amadey | 71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5

Analysis

max time kernel
104s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
Size

1.8MB
MD5

2063ad6746859ba2896e6d3bc7082fbc
SHA1

f29d5bca4a5c61ba291be6cff88a46d5ac3babd0
SHA256

71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5
SHA512

1f1cdaf3cacced639f8d5e60a11ed515b52d7687032dd27bd41e0e42c15f2a226dbe4f8735f689a13dbb1eba112dfebbb237601e21af65e7f1f4d08b21720ae0
SSDEEP

49152:7Vel+D6aTiNJ68++EcPsRq+jkFSXc1wEoIJuL:7Yq723pEcmq+jhcqRL

Score

10^/10

amadey lumma stealc xworm 9c9aa5 mars credential_access discovery evasion execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

Version

5.0

backto54.duckdns.org:8989

helldog24.duckdns.org:8989

Mutex

7Fvn9wsSHJeXUB5q

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

lumma

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://property-imper.sbs

Extracted

Family

stealc

Botnet

mars

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://blade-govern.sbs/api

https://story-tense-faz.sbs/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5136-1389-0x0000000000390000-0x00000000003A0000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	145c7b78f1.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	145c7b78f1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	46d9574b72.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e38eb3cc9b.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4988	powershell.exe
4808	powershell.exe
2340	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	filer.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Uses browser remote debugging 2 TTPs 18 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2844	chrome.exe
5920	msedge.exe
5816	msedge.exe
2296	chrome.exe
5100	chrome.exe
1676	chrome.exe
3820	chrome.exe
1800	chrome.exe
1392	msedge.exe
5432	msedge.exe
884	chrome.exe
4428	chrome.exe
5844	msedge.exe
2704	chrome.exe
1880	chrome.exe
4752	chrome.exe
5072	chrome.exe
2300	chrome.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	145c7b78f1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	145c7b78f1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e38eb3cc9b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e38eb3cc9b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	46d9574b72.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	46d9574b72.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	VBVEd6f.exe

Executes dropped EXE 9 IoCs

pid	Process
2484	skotes.exe
4156	VBVEd6f.exe
5360	skotes.exe
3876	filer.exe
4856	skotes.exe
3156	145c7b78f1.exe
5128	46d9574b72.exe
6028	e38eb3cc9b.exe
396	0f56ade15a.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	145c7b78f1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	46d9574b72.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	e38eb3cc9b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	skotes.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\46d9574b72.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009394001\\46d9574b72.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e38eb3cc9b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009395001\\e38eb3cc9b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0f56ade15a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009396001\\0f56ade15a.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
102	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0003000000000747-1989.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2344	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
2484	skotes.exe
5360	skotes.exe
4856	skotes.exe
3156	145c7b78f1.exe
5128	46d9574b72.exe
6028	e38eb3cc9b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 5136	2340	powershell.exe	103

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5004	5128	WerFault.exe	147
2552	6028	WerFault.exe	149

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38eb3cc9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VBVEd6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46d9574b72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	145c7b78f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f56ade15a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e38eb3cc9b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	e38eb3cc9b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VBVEd6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VBVEd6f.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3128	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4780	wmic.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	103	Go-http-client/1.1

Kills process with taskkill 5 IoCs

evasion

pid	Process
2360	taskkill.exe
5280	taskkill.exe
6128	taskkill.exe
5512	taskkill.exe
5604	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133771312794471109"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2344	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
2344	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
2484	skotes.exe
2484	skotes.exe
4156	VBVEd6f.exe
4156	VBVEd6f.exe
2340	powershell.exe
4156	VBVEd6f.exe
4156	VBVEd6f.exe
2340	powershell.exe
1676	chrome.exe
1676	chrome.exe
5360	skotes.exe
5360	skotes.exe
4156	VBVEd6f.exe
4156	VBVEd6f.exe
5136	RegAsm.exe
4156	VBVEd6f.exe
4156	VBVEd6f.exe
3024	msedge.exe
3024	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
1392	msedge.exe
1392	msedge.exe
4156	VBVEd6f.exe
4156	VBVEd6f.exe
4988	powershell.exe
4988	powershell.exe
4808	powershell.exe
4808	powershell.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe
3876	filer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeDebugPrivilege	5136	RegAsm.exe
Token: SeDebugPrivilege	3876	filer.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeIncreaseQuotaPrivilege	6012	wmic.exe
Token: SeSecurityPrivilege	6012	wmic.exe
Token: SeTakeOwnershipPrivilege	6012	wmic.exe
Token: SeLoadDriverPrivilege	6012	wmic.exe
Token: SeSystemProfilePrivilege	6012	wmic.exe
Token: SeSystemtimePrivilege	6012	wmic.exe
Token: SeProfSingleProcessPrivilege	6012	wmic.exe
Token: SeIncBasePriorityPrivilege	6012	wmic.exe
Token: SeCreatePagefilePrivilege	6012	wmic.exe
Token: SeBackupPrivilege	6012	wmic.exe
Token: SeRestorePrivilege	6012	wmic.exe
Token: SeShutdownPrivilege	6012	wmic.exe
Token: SeDebugPrivilege	6012	wmic.exe
Token: SeSystemEnvironmentPrivilege	6012	wmic.exe
Token: SeRemoteShutdownPrivilege	6012	wmic.exe
Token: SeUndockPrivilege	6012	wmic.exe
Token: SeManageVolumePrivilege	6012	wmic.exe
Token: 33	6012	wmic.exe
Token: 34	6012	wmic.exe
Token: 35	6012	wmic.exe
Token: 36	6012	wmic.exe
Token: SeIncreaseQuotaPrivilege	6012	wmic.exe
Token: SeSecurityPrivilege	6012	wmic.exe
Token: SeTakeOwnershipPrivilege	6012	wmic.exe
Token: SeLoadDriverPrivilege	6012	wmic.exe
Token: SeSystemProfilePrivilege	6012	wmic.exe
Token: SeSystemtimePrivilege	6012	wmic.exe
Token: SeProfSingleProcessPrivilege	6012	wmic.exe
Token: SeIncBasePriorityPrivilege	6012	wmic.exe
Token: SeCreatePagefilePrivilege	6012	wmic.exe
Token: SeBackupPrivilege	6012	wmic.exe
Token: SeRestorePrivilege	6012	wmic.exe
Token: SeShutdownPrivilege	6012	wmic.exe
Token: SeDebugPrivilege	6012	wmic.exe
Token: SeSystemEnvironmentPrivilege	6012	wmic.exe
Token: SeRemoteShutdownPrivilege	6012	wmic.exe
Token: SeUndockPrivilege	6012	wmic.exe
Token: SeManageVolumePrivilege	6012	wmic.exe
Token: 33	6012	wmic.exe
Token: 34	6012	wmic.exe
Token: 35	6012	wmic.exe
Token: 36	6012	wmic.exe
Token: SeIncreaseQuotaPrivilege	5784	wmic.exe
Token: SeSecurityPrivilege	5784	wmic.exe
Token: SeTakeOwnershipPrivilege	5784	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2344	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
396	0f56ade15a.exe
396	0f56ade15a.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
396	0f56ade15a.exe
396	0f56ade15a.exe
396	0f56ade15a.exe
396	0f56ade15a.exe
396	0f56ade15a.exe
396	0f56ade15a.exe
396	0f56ade15a.exe
396	0f56ade15a.exe
396	0f56ade15a.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
876	firefox.exe
396	0f56ade15a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5136	RegAsm.exe
3876	filer.exe
876	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2484	2344	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe	82
PID 2344 wrote to memory of 2484	2344	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe	82
PID 2344 wrote to memory of 2484	2344	71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe	82
PID 2484 wrote to memory of 4156	2484	skotes.exe	88
PID 2484 wrote to memory of 4156	2484	skotes.exe	88
PID 2484 wrote to memory of 4156	2484	skotes.exe	88
PID 2484 wrote to memory of 2340	2484	skotes.exe	91
PID 2484 wrote to memory of 2340	2484	skotes.exe	91
PID 2484 wrote to memory of 2340	2484	skotes.exe	91
PID 4156 wrote to memory of 1676	4156	VBVEd6f.exe	93
PID 4156 wrote to memory of 1676	4156	VBVEd6f.exe	93
PID 1676 wrote to memory of 936	1676	chrome.exe	94
PID 1676 wrote to memory of 936	1676	chrome.exe	94
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 3980	1676	chrome.exe	95
PID 1676 wrote to memory of 4744	1676	chrome.exe	96
PID 1676 wrote to memory of 4744	1676	chrome.exe	96
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97
PID 1676 wrote to memory of 3464	1676	chrome.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1988	attrib.exe
5408	attrib.exe

C:\Users\Admin\AppData\Local\Temp\71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe
"C:\Users\Admin\AppData\Local\Temp\71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Users\Admin\AppData\Local\Temp\1009342001\VBVEd6f.exe
    "C:\Users\Admin\AppData\Local\Temp\1009342001\VBVEd6f.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffffe14cc40,0x7ffffe14cc4c,0x7ffffe14cc58
        5⤵
        
        PID:936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1864 /prefetch:2
        5⤵
        
        PID:3980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        
        PID:4744
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2224 /prefetch:8
        5⤵
        
        PID:3464
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4420 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4652,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4656 /prefetch:8
        5⤵
        
        PID:5760
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4212,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:8
        5⤵
        
        PID:748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4620,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4668 /prefetch:8
        5⤵
        
        PID:1128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4752,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4608 /prefetch:8
        5⤵
        
        PID:4896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5032,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
        5⤵
        
        PID:1184
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5168,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5196 /prefetch:8
        5⤵
        
        PID:5536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4656,i,2117960133835431597,2882701778701050301,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:2
        5⤵
        Uses browser remote debugging
        
        PID:884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffe1546f8,0x7ffffe154708,0x7ffffe154718
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,18173480841472350894,6948204565717208447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        5⤵
        
        PID:4060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,18173480841472350894,6948204565717208447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,18173480841472350894,6948204565717208447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2176,18173480841472350894,6948204565717208447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2176,18173480841472350894,6948204565717208447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2176,18173480841472350894,6948204565717208447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2176,18173480841472350894,6948204565717208447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5816
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1009342001\VBVEd6f.exe" & rd /s /q "C:\ProgramData\ECAEGHIJEHJD" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3128
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1009351041\PeRVAzl.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5136
- - C:\Users\Admin\AppData\Local\Temp\1009384001\filer.exe
    "C:\Users\Admin\AppData\Local\Temp\1009384001\filer.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\1009384001\filer.exe
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4808
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:1988
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5408
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6012
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5784
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4780
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\1009393001\145c7b78f1.exe
    "C:\Users\Admin\AppData\Local\Temp\1009393001\145c7b78f1.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:3156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:4752
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff80cb8cc40,0x7ff80cb8cc4c,0x7ff80cb8cc58
        5⤵
        
        PID:644
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,1728077638072825543,15119721779706229065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1936 /prefetch:2
        5⤵
        
        PID:5308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1908,i,1728077638072825543,15119721779706229065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2172 /prefetch:3
        5⤵
        
        PID:6120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,1728077638072825543,15119721779706229065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2480 /prefetch:8
        5⤵
        
        PID:5724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,1728077638072825543,15119721779706229065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,1728077638072825543,15119721779706229065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3380,i,1728077638072825543,15119721779706229065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4428
- - C:\Users\Admin\AppData\Local\Temp\1009394001\46d9574b72.exe
    "C:\Users\Admin\AppData\Local\Temp\1009394001\46d9574b72.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:5128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 1592
      4⤵
      Program crash
      PID:5004
- - C:\Users\Admin\AppData\Local\Temp\1009395001\e38eb3cc9b.exe
    "C:\Users\Admin\AppData\Local\Temp\1009395001\e38eb3cc9b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:6028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2296
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8004acc40,0x7ff8004acc4c,0x7ff8004acc58
        5⤵
        
        PID:544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2388,i,1857304811839938361,1768245717644939936,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2384 /prefetch:2
        5⤵
        
        PID:3088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,1857304811839938361,1768245717644939936,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2476 /prefetch:3
        5⤵
        
        PID:2600
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2000,i,1857304811839938361,1768245717644939936,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2584 /prefetch:8
        5⤵
        
        PID:116
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,1857304811839938361,1768245717644939936,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,1857304811839938361,1768245717644939936,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3668,i,1857304811839938361,1768245717644939936,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1880
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 1608
      4⤵
      Program crash
      PID:2552
- - C:\Users\Admin\AppData\Local\Temp\1009396001\0f56ade15a.exe
    "C:\Users\Admin\AppData\Local\Temp\1009396001\0f56ade15a.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:396
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5280
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:6128
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:1108
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:876
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {787edd3d-45bb-4042-acd2-7c10a63b2e18} 876 "\\.\pipe\gecko-crash-server-pipe.876" gpu
        6⤵
        
        PID:2496
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48dc92be-35f0-4341-a03c-0356733db467} 876 "\\.\pipe\gecko-crash-server-pipe.876" socket
        6⤵
        
        PID:5284
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2608 -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 2944 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65d717f4-9e78-462c-8ed4-b2eea4e7b2ab} 876 "\\.\pipe\gecko-crash-server-pipe.876" tab
        6⤵
        
        PID:5636
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3840 -childID 2 -isForBrowser -prefsHandle 3832 -prefMapHandle 3828 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01b6698e-fa47-457d-a52d-b552ec5962fc} 876 "\\.\pipe\gecko-crash-server-pipe.876" tab
        6⤵
        
        PID:3092
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4632 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4488 -prefMapHandle 4620 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {254c83f2-25a5-47e1-86b9-b1f1b5098a7f} 876 "\\.\pipe\gecko-crash-server-pipe.876" utility
        6⤵
        
        PID:5232
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 3 -isForBrowser -prefsHandle 4908 -prefMapHandle 5500 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57d28659-0129-45c0-9bf2-5ecbbd3729dc} 876 "\\.\pipe\gecko-crash-server-pipe.876" tab
        6⤵
        
        PID:216
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5648 -childID 4 -isForBrowser -prefsHandle 5656 -prefMapHandle 5660 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {237b7f7f-efe9-4e75-8f98-f3ff3c57a911} 876 "\\.\pipe\gecko-crash-server-pipe.876" tab
        6⤵
        
        PID:3164
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 5 -isForBrowser -prefsHandle 5848 -prefMapHandle 5852 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {034de3ad-8b6e-4345-b9a4-7180253c90e4} 876 "\\.\pipe\gecko-crash-server-pipe.876" tab
        6⤵
        
        PID:1768
- - C:\Users\Admin\AppData\Local\Temp\1009397001\d06221bcb9.exe
    "C:\Users\Admin\AppData\Local\Temp\1009397001\d06221bcb9.exe"
    3⤵
    PID:4452

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5360

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5128 -ip 5128
1⤵
PID:1464

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6028 -ip 6028
1⤵
PID:5792

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4848

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
1fd2bcf7be677e004a5421b78e261340

SHA1
4e5abd04329ee1ffaebe9c04b67deef17f89ff84

SHA256
f539c848f584add20b43d5daefd614526b67adbf22b0c89eaa7802a8a653cd31

SHA512
929499946e38281bd808b37b362c4a86f3b6382eb1ecd5fc094410d3688906d14a114ca930a2cf38b6241ab734bc5959e6fe541270d47ca9538e82a68c99cc77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
2f76ee2eb1bab86252edbc2fc347c32f

SHA1
647cc028b3fa5366de07efc92de2c60bd8f60552

SHA256
b8193a581b49cf6b3407421d5f1904ab5fa08badb89494fffed9bb00ed4b73a8

SHA512
98dc073023b24d5cc3f875808df0d8f70763454dfc48539e3a6fb5823e7547b7784c7876d14fdaf02f481b4a5e8b9687a76d8e9e0b01dda7f56829a50b50f54b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
adbf29e5862d4d78f2d5f30c9a59bd15

SHA1
50ee5f80d3f97e04f1f93d8125f4c0357ea15811

SHA256
d0321f70eb95914ad6323913382eae110c2505bbea53992ba32a2a9cd83ab527

SHA512
d6fb7aab6f063d2eaed95243bc0867de3cbc97698d820a816dbc885f622e80bd3ca549ff50ee87637d3c5505a4899ab24de56fe535fa6da069c23ebb9dbb8929

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
4a7bd698eec140817177be103f9e144f

SHA1
2b3feb15ed502e2329657a7901e6518ecfda4e95

SHA256
8fad22a51c0d494afee2a3c13589615e960d9d61dde13e0ac9c23e724dfc799d

SHA512
6c829badb5cd2e9297c7599500d0efd87fbb2b7e204a9a68913cbc95af48eeee4fd0f17bbefb77c85767c9c120a9c36b62702f5f1bfe697556d1b7667494d011

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
d705038148ad773976e021cbe69fe3ab

SHA1
e2c3c064b854e15b9b2a386a49459480d92eab0b

SHA256
2d13e7a263a96843e02557642cbdd03a9a68869958eb05b43d4222c23f601303

SHA512
484adeca769471ef9ca7b52073c3c88ff43e0cc7a55f6c236289208a2243ad9a0b580925b105dcf17bef79d418515c4c9d1aa0be395faa1e8205f11d25f62647

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

Filesize
44KB

MD5
d37107dd9dacc7c01daa77072837db6a

SHA1
ff118c45f44a52329379013e82e0094a8b4529b7

SHA256
fcdc86162da62b0b3074e9a78ae4fe8d0c79c803e6cd3895903e9cd4b1013cc7

SHA512
7bddd0e57b73ae023cf19b8d153399268a6d4813822143685ce7cf98ce9d1d8cf0a0da5f50387dbe0e9d83c63f4e7090daaf20a2d9ea3ec561282927e7bcd99b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
2d61345bc9bcd49311e6de5b5fa731f2

SHA1
0e2241f8d9fc2d6055c5aef6f326032c1983c376

SHA256
fb0596c0f7a495d4e78bbc4398b923c503bc490911ac2efc5bf512fc459bdfa4

SHA512
b6d1dfa0138793be2ca3536451f9ea1fcbeb5ce54b7639ecd0bc0b39b545bef0169e1c3e02816fbb5cb519b2fc88dcf2b4f3d12d65273d5a6c87d52e93555045

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

Filesize
1.0MB

MD5
fe993339a25710ebec86c051941d462c

SHA1
1a7a578b7a32bbe2102a789c2321090d406838d1

SHA256
59ce81d41051a1d16c02906cd586fcdeabbe7ee30ea7b7b1bb0970b981ffa443

SHA512
b81201876efadc61a8fb48718abb16f7f458856f2ee676db8b0da36790492ad930585c14ce200e7a9e079b8115b15e20ed95176cbfdc337b3ab732e5fe72bbd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3

Filesize
4.0MB

MD5
d6b0609c4b6edb45553ff9afbfc95e33

SHA1
2697657b75906d3653f48080ec1f3993c07bd8bf

SHA256
eb5cc165f4f69f7a3e72851b1b63e67efa9afb3c96bf8aefc962a5fdbdd6cc2e

SHA512
db4c837c9a8a30e65f0f634bcceecff3354d6b72b34536e584fafd02eb103cb4a6b01522d4463d8c54e6852d28a71d9ec8997e2f353e59ea8724aadbbc2a80ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
01a613a8001c26ca13f83e87a17316f5

SHA1
c5f9e50d563c52a690c5b1c5ef58d21e87f495e6

SHA256
6400885f26ccfa77f0e4c8c345430c811ada410907ee0897277968969a1c32d2

SHA512
1f2cb06c84518215aa9d8fb2159f7a03abdf6e367ee12eb7ba549f1dbe746199ecc73432e4f1939deba4c47b491f4c3f65ddf79326780bfca2c2858e0622ce62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log

Filesize
3KB

MD5
ffb341cf59a4241814b3ff3be12d8d66

SHA1
f2d96cf219bc9bd7395592396ba3c266da997f26

SHA256
09a313288002d96fa1ce0d265a323ec8b9cd388cd9733d43c1cb3f5f9c85bf15

SHA512
17eefb314274d0a43965bd28ae6a8a51a04b71e9e2602e898e5b9e727b51c946aeb9eaa63572c9aac6d7dd2ecb7e3fda85c573520ef17fe27388827851466eb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
333B

MD5
67562ac0e14e0922565c1bf130fd85c6

SHA1
ac4f249f901372dd5a02abf5eae275372ae9b771

SHA256
30847fc611e34b780f33c55b00d0b924d597910191b38c34f5477c7886fdbc7a

SHA512
df1fa3cb330ac6c3c4c03e0513459c2f3f546efbcea35db4eaa48f604f4153f55458791b8a63333b157a88711e35032db3bbc0287302a21eb221bfd23466a0f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
348B

MD5
9a9215be1a68180b9a467a24277e212b

SHA1
4f61b8b8f97a023c761bd2e5df262355019c0d98

SHA256
4578ab8ace3cb5179f3946609504e47f7c6e65d68b200c4716a426605b816129

SHA512
30d008f27bb3742a38925827e5144b94cce85aa7046e313dec87d6dc04de7389f9a374970e77614fcc134e7ef7fa41a5060d40e4f3512a608b1cb29e14578778

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
324B

MD5
f9504442b82e75567b6259ac5fd824f5

SHA1
2b41bcc7bd1252ef75c367662cd6e65d8da18565

SHA256
79a75a0f1e50b07c0226c69db6bbe331731a0001019b2208399a71f823efb8c7

SHA512
206e373e7a394ea795622e0e71370d9112656a75ba42a1f12280e4d35ac585bf9e3ff3b6aac8e217b99015e604dbcd6aa9d8cd4b4ea6c0ff4002b4ed52b5be50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal

Filesize
12KB

MD5
48eb3af441804bb0eae2816473ff0e51

SHA1
d17029e7a1ec940fe286e93983d4e483fa142ad3

SHA256
600416c7f15aa3fe228fcd76a68c7bbea27ae075e25901b4ee23273c619bdd30

SHA512
ca1c6603620691b91d5618e5679a2755586cefec5ef4f4f83f9401b9c15816dbb490225b097f7babb32ece49a87e3612d561e357bc90a7197a941fa7dc04b22e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
317B

MD5
e77d6744a546e17377f34eba16b1775b

SHA1
ed3bd0e1ada598747338810c809d87e813380ad6

SHA256
5001bdd47d56f2a2902d42a00e8eabad384091ae8e573bb12fd017593871c834

SHA512
f0971b1f96f083dfe312467d1b74923b37a5b526e21ef2474a93f63304410efe0d8f8ffc3fff6de77baef4f64a93bc793ed612a750b5afc7474e63999e9854af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
16d75804077e67742c7f4a4c3f4f7eba

SHA1
f0d8c8dacf1d85cb540ebd465029ffa6a3b08448

SHA256
fa61d98babe9585043c7979d299170447a3b2aae739c218512db01c010196b90

SHA512
81f15559e3ebd042bc6f441c0503176cb3f07462e302424f7bc98ecf514a5a2dd4a73c9a07adbafc33026d9d623da4faa714006eb2fe178d1c41d069f57b1a38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
335B

MD5
15ec09650f8619d1b4e1b042ea188ac7

SHA1
299fe9e2605f5047b22ac02975a1d2b86c3c0b1c

SHA256
21b179e5045c984da3886de9e71d94baf44c149c09b44b88f383b45c36663001

SHA512
298a083f939f3a82ced3481d0611021e5b177085e743fd34f5bd0e675d3eab34d8c90aa57a3d9dce5ea4f2f4d1da4591db3fbed80e62c66861f295bed1c2d537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
ef48733031b712ca7027624fff3ab208

SHA1
da4f3812e6afc4b90d2185f4709dfbb6b47714fa

SHA256
c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

SHA512
ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cefe7c7e71524a37be524faf31e23ff9

SHA1
28969ea363d38502e334e43863e015b83901ddf9

SHA256
c7427abd165e35f7317b656dce5f99cee774a565d998cbaddd62b478ff51f9e7

SHA512
3af14b62da00ffc061b0e49d68d840ecb6b4515b082b9a31e4d30c1cc12afd47517d1f5818cf2da4a9841ecc6ca0cedba1913822c2e728d3139fef84e9aec33f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d624193b-ebe2-4ef4-a18b-e6ef65e22763.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
13KB

MD5
bdfe9fa28a047554277120e2499e5300

SHA1
b84d444168c9a7b1d6d4a56194728c7c196f0b38

SHA256
07136ad7a4a11433e9d88b3e28910f032c46b1043d4f26fd600bdc801415aeea

SHA512
d75622bdae3ee5fa7b1a337154acf51615d3c94df53e8df9dfeb4c303493e61ab18331f8cfede956e2530e93062aa521368f192255b7f2f95491e3d6901c9583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
52257ea5c92332e8de30b32ee7dbcc7d

SHA1
9716d8b0ece69be5cbc77ae49b171706794140a5

SHA256
478f63d3814c8c3cfc1899726622a3d836298479edf0e0cb03531b6f47018e0e

SHA512
375d58f51ce178a70127842c6a57b33202c7d432d9dbe3387eacf522af6c20851de244c5432f5b4f9280e3514ac92a058770ec29627dc454f2d309de674d8fb8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Filesize
13KB

MD5
5fc184de842c9943ab0bb4d487692a7e

SHA1
62433d4727b57263b62929325e8434d30b4f84e0

SHA256
a9340dbcfb1437f3ad28cc3fdefcada1ba39e752bb9db2c895088ffdf75db345

SHA512
b0b6a21be88a1c0bfa5a565268d1dc49aae2ade53a5e08dc4d30423a231ecd27f4d19a5db548c29d3ae794c7c7a0948b6d6474205308625ee249752cc0f90247

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009278001\DPQSEDd.exe

Filesize
30B

MD5
aba880e8d68c1ddc29af3b2fdb32a896

SHA1
8611c3e60d702e34f17a00e15f0ba4253ef00179

SHA256
a2ec5866c667c1261f906973133c39b1889db748852275ce9aa4a410e360fbd3

SHA512
36727e71873a241207283576279f7bc14ec67c92c09a3661a4e248a32dfd7a3f3ac44d031906b0547ec67ab171470bd129a9b7623a0f708d9214bf12b399282c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009342001\VBVEd6f.exe

Filesize
409KB

MD5
4ea576c1e8f58201fd4219a86665eaa9

SHA1
efaf3759b04ee0216254cf07095d52b110c7361f

SHA256
d94206d9509cc47cae22c94d32658b31cf65c37b1b15ce035ffaa5ce5872ad2f

SHA512
0c7462bc590d06f0ead37246f189d4d56e1d62ff73f67bf7e2ce9c653d8c56812a5f1306fb504168f7e33b87485c3465ea921a36f1ba5b458d7763e45c649494

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009351041\PeRVAzl.ps1

Filesize
3.0MB

MD5
2b918bf4566595e88a664111ce48b161

SHA1
e32fbdf64bb71dc870bfad9bbd571f11c6a723f4

SHA256
48492827286d403668996ae3814b2216b3b616f2fb4af2022bf3d2fc3f979a26

SHA512
e3d58adbe13befe91fb950cc52b16d6d2fcb8f6d65bab4020222713207b07ce78b76e2e2532cf3de23149e934ba1e1cb9046a95a18424a668bfa4a355af6f44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009384001\filer.exe

Filesize
25.7MB

MD5
9096f57fa44b8f20eebf2008a9598eec

SHA1
42128a72a214368618f5693df45b901232f80496

SHA256
f4e2eeea7e5db511bfca33ffd1e26bce5d72e2a381e84bf3700938eb404f7934

SHA512
ad29f94040532ab78679ec9e50d58d8ccef3f99d5ab53ef7c654527b9b2634da4c44375b2ca2d54a83d1dd1e0fa9b1d1a13241ffe0328bea07740166927521b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009393001\145c7b78f1.exe

Filesize
4.3MB

MD5
f5776b965778a92b20d7cdcc3ed87b8a

SHA1
1b5a38a9d6b40243306672d8beba4bd38081788e

SHA256
ae296c763a4d1175347ff21ca6b2fe38bbd3f5680be48bd20a27461fcd1632e5

SHA512
b3ee8f35314f237087c8b1d43b0771384e20f2f0a40c3c0d4d064f1b3e5a6fb7986c169a7d7c313f08e0600e03257516bf8ea9c47c5f16c671aeb266b365c911

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009394001\46d9574b72.exe

Filesize
1.8MB

MD5
f33c80d517734dd30771a89966179c74

SHA1
da1b46cda41ca6d75753e2efaedb300d0a0ec6e9

SHA256
1dcc039596d3f58e24e1d12ee64d51eb569f157689c3cb6ada3c2e932d314719

SHA512
beeb262db01c7754c88d78ab1ddb3e3d588efec05d5b253003645ae9060e3f728b08d6551db0092d1abe02cda429c0b2cf8aefc7a64c1e845685d61a6f7e3c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009395001\e38eb3cc9b.exe

Filesize
1.7MB

MD5
6b1c2cd2ec903e7deafeebde9bf8fa76

SHA1
86e42568bc553434de430649f85c804e820b244f

SHA256
5f23080097579060ce2606e5980045eacc19bf835e94a0d3a4691b55160cc4a8

SHA512
2bc748c350b61d27dbb31afe2a68e467e4839ef5216f2574106322f3350cd14baa9a84f669cc2c818dae3d43aec69c40dc3d836342aec5c39af0afff4b0cfaa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009396001\0f56ade15a.exe

Filesize
901KB

MD5
b14552016d4a0e1ced552484abddd6ac

SHA1
f1bc41839dfa15df8b5e03a4598d6e40751c352b

SHA256
f16f08a83223ee763f2b77189009796bfed2ba29dafdadeb6e908759bee80ad1

SHA512
d90d5537481bbb40fee4858f479f487d4d03fff891c20d38dc90edff5538e30185e67210d30f3e6d012f016c695259e9d876981cc760bf4c19f407e56286a1e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009397001\d06221bcb9.exe

Filesize
2.7MB

MD5
4136b00434fc0d432a02c695772d4a0d

SHA1
ba1a5e923bff50ff8a5ca73c04974ff1cf5ede3e

SHA256
4a52cfc3f9a089248ff9476810d130863f0913684a321a7338e985f0b84183ef

SHA512
602ffbb8fe4eb23ec92bc6de447cfbf0acc8f57f0d6cde28136db19a930063a591ae7c2c07f7f3805f412edea2db4b45935d66ede764221170515ac256dec468

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0rngndw5.3yt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
1.8MB

MD5
2063ad6746859ba2896e6d3bc7082fbc

SHA1
f29d5bca4a5c61ba291be6cff88a46d5ac3babd0

SHA256
71d1727ceeca04f6de46c377c3d94fe31de439e31454e320a7823c9aca1d82d5

SHA512
1f1cdaf3cacced639f8d5e60a11ed515b52d7687032dd27bd41e0e42c15f2a226dbe4f8735f689a13dbb1eba112dfebbb237601e21af65e7f1f4d08b21720ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1676_845692306\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1676_845692306\a964540f-a041-442c-bc22-11653e2c1eb9.tmp

Filesize
135KB

MD5
3f6f93c3dccd4a91c4eb25c7f6feb1c1

SHA1
9b73f46adfa1f4464929b408407e73d4535c6827

SHA256
19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e

SHA512
d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
6KB

MD5
a4b97a81150f1687927afe0c334e8418

SHA1
fc3ab00360faa25663ac6bb3c12f4acd4ccba9ab

SHA256
5bd43d64cb087f44181f96c21ad596ae73828cb91102c51097c36ba0bfea2c03

SHA512
96797b5645191ac557965fcb392d0915af9653ce5ce880f33b2f21d28c15542bef022eb40376b3bc7648900b5afb6544aba52ec418c66b7a10a1ac677aff33ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
8KB

MD5
0339b90ca48b32f8eb0a6de58842fd99

SHA1
7c677b6562b2d82197c09d885eed1166ae0c4f30

SHA256
96e2282df560c7d01d9dc781b5247c8749acdd61b6e05daecdc2314fa155de66

SHA512
880a8a18679e740471d661da3a47198fc9d1dbfc3fe0420560e32814c2ee020e8cc8604e9922c4fc129fcaef6320156d28391da11986846d10327ddb377e406f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e5aeb2e7f650abdc50790899dd7acadc

SHA1
4f0148a39e2f6686a5bf0fdb6b6ad97259bcbf35

SHA256
acb00e839e2de00876cb61c6dba731831666b1d0cf7750f4a0c483bff8cd8fd1

SHA512
b040d02aec753142984f230a8224ccb139284c3cdc4591a81c0762847405161fc6dab2363178b32cc6369914a6227dc35c3ee3c3a2d2b077f49693845840683f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
8207fbdcb91edf8ced3a5d90f89bc7d9

SHA1
8ba5a3ba34aea0222d33afb3330d4a6db4e00fc7

SHA256
bdb3cfc7a06e24ee5975c43e34ba89365cf31fc4f5e22d25b09d95dea325ea1e

SHA512
1c3883322e525eefd6f37c26b0bed9859cfac263c2e1fa3640d5d5896fc8d96814bd3b7ec9c83719fb53b36b2a07aedcc06a1fc4bd4844737916ebe767e5b33e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
ec66b0629f588f42f06081ec87086982

SHA1
17403a2e6e436e34d37ebfc3ff5d38492b42a546

SHA256
70ad55cd603fe299d5835bd54fa173d67beca8cc4a9ac73e3495aacf1512cb3a

SHA512
c54f4dfb19af9a9cc4da40752a1602439fd53787fa3959ac57723b521874ea496556718b6a58c3ffbecc140a23abfcf43877ee12c88508998e5fbceb89910d8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
037fd4480641250c7adcf6bfe873f196

SHA1
6c78d21d91bc841617bee6c00011a7be3ba90df5

SHA256
b8574518352e85b6398460c97b1cb76c779cd2b40d656c9a6c4d46b9810744f2

SHA512
f9906452cb3f39ae9c4590a16abbf39fdc36087ca04421b76b92d1411998e3b9b9d1e4ca6ac4207fae113f6ab1f1ad34685e763c2a4f6efd5d63f88f04c4620b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
acdf0ffa17db2cdd89d6fb1430b9f26c

SHA1
ba50577b72eae39f1791b0ed54cbc4ada2ba2ef4

SHA256
5c5dd2b01108203ab02e9c90487a68e68ace9a7a0638d0e931bb45119e1a2718

SHA512
d46e2861a6e153ef55a8eaa409bdb845a107576d5bbb98c7996000090ec0e025aa1a087107db8f4d0532906f9c1af573a66c0a144a4861acc4ebe6db2d59a3b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\0626e14c-e55f-4216-afbd-3986af9a787d

Filesize
671B

MD5
ee7fa00304d35460b71b059a330f47fc

SHA1
b8cced6d40a12386fda4be582ec197445fcd0c99

SHA256
3b24d2767e62a5a4b19dfe792e810ef1737f529fbf8df5c7d93b1648a7e17b39

SHA512
726c45f7f61598dd32f4c3c117480a48991d4271af020618baad300fde830b7a17af81836ab405149c34283a6aa9751710ed7fdb5604d1b8ed076834f9227b69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\46fb085d-1ab0-456c-a7ef-77e0672239e3

Filesize
982B

MD5
92760a61e91c5a2d5785c3fa3a529ad6

SHA1
c929caf8e62713b19000661061dc04e431d3b3af

SHA256
397c0cd6f923d1fe88927345cc9b0d72d3342a53cfccaa7c6cf851e79cea0585

SHA512
19b6fe8c1c9a4bf60ae5e32684162dbb8b47bfdde4bd4da12e4c83110c679259c6d14c2a4fbb4721ef7d56c6eebdfcb9aaeeeb6b23f32e4184b6b3069cd75044

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\d46fd56e-76f5-4d69-9ebb-778b59253d21

Filesize
30KB

MD5
bfc92283962678600822f956b95a0950

SHA1
008aee8d72c08b6104fd223807a4f0f9f1d7b068

SHA256
cfec2665f1eafcbbbbc798e5d398a6a007f08d8578a9bfaa70c47e86e8c74938

SHA512
64d71148a077239d03eed04a555ca040fb0d1ee9ea1627490f9c0e112f56b8a44f2daac22856e95bc42d7833ac8cd129f13123fec906df796b41d211720315d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
15KB

MD5
c70a854c3c9c2bbfe64198a3ba08ae1f

SHA1
68916f65bfb45c40c2f6934d74eadb81b99df55e

SHA256
f452c9571077cf1199fed906152e48df3dde120f4fe5fd82f5c88e1944082dfb

SHA512
5d717dda8c73d5159320d11e8205945f844d8cb847dec170da71b2ba0b57cc1a55699e86b85d2d841fc1e43e7c47b7ee60a23fa2565e8ab76fffa092f01bbbc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
10KB

MD5
393eba979834d26ef99d0b21b0d572ae

SHA1
097af96d027cad92b1c3603cf505e680c7942bcf

SHA256
4321bf827d84fcac421b416363cb0e5ba15df11a0cc9be90920c7c00ba726deb

SHA512
1c5851a80a8c88fac7a945da7153e779bc549ab0bbb4685a94975115ae45776c4e04f8e8d6cc79e4cca8d8d704fcad0e5df736ed236b0517157ddc9786baa050

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
a91fdde3f304a389529a539edf2700d4

SHA1
754e5a44b15b6edf58f94ea9a7bdf440e7a3180f

SHA256
f3e8df3852f55016bc0e8f446901a581943e351691100935719d38c563b015bd

SHA512
8985f98bd9aa49dc35cc39be8910043b049259b25c64250e156dd110c8d965e5038cb42f52c96efba48718c33662cad9c56accbd7679d3e5bdab21b9af563248

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
0d9bd8ec6d39a47f9feb14e75418e9ce

SHA1
bd7bbde5f99a7d04e4e161f2e3f5e69aabeaa0f5

SHA256
6e43e7f3f0c69e09186b81f4f4b1d27a44d4c027e36f66edc713c82362d5ef63

SHA512
b6cf4d7a25d36df59d872ee391abc34403213cfa3e69124fe3c8b09d64e20c071f1f05c7b9faddd0250a62baade7bda0bfe1eeaa8a9e491a9313f753f616fb78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
11KB

MD5
b857205fb6a0cc3cbda132cb33f1f80d

SHA1
7fa49381c72c8a796e796b26fb46500efa94c45d

SHA256
ef896838a0fa858ab378d36b2dd195239bd446cd0507277deb57fccfb0b6e1c6

SHA512
9041db2d3e1274b9f074dcbd034dfa227e8fdeb2412c3d5f3be87050eec146e173c8bc6972a6d640dbdbe0055e0dc4a08c9ee80cb14bba498b5e0dc92f5411f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
936KB

MD5
c4faba5129b29c173c0731672f19c261

SHA1
b72b79e573231c60cc93801f9854d16cbb990aab

SHA256
1dab464ebda9d50c987960e7f1391cbd4c2b7d05cc58a0c78dff7b5d7d0ebe0b

SHA512
ef20f2d97bd87648d948b413a5dcea1aa754e53fa4adb20c7c3038679e0e82a9a9cb147e6807b6e38e692d8f3833bd1da3fce2f036eb3c11d44de994513926e9

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
6e2386469072b80f18d5722d07afdc0b

SHA1
032d13e364833d7276fcab8a5b2759e79182880f

SHA256
ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

SHA512
e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

Download Submit
memory/2128-4127-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/2128-4170-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/2340-147-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-133-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-117-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-103-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-139-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-59-0x0000000005F00000-0x0000000005F66000-memory.dmp

Filesize
408KB

Download
memory/2340-58-0x0000000005E20000-0x0000000005E86000-memory.dmp

Filesize
408KB

Download
memory/2340-1384-0x000000000B7C0000-0x000000000B852000-memory.dmp

Filesize
584KB

Download
memory/2340-105-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-115-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-107-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-57-0x0000000005C80000-0x0000000005CA2000-memory.dmp

Filesize
136KB

Download
memory/2340-109-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-78-0x0000000006510000-0x000000000652E000-memory.dmp

Filesize
120KB

Download
memory/2340-111-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-101-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-113-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-155-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-119-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-161-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-121-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-97-0x000000000A4E0000-0x000000000A722000-memory.dmp

Filesize
2.3MB

Download
memory/2340-71-0x0000000006070000-0x00000000063C4000-memory.dmp

Filesize
3.3MB

Download
memory/2340-123-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-56-0x0000000005610000-0x0000000005C38000-memory.dmp

Filesize
6.2MB

Download
memory/2340-55-0x0000000004F40000-0x0000000004F76000-memory.dmp

Filesize
216KB

Download
memory/2340-125-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-151-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-135-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-1385-0x000000000B860000-0x000000000B8FC000-memory.dmp

Filesize
624KB

Download
memory/2340-157-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-132-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-153-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-149-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-127-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-145-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-143-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-130-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-137-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-100-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-80-0x0000000006560000-0x00000000065AC000-memory.dmp

Filesize
304KB

Download
memory/2340-141-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-159-0x00000000069A0000-0x0000000006A38000-memory.dmp

Filesize
608KB

Download
memory/2340-98-0x00000000069A0000-0x0000000006A3C000-memory.dmp

Filesize
624KB

Download
memory/2340-99-0x000000000BCD0000-0x000000000C274000-memory.dmp

Filesize
5.6MB

Download
memory/2344-1-0x00000000776E4000-0x00000000776E6000-memory.dmp

Filesize
8KB

Download
memory/2344-2-0x0000000000FB1000-0x0000000000FDF000-memory.dmp

Filesize
184KB

Download
memory/2344-3-0x0000000000FB0000-0x000000000146B000-memory.dmp

Filesize
4.7MB

Download
memory/2344-4-0x0000000000FB0000-0x000000000146B000-memory.dmp

Filesize
4.7MB

Download
memory/2344-15-0x0000000000FB0000-0x000000000146B000-memory.dmp

Filesize
4.7MB

Download
memory/2344-0-0x0000000000FB0000-0x000000000146B000-memory.dmp

Filesize
4.7MB

Download
memory/2484-20-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/2484-19-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/2484-18-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/2484-44-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/2484-46-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/2484-47-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/2484-17-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/3156-1972-0x0000000000250000-0x0000000000ED2000-memory.dmp

Filesize
12.5MB

Download
memory/3156-1926-0x0000000000250000-0x0000000000ED2000-memory.dmp

Filesize
12.5MB

Download
memory/4156-45-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4156-1861-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4452-2443-0x0000000000690000-0x0000000000946000-memory.dmp

Filesize
2.7MB

Download
memory/4452-2472-0x0000000000690000-0x0000000000946000-memory.dmp

Filesize
2.7MB

Download
memory/4452-2445-0x0000000000690000-0x0000000000946000-memory.dmp

Filesize
2.7MB

Download
memory/4452-2444-0x0000000000690000-0x0000000000946000-memory.dmp

Filesize
2.7MB

Download
memory/4452-2475-0x0000000000690000-0x0000000000946000-memory.dmp

Filesize
2.7MB

Download
memory/4856-1906-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/4856-1908-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/4988-1878-0x000001C6FA4D0000-0x000001C6FA4F2000-memory.dmp

Filesize
136KB

Download
memory/5128-2048-0x0000000000200000-0x00000000006B9000-memory.dmp

Filesize
4.7MB

Download
memory/5128-1951-0x0000000000200000-0x00000000006B9000-memory.dmp

Filesize
4.7MB

Download
memory/5136-1796-0x0000000005580000-0x000000000558A000-memory.dmp

Filesize
40KB

Download
memory/5136-1389-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download
memory/5360-1621-0x0000000000C00000-0x00000000010BB000-memory.dmp

Filesize
4.7MB

Download
memory/6028-2059-0x00000000001B0000-0x000000000084D000-memory.dmp

Filesize
6.6MB

Download
memory/6028-1969-0x00000000001B0000-0x000000000084D000-memory.dmp

Filesize
6.6MB

Download
memory/6028-2422-0x00000000001B0000-0x000000000084D000-memory.dmp

Filesize
6.6MB

Download