amadey | 2bef7f94ae35ae24ec6580311d98315cf34e82402ae1f71396e17d03250ccc61

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a1ac94cc27bf21fa3f542a09658a2c7.exe
Size 1.8MB
Sample241009-fb83wsserc
SHA256 2bef7f94ae35ae24ec6580311d98315cf34e82402ae1f71396e17d03250ccc61
MD5 1a1ac94cc27bf21fa3f542a09658a2c7
SHA1 d0242b0a3a14d9d12c84ed6552b8e1e0280a41c0
SHA512 5209536829cd3052f20169719fa80486398115149fddd3943653f53f17357dbecc0a44a240e72793a390e040619db8b1e5daba02d4cfdd98e712f831c2902228
SSDEEP 49152:vopf4CbB40MG8/SU50BJGcGq0V052j4qNNHd3HajHlgRwEpYrCjAt:ApfLBjTa0BkoX5vqNBoB1AY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey lumma redline stealc 9c9aa5 default2 doma fed3aa newbundle2 tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

redline

Botnet

newbundle2

185.215.113.67:15206

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29862

Extracted

Family

stealc

Botnet

doma

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 7 IoCs

resource	yara_rule
behavioral1/files/0x0006000000019c50-182.dat	family_redline
behavioral1/memory/1844-192-0x00000000009F0000-0x0000000000A42000-memory.dmp	family_redline
behavioral1/memory/1828-390-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1828-392-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1828-391-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1828-387-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1828-385-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	02f3150e43.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	65d85f5119.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0bdb17e067.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3856fa2c53.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	02f3150e43.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	65d85f5119.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0bdb17e067.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	02f3150e43.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	65d85f5119.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3856fa2c53.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3856fa2c53.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0bdb17e067.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	splwow64.exe

Executes dropped EXE 23 IoCs

pid	Process
2284	axplong.exe
1444	gold.exe
2008	legas.exe
2056	wSD9zvndpC.exe
2580	y41pgCs9Nj.exe
948	stealc_default2.exe
1844	newbundle2.exe
2112	0bdb17e067.exe
1204	3856fa2c53.exe
2652	skotes.exe
2536	MK.exe
2976	Nework.exe
2240	Hkbsse.exe
2396	processclass.exe
2008	splwow64.exe
1604	91d8be2514.exe
2864	num.exe
2524	javuma.exe
3332	02f3150e43.exe
1696	65d85f5119.exe
3220	context.exe
3224	service123.exe
2688	service123.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	0bdb17e067.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	3856fa2c53.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	02f3150e43.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	65d85f5119.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	1a1ac94cc27bf21fa3f542a09658a2c7.exe

Loads dropped DLL 49 IoCs

pid	Process
1952	1a1ac94cc27bf21fa3f542a09658a2c7.exe
2284	axplong.exe
2284	axplong.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2284	axplong.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
1556	MSBuild.exe
1556	MSBuild.exe
2284	axplong.exe
2284	axplong.exe
2284	axplong.exe
2284	axplong.exe
2284	axplong.exe
948	stealc_default2.exe
948	stealc_default2.exe
2284	axplong.exe
1204	3856fa2c53.exe
2284	axplong.exe
2284	axplong.exe
2976	Nework.exe
2284	axplong.exe
2284	axplong.exe
2652	skotes.exe
2652	skotes.exe
2652	skotes.exe
2240	Hkbsse.exe
2240	Hkbsse.exe
2652	skotes.exe
2652	skotes.exe
2652	skotes.exe
2652	skotes.exe
2652	skotes.exe
3652	WerFault.exe
3652	WerFault.exe
3652	WerFault.exe
3652	WerFault.exe
3652	WerFault.exe
2524	javuma.exe
2524	javuma.exe
3224	service123.exe
2688	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\0bdb17e067.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\0bdb17e067.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\3856fa2c53.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\3856fa2c53.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\91d8be2514.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000332001\\91d8be2514.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\num.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000336001\\num.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\02f3150e43.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000349001\\02f3150e43.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\65d85f5119.exe = "C:\\Users\\Admin\\1000350002\\65d85f5119.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001a4eb-453.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
1952	1a1ac94cc27bf21fa3f542a09658a2c7.exe
2284	axplong.exe
2112	0bdb17e067.exe
1204	3856fa2c53.exe
2652	skotes.exe
3332	02f3150e43.exe
1696	65d85f5119.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 1452	1444	gold.exe	34
PID 2008 set thread context of 1556	2008	legas.exe	37
PID 2536 set thread context of 1828	2536	MK.exe	51
PID 2008 set thread context of 3808	2008	splwow64.exe	88

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	3856fa2c53.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File created	C:\Windows\Tasks\axplong.job	1a1ac94cc27bf21fa3f542a09658a2c7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2952	1444	WerFault.exe	33
2328	2008	WerFault.exe	36
3652	3220	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65d85f5119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0bdb17e067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91d8be2514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f3150e43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javuma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3856fa2c53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	num.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	legas.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javuma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javuma.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1516	timeout.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
2168	taskkill.exe
2572	taskkill.exe
2560	taskkill.exe
3252	taskkill.exe
2472	taskkill.exe
2528	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 13 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	axplong.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	newbundle2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	wSD9zvndpC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	02f3150e43.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	02f3150e43.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	wSD9zvndpC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	axplong.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	newbundle2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	wSD9zvndpC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	wSD9zvndpC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	wSD9zvndpC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	wSD9zvndpC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	wSD9zvndpC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2968	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3220	context.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1952	1a1ac94cc27bf21fa3f542a09658a2c7.exe
2284	axplong.exe
948	stealc_default2.exe
2580	y41pgCs9Nj.exe
2056	wSD9zvndpC.exe
2112	0bdb17e067.exe
948	stealc_default2.exe
1204	3856fa2c53.exe
2652	skotes.exe
1828	RegAsm.exe
1604	91d8be2514.exe
1828	RegAsm.exe
1828	RegAsm.exe
1604	91d8be2514.exe
3332	02f3150e43.exe
3332	02f3150e43.exe
1696	65d85f5119.exe
1696	65d85f5119.exe
1696	65d85f5119.exe
2008	splwow64.exe
2008	splwow64.exe
2008	splwow64.exe
3220	context.exe
3220	context.exe
3220	context.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeBackupPrivilege	2580	y41pgCs9Nj.exe
Token: SeBackupPrivilege	2056	wSD9zvndpC.exe
Token: SeSecurityPrivilege	2580	y41pgCs9Nj.exe
Token: SeSecurityPrivilege	2056	wSD9zvndpC.exe
Token: SeSecurityPrivilege	2580	y41pgCs9Nj.exe
Token: SeSecurityPrivilege	2580	y41pgCs9Nj.exe
Token: SeSecurityPrivilege	2580	y41pgCs9Nj.exe
Token: SeSecurityPrivilege	2056	wSD9zvndpC.exe
Token: SeSecurityPrivilege	2056	wSD9zvndpC.exe
Token: SeSecurityPrivilege	2056	wSD9zvndpC.exe
Token: SeDebugPrivilege	2056	wSD9zvndpC.exe
Token: SeDebugPrivilege	2580	y41pgCs9Nj.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	1828	RegAsm.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	2168	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	2868	firefox.exe
Token: SeDebugPrivilege	2868	firefox.exe
Token: SeDebugPrivilege	2396	processclass.exe
Token: SeDebugPrivilege	2008	splwow64.exe
Token: SeDebugPrivilege	3252	taskkill.exe
Token: SeDebugPrivilege	3220	context.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
1952	1a1ac94cc27bf21fa3f542a09658a2c7.exe
1204	3856fa2c53.exe
2976	Nework.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
2868	firefox.exe
2868	firefox.exe
2868	firefox.exe
2868	firefox.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
2868	firefox.exe
2868	firefox.exe
2868	firefox.exe
1604	91d8be2514.exe
1604	91d8be2514.exe
1604	91d8be2514.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2284	1952	1a1ac94cc27bf21fa3f542a09658a2c7.exe	30
PID 1952 wrote to memory of 2284	1952	1a1ac94cc27bf21fa3f542a09658a2c7.exe	30
PID 1952 wrote to memory of 2284	1952	1a1ac94cc27bf21fa3f542a09658a2c7.exe	30
PID 1952 wrote to memory of 2284	1952	1a1ac94cc27bf21fa3f542a09658a2c7.exe	30
PID 2284 wrote to memory of 1444	2284	axplong.exe	33
PID 2284 wrote to memory of 1444	2284	axplong.exe	33
PID 2284 wrote to memory of 1444	2284	axplong.exe	33
PID 2284 wrote to memory of 1444	2284	axplong.exe	33
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 1452	1444	gold.exe	34
PID 1444 wrote to memory of 2952	1444	gold.exe	35
PID 1444 wrote to memory of 2952	1444	gold.exe	35
PID 1444 wrote to memory of 2952	1444	gold.exe	35
PID 1444 wrote to memory of 2952	1444	gold.exe	35
PID 2284 wrote to memory of 2008	2284	axplong.exe	36
PID 2284 wrote to memory of 2008	2284	axplong.exe	36
PID 2284 wrote to memory of 2008	2284	axplong.exe	36
PID 2284 wrote to memory of 2008	2284	axplong.exe	36
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 1556	2008	legas.exe	37
PID 2008 wrote to memory of 2328	2008	legas.exe	38
PID 2008 wrote to memory of 2328	2008	legas.exe	38
PID 2008 wrote to memory of 2328	2008	legas.exe	38
PID 2008 wrote to memory of 2328	2008	legas.exe	38
PID 1556 wrote to memory of 2056	1556	MSBuild.exe	39
PID 1556 wrote to memory of 2056	1556	MSBuild.exe	39
PID 1556 wrote to memory of 2056	1556	MSBuild.exe	39
PID 1556 wrote to memory of 2056	1556	MSBuild.exe	39
PID 1556 wrote to memory of 2580	1556	MSBuild.exe	40
PID 1556 wrote to memory of 2580	1556	MSBuild.exe	40
PID 1556 wrote to memory of 2580	1556	MSBuild.exe	40
PID 1556 wrote to memory of 2580	1556	MSBuild.exe	40
PID 2284 wrote to memory of 948	2284	axplong.exe	41
PID 2284 wrote to memory of 948	2284	axplong.exe	41
PID 2284 wrote to memory of 948	2284	axplong.exe	41
PID 2284 wrote to memory of 948	2284	axplong.exe	41
PID 2284 wrote to memory of 1844	2284	axplong.exe	42
PID 2284 wrote to memory of 1844	2284	axplong.exe	42
PID 2284 wrote to memory of 1844	2284	axplong.exe	42
PID 2284 wrote to memory of 1844	2284	axplong.exe	42
PID 2284 wrote to memory of 2112	2284	axplong.exe	46
PID 2284 wrote to memory of 2112	2284	axplong.exe	46
PID 2284 wrote to memory of 2112	2284	axplong.exe	46
PID 2284 wrote to memory of 2112	2284	axplong.exe	46
PID 2284 wrote to memory of 1204	2284	axplong.exe	47
PID 2284 wrote to memory of 1204	2284	axplong.exe	47
PID 2284 wrote to memory of 1204	2284	axplong.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1a1ac94cc27bf21fa3f542a09658a2c7.exe
"C:\Users\Admin\AppData\Local\Temp\1a1ac94cc27bf21fa3f542a09658a2c7.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 96
      4⤵
      Loads dropped DLL
      Program crash
      PID:2952
- - C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Users\Admin\AppData\Roaming\wSD9zvndpC.exe
        
        "C:\Users\Admin\AppData\Roaming\wSD9zvndpC.exe"
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Users\Admin\AppData\Roaming\y41pgCs9Nj.exe
        
        "C:\Users\Admin\AppData\Roaming\y41pgCs9Nj.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 52
      4⤵
      Loads dropped DLL
      Program crash
      PID:2328
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\1000354001\0bdb17e067.exe
    "C:\Users\Admin\AppData\Local\Temp\1000354001\0bdb17e067.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\1000355001\3856fa2c53.exe
    "C:\Users\Admin\AppData\Local\Temp\1000355001\3856fa2c53.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\1000332001\91d8be2514.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000332001\91d8be2514.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1604
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:2920
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2868
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.0.469616432\452905895" -parentBuildID 20221007134813 -prefsHandle 1240 -prefMapHandle 1232 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c34f156-dcc6-4dba-bdec-fb3375d73ae2} 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1304 101d1a58 gpu
        8⤵
        
        PID:2472
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.1.1175754062\1649904978" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c672b101-b4db-4a0a-ac33-d081d88e0b1b} 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1520 43ec158 socket
        8⤵
        
        PID:2092
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.2.514141693\1779397838" -childID 1 -isForBrowser -prefsHandle 1976 -prefMapHandle 1972 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fba4db45-8322-4af6-9278-9000bbcf9ec6} 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1816 1a29eb58 tab
        8⤵
        
        PID:1052
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.3.1858281260\999874171" -childID 2 -isForBrowser -prefsHandle 2640 -prefMapHandle 2636 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da24894c-3e99-4ece-8115-579c70a5fc89} 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 2656 1cef6e58 tab
        8⤵
        
        PID:768
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.4.290647767\852474819" -childID 3 -isForBrowser -prefsHandle 3860 -prefMapHandle 3828 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f10a2c5a-86a9-457b-af7a-24051300e8ea} 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 3884 206b3e58 tab
        8⤵
        
        PID:1876
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.5.2058584002\1096760082" -childID 4 -isForBrowser -prefsHandle 4012 -prefMapHandle 4016 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5194aa2d-4224-4d6d-80a2-182041695284} 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 4000 20af9958 tab
        8⤵
        
        PID:3112
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.6.465568953\1951920164" -childID 5 -isForBrowser -prefsHandle 4188 -prefMapHandle 4192 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10399b3d-a8a3-45b6-9a54-bda603a7a9a2} 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 4176 20af8458 tab
        8⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\1000349001\02f3150e43.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000349001\02f3150e43.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:3332
    - - C:\Users\Admin\1000350002\65d85f5119.exe
        
        "C:\Users\Admin\1000350002\65d85f5119.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        
        PID:2296
- - C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
    "C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2536
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1828
- - C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
    "C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\1000077001\javuma.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000077001\javuma.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3224
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2968
- - C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
    "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start context.exe
      4⤵
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 732
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:3652
- - C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
    "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:3080
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3808
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1516

C:\Windows\system32\taskeng.exe
taskeng.exe {DEB2A651-698D-49EC-89E0-2898B504CC82} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]
1⤵
PID:1168
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 05351deef1e82241400c46381068387e842399836fb963453a3d6d192d26d673
MD5 af537edd13222077b576c01839713901
SHA1 a2b8c785838f38387692154f3dc7725e4b522ff9
SHA512 95a6410028471feb1ad451f5b2b2a7574c87409a998628d436b6736bccda18977963768c7b197e544de829c21554b02a405ded452d1d9a4ddc9474b01c82e85d
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 53f48a092cafa22281b90b8c891869c728c540a013c2c316e69b09a1e93aeeaa
MD5 dbd70c2eefca422c163d34c29193b9a5
SHA1 e3079872981cf65e68c3cc9c2eb79911fb08a489
SHA512 68a2623fcee3b4ffd60f14de808f68713e6e825583f82a361e6621acd084a5df4d3cdfa82a4c36b800387b7dd4d1c2a62749b0f28ec5a4c3be607ce8963a79d1
MD5 SHA1 SHA512

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\activity-stream.discovery_stream.json.tmp
Size 29KB
SHA256 39af1e5a42f0317125e7a4ebd9db533dde3f53c85419119a6876063c91a7cdbf
MD5 6350780946307b6e0f4ad7abf9758abf
SHA1 730263f0af814314b4401f699c67d1102f76cf74
SHA512 fbe8c8a5f9248e2926276027c7dd18559bb71f1bfb94d0491792a048c0a288edf8198d6eae3bf872cc0939cfd4e6f2cdf940739c5ed31df45bfe555820195d32
SSDEEP 384:zPvt2YuxaB6SorgFkUmrhAFabHZiwoLlkTfHyauotct17M/t6c:zPkYuxaVFEkabHZi/uHydYE1I16c
MD5 SHA1 SHA512 SSDEEP

Submit Download

gold.exe

Path C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
Size 566KB
SHA256 b78402483c46cd37e2c204d95690aa2a213616a1f904d779ceec0e22fcdd6531
MD5 049b6fe48a8cfb927648ad626aba5551
SHA1 9555d23104167e4fad5a178b4352831ce620b374
SHA512 ed787f90966ca1ea4b1e67c4026dd44393c7d312cd52e376f4ba5e5c49616938ec9e913044def29b40b441eb4c913a5134bb78317a179f62067bef3f9d913c7e
SSDEEP 12288:1jlubWMRDyAWLTf1MHzziuddD//x5gmwA964f2ETEO:1j4qMRqpMTziQdD/wjbmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

legas.exe

Path C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
Size 1.3MB
SHA256 c02fcc32573f4546201515667154d9e51e2636af52a1790d1063183c0d012566
MD5 24402fc0617a2740c16ea9c81518d669
SHA1 a0476ef848cd11bb20f8efd06e295a0f44c956ca
SHA512 dd90c0036a8a109c5645b481f1bd7b193fa86518183790b75dbc400416793fb8f9e7d4d4621d7c0227cbbf483758a03a94581397686b09c6f65218b651b5bc63
SSDEEP 24576:0kVD4LnqAsYilQNDuhy/Nl3je9DwScE8VhCqkCLGZiSYAcdin6u1Tp/1K:0SD4Lnq5Yi2NiM1l3ZS0htskE6iTpdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealc_default2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
Size 187KB
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
SSDEEP 3072:QJlVTFj5qDao8KaxfE54HnnGSail+bOX8bX60UFHJKa:QJP5j5Ka2aOanGSabY860UFpKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

javuma.exe

Path C:\Users\Admin\AppData\Local\Temp\1000077001\javuma.exe
Size 6.8MB
SHA256 4d17234e7d928fe07ad348777e08e80cf1b50530c7997645b5f4eb896c0d4404
MD5 8022d07f97b41440f4be8229f5a57069
SHA1 313b34e34c003aa7d4bfd84f7dc6e44503a1e4b7
SHA512 17fd1e31a91d9f0a1303b09d31e815aeed05de5c99e4b821af9b5366e3fa7d4505350b11cc530181b4d5054bfcd457dac45d497aac9556f42a882c5fc9958bb1
SSDEEP 49152:I8oGKIqb64Lw0fGPWVsWeqU9eR7FToV4SFqSiqL7EI4ohxbq3zDzAQJ5JZGW:I8tj4MiB5eqkyFUV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealc_magent.exe

Path C:\Users\Admin\AppData\Local\Temp\1000254001\stealc_magent.exe
Size 10B
SHA256 7515bf959b73b956ceb967351c7e299cbb3668a53d35f9c770eb72e00d93ced6
MD5 ef81e41d11c9e7193ddd3d470dbb3eda
SHA1 0c15d12755a0be84e6403445c427231c274919c6
SHA512 bf69c60fbb6d5ff50d81cd093cbabe59cd4eed439822e9ed02472245c3dae033cec143f1c4bbe6f702b7530f87c020442217ca1859da8f4b0f578a93b46cbdfa
MD5 SHA1 SHA512

Submit Download

newbundle2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
Size 304KB
SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
MD5 58e8b2eb19704c5a59350d4ff92e5ab6
SHA1 171fc96dda05e7d275ec42840746258217d9caf0
SHA512 e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
SSDEEP 3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

91d8be2514.exe

Path C:\Users\Admin\AppData\Local\Temp\1000332001\91d8be2514.exe
Size 897KB
SHA256 a87c0f18e15e7b1a8b13354f2107c3d6b1e60da88a5bb196319fa2d7087619bd
MD5 787198c3296e8495382a16e38dcd2cc9
SHA1 64647dcf4d7df0ca054e72a6eba2d62bd5be9d3c
SHA512 df760d7ee602b2cf03d7055812dda63625939bd5803cd7c14d90872d1eb4d3208343c323409c47154308cc4824b295ecdb2bc095b77efee5ff5e15e1bfe28efb
SSDEEP 12288:/qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaxTk:/qDEvCTbMWu7rQYlBQcBiT6rprG8aFk
MD5 SHA1 SHA512 SSDEEP

Submit Download

num.exe

Path C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
Size 307KB
SHA256 27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d
MD5 791fcee57312d4a20cc86ae1cea8dfc4
SHA1 04a88c60ae1539a63411fe4765e9b931e8d2d992
SHA512 2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c
SSDEEP 6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

02f3150e43.exe

Path C:\Users\Admin\AppData\Local\Temp\1000349001\02f3150e43.exe
Size 1.7MB
SHA256 16413a4fbd8e9220e8aac3443d8a4b4f3db01063afc16caf82a5554e3d897393
MD5 9028d6ec8410d854d7a504f65bec566d
SHA1 02b33689d29b36bec5a80d5a65c3cf311f21e33b
SHA512 6bd5962d35f1855354c93ed94444680a6727e071b1607252ac2c1a4ec1ff5efdc6f74be42d2306c2ed9ef60cb2e9adaa6ed0ff2b36ca38c7c04d7f53ddb16cc1
SSDEEP 49152:g3O8bOEUzvnGdPaRpc6hqWsckXJ1FeqIhEuVP:MTbezvnJPc6XnkZmqwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

0bdb17e067.exe

Path C:\Users\Admin\AppData\Local\Temp\1000354001\0bdb17e067.exe
Size 1.8MB
SHA256 44dde1f10c72c11df8d7f33d7f0f9570b2257b3783de13efd19a5103e886c9b5
MD5 12e34403109e8cb8c389674544a983a8
SHA1 a1d72bce0f37a06826382a6f7b803fe33917f53d
SHA512 434148f3ab3b09bea60d3b713aacf6e6e414d51565f17df67dfd87596383d90d50d6826309d4489e02179b04da5390a962c4abe3270907e698ecb7dac0241014
SSDEEP 49152:BuIn0YPMGmdAs6QQ27UH7ADUS1JF4tPE+a0u0A:ButYmmkQJGUS1JFVsA
MD5 SHA1 SHA512 SSDEEP

Submit Download

3856fa2c53.exe

Path C:\Users\Admin\AppData\Local\Temp\1000355001\3856fa2c53.exe
Size 1.8MB
SHA256 369a92254621e22bf54c611a279fef9a2ee870182c48db2e93ec233f53e64ba3
MD5 4c7763c0a1a0834602ff210a455c15c1
SHA1 2e31899c521e2dd8cbd4d5abe2de5fab9e0fb8ae
SHA512 b578a380b8dfe5f15797e47430698007f06fe500970dc2a430a5e27af7349a5b2bac106fcf8397f138d9d41640a85ec33ceb8447dbcaf7a1b7728d0d6248ee7b
SSDEEP 49152:i1+q1/5YzpG0V6BToYpbZX32wkLttk3gP1:C+q1/55AwcGM7Lt4gP1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MK.exe

Path C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
Size 314KB
SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
MD5 ff5afed0a8b802d74af1c1422c720446
SHA1 7135acfa641a873cb0c4c37afc49266bfeec91d8
SHA512 11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac
SSDEEP 6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nework.exe

Path C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
Size 416KB
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
SSDEEP 12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5 SHA1 SHA512 SSDEEP

Submit Download

processclass.exe

Path C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
Size 6KB
SHA256 a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6
MD5 c042782226565f89ce3954489075e516
SHA1 256dd5ba42837a33c7aa6cb71cef33d5617117ee
SHA512 9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd
SSDEEP 96:KR0JUnFk9YV0Y9btrzxSC6+1lcBrs4VvlrljlQ0ljhFEuxlSRjbumOLzNt:p396VLSN2GQEvlrljlQ0lj3lMHON
MD5 SHA1 SHA512 SSDEEP

Submit Download

splwow64.exe

Path C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
Size 1.1MB
SHA256 53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a
MD5 ed9393d5765529c845c623e35c1b1a34
SHA1 d3eca07f5ce0df847070d2d7fe5253067f624285
SHA512 565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8
SSDEEP 24576:SjmUMPBrmM35axAiLlvySI1/vJDFBLBYcJ82mnNOt6QVqJYLkmAp984BRCqQGejK:SjmUMPBrmM35axAiLlvySI1/vJDFBLB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

axplong.exe

Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
Size 1.8MB
SHA256 2bef7f94ae35ae24ec6580311d98315cf34e82402ae1f71396e17d03250ccc61
MD5 1a1ac94cc27bf21fa3f542a09658a2c7
SHA1 d0242b0a3a14d9d12c84ed6552b8e1e0280a41c0
SHA512 5209536829cd3052f20169719fa80486398115149fddd3943653f53f17357dbecc0a44a240e72793a390e040619db8b1e5daba02d4cfdd98e712f831c2902228
SSDEEP 49152:vopf4CbB40MG8/SU50BJGcGq0V052j4qNNHd3HajHlgRwEpYrCjAt:ApfLBjTa0BkoX5vqNBoB1AY
MD5 SHA1 SHA512 SSDEEP

Submit Download

CabF3C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabF3C1.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarF47F.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarF47F.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmpF835.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpF835.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_d9071d2c-e5ad-4187-a976-30114bb93bf6

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000\76b53b3ec448f7ccdda2063b15d2bfc3_d9071d2c-e5ad-4187-a976-30114bb93bf6
Size 2KB
SHA256 775d3a3b9fb52a7dbd447110a25a2e2edd09aa8618f28ac1bc9e6a6ca686c2a7
MD5 d4f99973e0f9f511cdc601147a2b5abc
SHA1 95ec8de378d9f5abc35cc0b71ae74b0b3aaa2ae1
SHA512 b520728deba7b5eac7d2cd13d412d80edc43be5da9a9f3ef57c1ef6c53f619ba913a6e5e5cb845ab86cea7e4d2b83869450283372cbefb32c4f289e3f1363f5f
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 0746092d9fc0bf375b5d41dc359cda3c9fbcabee568435d2aed4a865ef203e0c
MD5 83969901e9d0ae8431c1836410f70cac
SHA1 c43c61ef9700d86590f51bf49be88f4d256be475
SHA512 aa26b11aa1b92c8c5ce8def6e62b56617b8ac678fcc5334d69d1d1d540633a82d8b8e7211bbfdde8848d561210768c301b6ff960ef545fb84265b2bf8b517ee1
MD5 SHA1 SHA512

Submit Download

0d5f0154-c7e9-45e6-b5b4-87e4ce11b27a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\0d5f0154-c7e9-45e6-b5b4-87e4ce11b27a
Size 10KB
SHA256 f165fe9287e1490910a07a78f718e7f1f1ddcdf730080f59cff5624b2d9017fe
MD5 93762c5abbbd0c697f646be22cf7deb1
SHA1 06d69ebd5fa2198a54ecbbbbc39cffef1d0c1f63
SHA512 3b1a7371f16849fd629be0538da6c67c6729b50933b45c79d750b6ac04fb6675ac937dfd6efca10d2d2edef604935854794774b5938d01eee39738a94e04f45b
SSDEEP 192:Rd5yqa8r5V6+98/Yha4O+bqgPpYLWSf21e5M7jbVPX2z65QKUcj9Cz7LNM:rha8mm8iSMVoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

67e809d5-138c-45ac-9eec-06b4a092fdc6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\67e809d5-138c-45ac-9eec-06b4a092fdc6
Size 745B
SHA256 f457551da5549b557547ce3600d16ce75217ff6c9c1f09ec48845ac68ed32b52
MD5 c21ca1201b4c6a45c80deda21937ab0d
SHA1 1a7278d512affb157536f0f794b6fab6556fb931
SHA512 4b018703998dd815fc2ad2e893346ac438a4085a4f263008e453ec439c9721d562746e31614eff699c774544723b7bf732d11b887b5f52997604c1d63ce2a659
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js
Size 6KB
SHA256 3b36b4ae3d8f91b83a06044103bac6d66fdb7530d7ef8b2cae17234db5fd9ee0
MD5 13a20e05e4ebad3ca4af975b15ae580f
SHA1 c549bb56ea571abf719401c4df322374fc2034f6
SHA512 ea65558a957bdb34922d2aa656eda771142013d5a5726262e0afe6fc7f70f3a14862d174607406fcc2d25a071b65e88c4cbfc4fac857877ad32064bb8095fb95
SSDEEP 96:xHI5nUTeqGqPrdbrM4eOTzS+PXAnpjjHq26OuZBw8H7Rp:O5nIRjdbrDesPX+AOSBw8H7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js
Size 7KB
SHA256 0ccf4dfeae402bba65344620cc63a981d15cae008c8a0c115cc5c405d4cc2480
MD5 7c8b82f70c16a94187992c08359599c7
SHA1 f63d38399b0382bb546e6ac1fa7522c209ab68c6
SHA512 89e7e8b7b1d9d20e791d57291183d15316b7f66e0a7c6dec3cdb1c8eeda3532eeb9dc72bb11060a474dac00975023c155891849e1504ccdd58b5813a19ac91f7
SSDEEP 96:xHDSnUTeqGqPrdbrM4eOTzS+PXAnpjjHq26OutBw8H7Rp:JSnIRjdbrDesPX+AOmBw8H7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js
Size 6KB
SHA256 02bae4f680e664771f1dc4a330ebd50ac3c128ee29dc47477771da6ea8c75fc9
MD5 bfa9d16bdb782e9bf7f9099e5cb62f0a
SHA1 0a9560159e67424e09110b3e9d23b924f87c3333
SHA512 30dcb4a10c29100c6d062c2c899801c917ea9d79574b571d06fc0ccab867f66b8de036b478b282f784f09aa12c05fa464b9489dca6cfd076fd671de8b8ade3b5
SSDEEP 96:xHI5nUTeqGqP5db/9eOTzS+PXAnpjVGHq26OuZBw8H7Rp:O5nIRhdb/9esPXsIAOSBw8H7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js
Size 6KB
SHA256 0acfff9b51ae2c0f85ed13730f5771a9e02d49ebd090d0f38a53e6035877399a
MD5 4f3aae5f3bf94f90a1bade71f31f2659
SHA1 54417768424a76b9744d84960f85a1b4b952c2cb
SHA512 2302e01e8655483e70e5fa6788e6ef97e5df0c2494ea7571e2d9b0ebdd072576fa31fa2293d5c74db54e98f915ea36a698477bfa2fdad42074a309dc26789392
SSDEEP 96:xHI5nUTeqGqPrdb/9eOTzSQPXAnpjVGHq26OuZBw8V7Rp:O5nIRjdb/9eePXsIAOSBw8V7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 aa77f78c3feb5a928f9b92272ea4c079617e658c00ec2cdfc7dc23b0cabbe804
MD5 ce555337d75d3d35390ee00bb72b2768
SHA1 ec2cd4a3215dd51e1cd6d6d818dac2380a51b36e
SHA512 e6317541c61738ed82650b0b6f0aff167be12ce2bc001a66835f6a676cb4fc9067fa33463127fca649abd8234ca8da658ee5cfee1b3d555c9758c9b3a2d87d17
SSDEEP 96:rz4NrR6It8JwTrEGJF7xDM7k0zf8W8Qge3ZwS2Fup3qLrxBZ/BiP:3OAN4QiFxM7kcuem5uAxDZiP
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 50ad3c39b8eac5f7fb5121feea02fa552af809e7b4cb2c5628c2c47bd6329bf3
MD5 7d5f855a7b8e99ecfe9d2b3c7f1992e6
SHA1 138562d8b6f87181cba87ec3b0e2c10be7169daa
SHA512 19bebacde294735d12aafacf8dfa3aad4984922b71d17658cf29d2cae90876d9da165cf133575b319ff811354177b29f1d320f22d33eb223e63a2ca8f8f318c8
SSDEEP 3072:3mcHDPRuFPF3y3Q6uaS9vAee6ua9QGeHhPZY:3mcHDPR093y3Q6uaie6ua9QGeHbY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 77c749ce967d0437f8dce2184f9d45c89a1144fcdf99c9dc6cc8535a3f45cf11
MD5 9a1007aa4605dfdbced6395f0202db9b
SHA1 47b4f39411d258c6be8de5cc4c7e39b2eadab619
SHA512 f1dea9df274f810dbd972b897df67b7e434f49e982155c43bd698b92aa3fec663fb77df6f2480218bfcb5f6b38bc7d41de4aebe90de7cadbd5109cfc50ccb0e3
MD5 SHA1 SHA512

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wSD9zvndpC.exe

Path \Users\Admin\AppData\Roaming\wSD9zvndpC.exe
Size 602KB
SHA256 973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a
MD5 e4fc58d334930a9d6572c344e5129f6b
SHA1 d38fbd0c4c86eee14722f40cc607e2128c01b00f
SHA512 a69f5da8de8c9782769cca2e2fc5b28bbeba0c0d0027954dbe47b15610d82277abbe912f0e5921a18000f1a3a3c54eb5922f70c773537a22f4b35ff926d17a59
SSDEEP 6144:nxLHgtvsrT8Y82Mgp17GA1Ce9OkksWY0TNQlMAqgDqJW9HVh:nxTgtvUQl2Mi50hQlMlgz9/
MD5 SHA1 SHA512 SSDEEP

Submit Download

y41pgCs9Nj.exe

Path \Users\Admin\AppData\Roaming\y41pgCs9Nj.exe
Size 393KB
SHA256 3d66fed04c76d055c6149b33dcfda544b509c57087c57a861e1d6256b59f8465
MD5 7d7366ab79d6d3d8d83d13a8b30de999
SHA1 75c6c49a6701d254c3ce184054a4a01329c1a6f3
SHA512 64f4551b3be1c21ce7c2d49608463e5aec4166e3e6893883c33a5b7d1109ef0fc8ab6bd15c70d9d606e2706f12a937c2d90d5bc8f6c629ad6f30f212dc25f022
SSDEEP 6144:qhUGuz/J74kSIjF0nLuMjqrWqOckWkqrDzP8U3S0pM:qhUGix7cKaqraHWhr5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-207-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/948-125-0x0000000000CF0000-0x0000000000F33000-memory.dmp

Download

memory/948-376-0x0000000000CF0000-0x0000000000F33000-memory.dmp

Download

memory/1204-361-0x00000000001A0000-0x000000000066B000-memory.dmp

Download

memory/1204-343-0x00000000001A0000-0x000000000066B000-memory.dmp

Download

memory/1444-284-0x0000000000237000-0x0000000000238000-memory.dmp

Download

memory/1444-38-0x0000000000237000-0x0000000000238000-memory.dmp

Download

memory/1452-42-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1452-43-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1452-39-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1452-41-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1452-48-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1452-47-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1452-46-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1452-40-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1452-44-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1556-78-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-99-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-74-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-71-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-82-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-68-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-72-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-76-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-81-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1556-83-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/1828-387-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1828-383-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1828-392-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1828-391-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1828-389-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1828-381-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1828-385-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1828-390-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1844-192-0x00000000009F0000-0x0000000000A42000-memory.dmp

Download

memory/1952-0-0x0000000001390000-0x000000000184B000-memory.dmp

Download

memory/1952-14-0x0000000001390000-0x000000000184B000-memory.dmp

Download

memory/1952-15-0x00000000071C0000-0x000000000767B000-memory.dmp

Download

memory/1952-4-0x0000000001390000-0x000000000184B000-memory.dmp

Download

memory/1952-3-0x0000000001390000-0x000000000184B000-memory.dmp

Download

memory/1952-2-0x0000000001391000-0x00000000013BF000-memory.dmp

Download

memory/1952-1-0x0000000077C80000-0x0000000077C82000-memory.dmp

Download

memory/2008-478-0x00000000066B0000-0x0000000006734000-memory.dmp

Download

memory/2008-477-0x0000000001060000-0x0000000001178000-memory.dmp

Download

memory/2056-104-0x0000000000CB0000-0x0000000000D4C000-memory.dmp

Download

memory/2112-420-0x0000000000DE0000-0x0000000001495000-memory.dmp

Download

memory/2112-306-0x0000000000DE0000-0x0000000001495000-memory.dmp

Download

memory/2112-435-0x0000000000DE0000-0x0000000001495000-memory.dmp

Download

memory/2284-303-0x0000000006A60000-0x0000000007115000-memory.dmp

Download

memory/2284-136-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2284-865-0x0000000006950000-0x0000000006B93000-memory.dmp

Download

memory/2284-864-0x0000000006950000-0x0000000006B93000-memory.dmp

Download

memory/2284-121-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2284-54-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2284-122-0x0000000006950000-0x0000000006B93000-memory.dmp

Download

memory/2284-124-0x0000000006950000-0x0000000006B93000-memory.dmp

Download

memory/2284-21-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2284-379-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2284-19-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2284-18-0x00000000003B1000-0x00000000003DF000-memory.dmp

Download

memory/2284-358-0x0000000006A60000-0x0000000007115000-memory.dmp

Download

memory/2284-342-0x0000000006A60000-0x0000000006F2B000-memory.dmp

Download

memory/2284-91-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2284-17-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2284-304-0x0000000006A60000-0x0000000007115000-memory.dmp

Download

memory/2284-479-0x0000000006A60000-0x0000000006F2B000-memory.dmp

Download

memory/2284-105-0x00000000003B0000-0x000000000086B000-memory.dmp

Download

memory/2396-448-0x0000000000940000-0x0000000000948000-memory.dmp

Download

memory/2524-584-0x0000000069CC0000-0x000000006A377000-memory.dmp

Download

memory/2536-378-0x0000000000140000-0x0000000000194000-memory.dmp

Download

memory/2580-103-0x0000000000340000-0x00000000003A8000-memory.dmp

Download

memory/2652-359-0x0000000000380000-0x000000000084B000-memory.dmp

Download

memory/2652-703-0x0000000006C10000-0x00000000072C5000-memory.dmp

Download

memory/2652-889-0x0000000006C10000-0x0000000006E71000-memory.dmp

Download

memory/2652-730-0x0000000006C10000-0x00000000072C5000-memory.dmp

Download

memory/2652-731-0x0000000006C10000-0x00000000072C5000-memory.dmp

Download

memory/2652-716-0x0000000006C10000-0x00000000070AC000-memory.dmp

Download

memory/2652-636-0x0000000006C10000-0x00000000070AC000-memory.dmp

Download

memory/2652-888-0x0000000006C10000-0x0000000006E71000-memory.dmp

Download

memory/2652-496-0x0000000006C10000-0x0000000006E71000-memory.dmp

Download

memory/2652-505-0x0000000000380000-0x000000000084B000-memory.dmp

Download

memory/2652-637-0x0000000006C10000-0x00000000070AC000-memory.dmp

Download

memory/2652-519-0x0000000000380000-0x000000000084B000-memory.dmp

Download

memory/2652-702-0x0000000006C10000-0x00000000072C5000-memory.dmp

Download

memory/2652-497-0x0000000006C10000-0x0000000006E71000-memory.dmp

Download

memory/2864-499-0x0000000001150000-0x00000000013B1000-memory.dmp

Download

memory/2864-498-0x0000000001150000-0x00000000013B1000-memory.dmp

Download

memory/3220-718-0x0000000000810000-0x0000000000928000-memory.dmp

Download

memory/3220-719-0x0000000006670000-0x00000000066F4000-memory.dmp

Download

memory/3332-638-0x0000000000860000-0x0000000000CFC000-memory.dmp

Download

memory/3332-715-0x0000000000860000-0x0000000000CFC000-memory.dmp

Download