ed7f7b8021e02c368cb09a7

SHA1
710cd4681badea027e91b9bb361ae2ed3d990567

SHA256
565401f0f128368517bcf7660641ab133b31b8f62c9d67d809a929f93a604835

SHA512
0ad50fd132480c42c94ab18cc5a1850e999dffe4a75f1b90a1b35443fe67bc1a4f4c579826cebcab6b80859e0050c511a091e49b03d3eca42b467f56dc396006

Download Submit
C:\Users\Admin\AppData\Local\Temp\Incident

Filesize
75KB

MD5
50106d16ba7533876ebf0a17b25e126b

SHA1
5bd3772a4d820deb24480f48eaadd138c98e1ffa

SHA256
20457a6e41ebfa593801db8dbec760da03ed63d42f81ad7abc17093de7b04c4c

SHA512
8e8e3a7703f774c7ad4418433031e65bc834ea7a00724659b1fa1c71af31ee2198f970d15a4728d6e52959f929a4493a8555bcfd9c463484f8cc853b78c2b9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Innovation

Filesize
77KB

MD5
72632a0bab5eac2286554b42f86a1820

SHA1
7d6f4d44e96280bb76ae04408e14abcfadfd636f

SHA256
1249c7d926fd5d22568f720531c895144d7a07fae2c928ec32cb1d37a54589d6

SHA512
a5dea1a1c17dea656e84baf7f30ae1d1a98fa4bd74bdad6abf8785da8a710aa1e1b7365b1b3b9508d47f1b28d74cdcb275a0304a108e4c1b64ffb23b04cddc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Latter

Filesize
76KB

MD5
f8b6b7007a00fbd87c41e86c2fa670ba

SHA1
0a32ab0eb8033559a56505dc46568a53e7babb8c

SHA256
ff095a33aacfc49fbc7f9e69b9c9be9e70038793d1f0775b34a122effd35bd53

SHA512
30f5e6eef2f3d9ccdc27c7cdb5a423f40df62be22f2d5f8afdea34cd6f9ac93480c6c94566c48b9d3616ef8b91c313db14ea4f3665d6cba117191344a88de008

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mart

Filesize
97KB

MD5
f1a876f0e12db86afec877c784919983

SHA1
4a3f852628b40253c048ba1c60b4ba235647323d

SHA256
7690fd321edac355958e096891770cf9c4bfcbfd4a46ac42e5cc4b5a78c2705b

SHA512
a47983c031e9909b5e3f7346a2c3ed893c6a9b51fdf9e988a009b3154fdc7e35628544cf62552c671fe87bab34c429ca69acd9b5d7dbccfd0d8fa092042bcdd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Montgomery

Filesize
96KB

MD5
c567e9aa3ca6191e46732f680524b457

SHA1
fabc567d73942b10248a8b434bc44b8b2560933f

SHA256
43ee7d4b00558674c0b2b0afcf84ff7d963c8a99dd08ef33d1a826960d1678c1

SHA512
19c044ea54a79f4b8556867889167b86a3f3d5fe02f5cae5a6370300151ca2e4becd2ee22917b31761c3c87728f5f029a3ec57be806a20c08067eb4a1911d79d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Names

Filesize
62KB

MD5
b12bd6871223fbb0c514296c0de2f135

SHA1
98cae3783bf77ef9609a1b085f612fbf0ee90d5f

SHA256
a446dd4efbf1c81cec086d265ac1477117c0760503cd9fc0f293cbbdb558ec71

SHA512
978b6034a9ded4994d689d0adb58cdbbbd2e94381db80f6834c589916fda3cd8cf76b4f4ac7c36bcd7a72507a22d2a038037cdd619cbe088523f5ae0c8ca0e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Newbie

Filesize
17KB

MD5
74c97b08b7dc106d2da14e17aff27cc1

SHA1
7345d2022cf8c4059fc33e3172a7e11fe030b992

SHA256
36d455e9d16898df044eb2b1611a453c3445fdf12a1505e0432a79f605acd462

SHA512
18a5a91c87a6a1c7f0a6552870641fd3a4e15e8dd31b80265e46d10641430e56edafc3bbb1a815f6fda3a225c3f7d6ddda6a6062dee240ce080c91fc9e50215a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Own

Filesize
58KB

MD5
ea92f24f6b30c72cc570b324b457a5cb

SHA1
9db0e258914511a2587449e54b0d0dfd95df9e51

SHA256
d9f5f85a8617c15e64b1d195b505484e81dbd90f76f09c9bc2064b8009def948

SHA512
c01dad9318d9b673334df4b55079c42e7f1dee0da70a0734cf35a2cbfd24b679976c7e7efa6163fea5597e59b3edb9707e2ad10770ed56a71a0260f5be7f7efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pair

Filesize
62KB

MD5
5820dd5134bdfbd4a1d33c3f69722af3

SHA1
135315758a0f889142c6b1d03aa4d446d68109d2

SHA256
0a51d6d1756a88dfdd6f7f17d8c104d6a7bc3c483e7f5a909d5f0376388a12f2

SHA512
8d24719c5bd654b6461fe44249fd47f583a375c8eb137b1c36eaf8a53fccb871e59c9845d9f3397b508b2f6b76ea700ee8ca9cbe76df5cc77ba18fede7547818

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pod

Filesize
77KB

MD5
95bf8570f5eee649f7a8cf26bb6d9282

SHA1
267c6d85685fae5f3e847da5f6cd5e06060471f3

SHA256
b66f0aeb70777264810b5e8500b6e562d8613c348626b4c72e19be813ddfdcbc

SHA512
58b65bc54f79d953a3ba1439c02c6c3a189db272654309368eb4190150df4cc47f8af8d8fb396670f76606f7c11e900c2933011ef09ca1b041162a2f5db17cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Prefers

Filesize
866KB

MD5
b9df2ef7468fd0d82bad1bb800179153

SHA1
8eaf7188c40c2d8aeabc382ef6d234c83411f0e8

SHA256
3527e01919c940aa96aff2fc7fbcda0a709e8167f0ccd7cf99b3b05d6e9b2cfa

SHA512
d678757093dd50c5b11ad8d3b77963ed41db163d2bad4bf4fb669155fb06585442d2a4a04da3b1c4fbb5de8e5638ce194122758654a47fb73374f493e2fb2093

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pretty

Filesize
68KB

MD5
c0d47c5a852d5b150d4635751b05354b

SHA1
33105a6dfb946e370069feb96437bb9b511ca6ed

SHA256
061ead97da5d75329854ffe838d655a4009f464d8c213899d86d1877c522c9bc

SHA512
37d527c5d2d8270810aa71de26a4f3b1e92aeb0a74d2ac50a8613d75ec3df1091e86cf964481169a1b8a0d6815b92b644c3fcbeac112c373398b68b9177370c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Publishers

Filesize
77KB

MD5
aeec156eadda8f3ab54942386d115c9e

SHA1
2180f4d8b6bb116a58d53d4620dc219f53a32cea

SHA256
edc26d860fb93ae719fdce0d9de9a1a367c4ee5d8d5d594675c08fac3c5702ac

SHA512
90f15cf5ed4484ba008a57df129076fac5209d08e7efa7f794f441e436a7834d713a54a9bf419af71452d5053f0f9f0e4fcbca8f8740f7f380e605565a35ced1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Termination

Filesize
59KB

MD5
37e21ab4cf57679f57be62e06d54ebde

SHA1
e03642b281d2c352ca6c4b174c6d1132fc74c8fd

SHA256
141ac183e79cad7b4b2299b0d6d126a80234ca44e93a537fd59396b51f122668

SHA512
41112a7e25967324edaf823624ae11865f94a0eab9b282f28f6bd006e8ce0a72782fa1b5255531950000895190e2ac0c421644d1ba09ac8a81473a7c580b9c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trunk

Filesize
82KB

MD5
b7073eaa1c4888f97adcfb867def3dea

SHA1
a3e096bd72e7f6f57d61d832503993dddfe1e072

SHA256
14e43584f53942c2386a7c9d68e1c1836147e4a2bf7dc684731f2aedcf241405

SHA512
3fdc291916b18cfe1cf56d73d9a856b2f4ab89658c9660f7a3bca3f97cc311be3150cc6798a5c520e8eb0103e8301fac0bf2b7d4d35eeff5d1508961d58a79f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Viewer

Filesize
61KB

MD5
5e431b7c5ed155f8a046fb475d0fc84e

SHA1
e361e0bc22f99e5e7dbc989c8d7e6d6ebb9878c5

SHA256
e65eed1c391c70880e08056d2c7a35fb8650b01d92edb57a7fc9990373ad6724

SHA512
2437af95290ea7329ebcf18c719e144a1cea3f43e659830c065408e52e367cc8e1507b04bec2c04ee18a0464ca3dee147329598b06973fe3ce7e67fa42c98a06

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DRA0L.tmp\NnPoAFDdOAavVExhQU9pVBI8.tmp

Filesize
692KB

MD5
16c9d19ab32c18671706cefee19b6949

SHA1
fca23338cb77068e1937df4e59d9c963c5548cf8

SHA256
c1769524411682d5a204c8a40f983123c67efeadb721160e42d7bbfe4531eb70

SHA512
32b4b0b2fb56a299046ec26fb41569491e8b0cd2f8bec9d57ec0d1ad1a7860eec72044dab2d5044cb452ed46e9f21513eab2171bafa9087af6d2de296455c64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_43aa519f49a54879b697ea5ad8eb243d.lnk

Filesize
1KB

MD5
eeeebcf1b6fa06ab5f1d9b909b9beb0a

SHA1
5babeccbd7ccf296beb40c23f1fb671ed2576f53

SHA256
21dddf01dfbd84d4b07907303f50c324a703359ce00fc9e0db6495babd841f9a

SHA512
8fd9bdba9e9d70e676bbee5a3856f1b2b1b56b38fa1a2de867ec81f40fc5cece6acae5c51f2d4ecc91ae4387a2fc136dffde1bb8b1293567cb724110ee72182b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_54b2c77581e2473aa296381b6bbad89e.lnk

Filesize
1KB

MD5
427c7f9c24207046f10f0ceb180530df

SHA1
fb3bbc681864c159a5784d5905c8333ffa532450

SHA256
3deeeeb27db86c11aeb81f71cbcf372b86540217884c792864f9318a427ff2d5

SHA512
3c58925c8e5cb669fe277fcfc16fb15cfc1d7c7fe379c1fcf83818481eb1bed2d4a1a8c4dcdda1576c5714f3fac3b080a19951dd692d19fb9d9cd4a9181c5b37

Download Submit
C:\Users\Admin\Documents\iofolko5\ALF17ItoAx1HtWeujR75iYV8.exe

Filesize
11.4MB

MD5
07fc5b4f3a432b09b0d51f8b00ef05f3

SHA1
b098b5f859f45314d5edd03aad9eab420bbdec40

SHA256
d65629e6028c54eb383b310547426ed1907296a14a2e8977b9d469126de1f8a9

SHA512
ba4c21a022ea2253f26400c7d247d1b886f29e7d2e8722d3c1545830695106168605a963e448651e7d2613545ad903f4dbd17e09e30ed2167d5e65755794c888

Download Submit
C:\Users\Admin\Documents\iofolko5\AdxAGfHlcbhPudPjREBjcZVa.exe

Filesize
10.4MB

MD5
6e1953433d891db10790aafcced19b30

SHA1
c46581f4673f068a357b76fbe1bfd1909b81d79f

SHA256
af708267cf479834fbd0811c58facd377ccd0226a3733ae9f6e086813e68bcfa

SHA512
44a6753572ba7ece19aa3f29acda2237cd405b4cfc9f65513da357b9a72819ee95d2787e5ddbccc184b6bf73998b5d17a7456deb64c00d2639e4c9d49c346149

Download Submit
C:\Users\Admin\Documents\iofolko5\B4JdRzbsRG5GwFEYllm0Nx_K.exe

Filesize
550KB

MD5
33f127e35338687a1a64f67fa6ed3b9a

SHA1
672dc4d194a5ffe2fd5c23b411bca7b99647ebd2

SHA256
60bd16249ed2f24c98380920cb581f447a806541827d4eb2a5c1e889b9379c30

SHA512
c50878d3cb82e12384f1a1c214d9bec19dc7e0e54285336261837a4c92aa42fd9068ec27c6d0361e60935b097a59d3262c4295c6660eaabb57503e4a2f82b4c8

Download Submit
C:\Users\Admin\Documents\iofolko5\NnPoAFDdOAavVExhQU9pVBI8.exe

Filesize
4.2MB

MD5
b771f46c06f2f0d103f152fa1bbb2eed

SHA1
da7d14b6e59a59bef349433cabaa13b02d07c2e8

SHA256
c5df9d57b4c1c4eea5a53c83bba6a2adf57ca7309115c0fb108b8a1401bc87e9

SHA512
7221018a7650305c353058b5b5e47e5aa31bed12b2914f6724df08e3819fcbda92c9c5bc1b05f3dd59c9d8538f8d872e306c1f21d93172659d6cfcf05db73275

Download Submit
C:\Users\Admin\Documents\iofolko5\QChuxpihTR0xsV5tFcIYYbfP.exe

Filesize
10.1MB

MD5
4577ea4b86da052900468e8cf8a775b8

SHA1
2e7d6608bb4d90a41627dc9381acb0a7704b301b

SHA256
2333a83bfd543d45bb945d6b879216b8505398258f2dc43571708393189419a7

SHA512
1fe8fe00ef8eeab0f4ee0313bb145425cec548a2769b58487ba0f32651ef02fe51bc08fa80177b498160ece1a849fb8513caada7a14214542f6ef0ccb5cab125

Download Submit
C:\Users\Admin\Documents\iofolko5\eZlTLSyI1U1yTHHX7jxlvDkb.exe

Filesize
26KB

MD5
cdb17e17bc4e4d51fde6a4620cec014c

SHA1
c184c6c58a66555685be713dcd2d11e6f0af7c37

SHA256
b10c9d5286c17c05f587660664ab7f5723817fc98343c02c6b91ccc562e1019f

SHA512
acde9cf8b3ee05efe99f5bd1e096e2016f0f6f7fc196f89f6a9592480ee0afe134d4ebdb2a5c6c8782290c5da31b07f9e58cc1722a9fe4bf70d9ca05e1b2417a

Download Submit
C:\Users\Admin\Documents\iofolko5\icWLwA8fbUrgBuqPXz8Knm3C.exe

Filesize
473KB

MD5
2b7045094692bc5dd208cd1e195a6128

SHA1
4830718ca327e4717d42586579d7311387c04853

SHA256
53f74c71c625da6b7ff77c3a61aad3be0ff4a7199ee447c57c0d12dbbfaccf32

SHA512
57374d733a732b5a70ca79115f8107967ef9d5e36f58799f963494cd541486bf911c457fd667553c56dc5217b9d103d7ab55c71b4585a0056b6b70eeb7069003

Download Submit
C:\Users\Admin\Documents\iofolko5\t6_uhlogzSrBEq37BCObfdmz.exe

Filesize
1.9MB

MD5
92877de6537ce25199d9bfe8145bb7ac

SHA1
b7cb1df118def3c30d95168514bac71232b5fb65

SHA256
f78a5d3716dcf0b473feec0ad2e0cc8b8bd98f94e06d902ac82bc0ddcceb8b61

SHA512
d94b93b35259471f5862a3ac27bd6ae1c8a9387c69ce7b675cd2818bab629602ae0cb521688a8a55613e56cc288bbbdeab5ed4e7e112ef6b5920e779d7141d1a

Download Submit
C:\Users\Admin\Documents\iofolko5\wZDiGH0zvSPFoycipHvysKO6.exe

Filesize
473KB

MD5
8d58892dfecb6f0dfc5ec81429804f0d

SHA1
501777dd2d63dd70095cfe758f73459378f4e409

SHA256
789518691c359e3504ebe047c801b155eeb3189e2fdfcd5e82b0cc88bb460d7f

SHA512
75435f31a6c4092b53510fa482931351ab68ff99eb5900926c336f70e535b25408b7d9636e0d1f13fba662503e681684b7546d3e8c188d948969879c8c6079c6

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\is-AVT08.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/8-322-0x00000000050D0000-0x00000000051D0000-memory.dmp

Filesize
1024KB

Download
memory/216-280-0x00007FFB598A0000-0x00007FFB598A2000-memory.dmp

Filesize
8KB

Download
memory/216-282-0x0000000140000000-0x00000001419AC000-memory.dmp

Filesize
25.7MB

Download
memory/320-226-0x0000000000400000-0x0000000000F8E000-memory.dmp

Filesize
11.6MB

Download
memory/320-220-0x0000000140000000-0x0000000140033000-memory.dmp

Filesize
204KB

Download
memory/828-361-0x0000000001A70000-0x0000000001A71000-memory.dmp

Filesize
4KB

Download
memory/920-205-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/920-338-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/920-206-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/1104-560-0x0000000000AF0000-0x0000000000FC9000-memory.dmp

Filesize
4.8MB

Download
memory/1104-439-0x0000000000AF0000-0x0000000000FC9000-memory.dmp

Filesize
4.8MB

Download
memory/1436-786-0x0000000000AF0000-0x0000000000FC9000-memory.dmp

Filesize
4.8MB

Download
memory/2168-212-0x0000000001050000-0x0000000001529000-memory.dmp

Filesize
4.8MB

Download
memory/2168-446-0x0000000001050000-0x0000000001529000-memory.dmp

Filesize
4.8MB

Download
memory/2192-846-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/2192-325-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/2192-320-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/2840-216-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2840-217-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2840-331-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3452-201-0x00000000009E0000-0x00000000009EC000-memory.dmp

Filesize
48KB

Download
memory/4476-550-0x0000000001110000-0x00000000017A5000-memory.dmp

Filesize
6.6MB

Download
memory/4476-730-0x0000000001110000-0x00000000017A5000-memory.dmp

Filesize
6.6MB

Download
memory/4476-653-0x0000000001110000-0x00000000017A5000-memory.dmp

Filesize
6.6MB

Download
memory/4772-228-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/4772-229-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/4844-208-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5068-83-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-85-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-94-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-177-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-184-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-87-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-79-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-80-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-82-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-182-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-172-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-187-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-90-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-84-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-68-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-98-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-86-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-88-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-89-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-179-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-81-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-78-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-69-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-175-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-190-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-192-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5068-71-0x0000000000A00000-0x0000000000BE4000-memory.dmp

Filesize
1.9MB

Download
memory/5996-723-0x0000000001150000-0x00000000013B1000-memory.dmp

Filesize
2.4MB

Download
memory/5996-622-0x0000000001150000-0x00000000013B1000-memory.dmp

Filesize
2.4MB

Download