amadey | c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69

Analysis

max time kernel
64s
max time network
156s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
Size

3.1MB
MD5

710c44d15b43173067b038379c47ffe9
SHA1

c3a27447cb2c87d4830e0d425f614d46402708cb
SHA256

c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69
SHA512

77e6670f844a3e4debdb7c71d1c5701d55735da729d511ac02f7b9b84cd818aba491f912e097a332d80b14067f45a089f3484db95f0adc3aaece0c6d1a7ed695
SSDEEP

49152:sAbDVEobeGgdXmq8HPdzC57HODwfBJzKfpmaoM1gnHrjMq:JiobeGQXmq8HPdG57qOy1gnHr

Score

10^/10

amadey lumma stealc xworm 9c9aa5 default_valenciga fed3aa credential_access discovery evasion execution persistence pyinstaller rat spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

lumma

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

https://ratiomun.cyou/api

https://crib-endanger.sbs/api

https://faintbl0w.sbs/api

https://300snails.sbs/api

https://bored-light.sbs/api

https://3xc1aimbl0w.sbs/api

https://pull-trucker.sbs/api

https://fleez-inc.sbs/api

https://thicktoys.sbs/api

Extracted

Family

xworm

Version

5.0

127.0.0.1:8080

101.99.92.189:8080

Mutex

d5gQ6Zf7Tzih1Pi1

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

lumma

https://drive-connect.cyou/api

https://covery-mover.biz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1948-3256-0x0000000000280000-0x00000000006F6000-memory.dmp	family_xworm
behavioral1/memory/1948-3264-0x0000000000280000-0x00000000006F6000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b8a2442192.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	BhD8htX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	13c5d97907.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	v_dolg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
52	2484	rundll32.exe
56	2532	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3276	powershell.exe
6188	powershell.exe
2532	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b8a2442192.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	13c5d97907.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BhD8htX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	v_dolg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	13c5d97907.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b8a2442192.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BhD8htX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	v_dolg.exe

Executes dropped EXE 32 IoCs

pid	Process
2768	skotes.exe
2912	b8a2442192.exe
912	axplong.exe
680	BhD8htX.exe
1916	stealc_default2.exe
1568	alexshlu.exe
2292	alexshlu.exe
664	13c5d97907.exe
812	AllNew.exe
1584	Gxtuum.exe
844	am209.exe
1704	defnur.exe
264	ziNGMDa.exe
1620	Office2024.exe
2860	ziNGMDa.exe
1508	v_dolg.exe
1548	C1J7SVw.exe
2672	stail.exe
2268	stail.tmp
2340	chrome11.exe
2492	videominimizer.exe
2520	Z9Pp9pM.exe
2228	7z.exe
664	7z.exe
3032	7z.exe
1716	7z.exe
2296	7z.exe
2256	7z.exe
3040	7z.exe
1560	7z.exe
2128	in.exe
2420	yiklfON.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	b8a2442192.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	BhD8htX.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	13c5d97907.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe

Loads dropped DLL 60 IoCs

pid	Process
2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
2768	skotes.exe
2768	skotes.exe
2912	b8a2442192.exe
2912	b8a2442192.exe
2768	skotes.exe
2768	skotes.exe
912	axplong.exe
912	axplong.exe
912	axplong.exe
912	axplong.exe
1568	alexshlu.exe
1916	stealc_default2.exe
1916	stealc_default2.exe
912	axplong.exe
912	axplong.exe
912	axplong.exe
812	AllNew.exe
912	axplong.exe
844	am209.exe
2768	skotes.exe
1584	Gxtuum.exe
1584	Gxtuum.exe
912	axplong.exe
264	ziNGMDa.exe
2860	ziNGMDa.exe
2768	skotes.exe
1584	Gxtuum.exe
912	axplong.exe
2672	stail.exe
2268	stail.tmp
2268	stail.tmp
2268	stail.tmp
2484	rundll32.exe
2484	rundll32.exe
2484	rundll32.exe
2484	rundll32.exe
2268	stail.tmp
2492	videominimizer.exe
2768	skotes.exe
2236	cmd.exe
2228	7z.exe
2236	cmd.exe
664	7z.exe
2236	cmd.exe
3032	7z.exe
2236	cmd.exe
1716	7z.exe
2236	cmd.exe
2296	7z.exe
2236	cmd.exe
2256	7z.exe
2236	cmd.exe
3040	7z.exe
2236	cmd.exe
1560	7z.exe
2236	cmd.exe
2236	cmd.exe
2768	skotes.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	v_dolg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
109	pastebin.com
110	pastebin.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2304	powercfg.exe
3212	powercfg.exe
2596	powercfg.exe
2276	powercfg.exe
5908	powercfg.exe
5892	powercfg.exe
5872	powercfg.exe
5852	powercfg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000800000001c866-3321.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
2768	skotes.exe
2912	b8a2442192.exe
912	axplong.exe
680	BhD8htX.exe
664	13c5d97907.exe
1508	v_dolg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1568 set thread context of 2292	1568	alexshlu.exe	39

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-705-0x000000013F760000-0x000000013FBF0000-memory.dmp	upx
behavioral1/files/0x000600000000b3a2-1205.dat	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\defnur.job	am209.exe
File created	C:\Windows\Tasks\skotes.job	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
File created	C:\Windows\Tasks\axplong.job	b8a2442192.exe
File created	C:\Windows\Tasks\Gxtuum.job	AllNew.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6796	sc.exe
7152	sc.exe
3824	sc.exe
5524	sc.exe
7048	sc.exe
2800	sc.exe
2164	sc.exe
3392	sc.exe
6872	sc.exe
296	sc.exe
3980	sc.exe
6928	sc.exe
3532	sc.exe
3148	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0005000000019515-314.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4260	3024	WerFault.exe	96
4268	1668	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	videominimizer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BhD8htX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AllNew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yiklfON.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8a2442192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alexshlu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v_dolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	defnur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	am209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alexshlu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13c5d97907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C1J7SVw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
992	powershell.exe
2552	PING.EXE
3324	powershell.exe
6236	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4996	timeout.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	defnur.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	defnur.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	defnur.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	13c5d97907.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	13c5d97907.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2552	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2324	schtasks.exe
2292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
2768	skotes.exe
2912	b8a2442192.exe
912	axplong.exe
680	BhD8htX.exe
1916	stealc_default2.exe
664	13c5d97907.exe
1916	stealc_default2.exe
2532	powershell.exe
1508	v_dolg.exe
2268	stail.tmp
2268	stail.tmp
992	powershell.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeRestorePrivilege	2228	7z.exe
Token: 35	2228	7z.exe
Token: SeSecurityPrivilege	2228	7z.exe
Token: SeSecurityPrivilege	2228	7z.exe
Token: SeRestorePrivilege	664	7z.exe
Token: 35	664	7z.exe
Token: SeSecurityPrivilege	664	7z.exe
Token: SeSecurityPrivilege	664	7z.exe
Token: SeRestorePrivilege	3032	7z.exe
Token: 35	3032	7z.exe
Token: SeSecurityPrivilege	3032	7z.exe
Token: SeSecurityPrivilege	3032	7z.exe
Token: SeRestorePrivilege	1716	7z.exe
Token: 35	1716	7z.exe
Token: SeSecurityPrivilege	1716	7z.exe
Token: SeSecurityPrivilege	1716	7z.exe
Token: SeRestorePrivilege	2296	7z.exe
Token: 35	2296	7z.exe
Token: SeSecurityPrivilege	2296	7z.exe
Token: SeSecurityPrivilege	2296	7z.exe
Token: SeRestorePrivilege	2256	7z.exe
Token: 35	2256	7z.exe
Token: SeSecurityPrivilege	2256	7z.exe
Token: SeSecurityPrivilege	2256	7z.exe
Token: SeRestorePrivilege	3040	7z.exe
Token: 35	3040	7z.exe
Token: SeSecurityPrivilege	3040	7z.exe
Token: SeSecurityPrivilege	3040	7z.exe
Token: SeRestorePrivilege	1560	7z.exe
Token: 35	1560	7z.exe
Token: SeSecurityPrivilege	1560	7z.exe
Token: SeSecurityPrivilege	1560	7z.exe
Token: SeDebugPrivilege	992	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
2912	b8a2442192.exe
812	AllNew.exe
844	am209.exe
2268	stail.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2768	2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe	30
PID 2128 wrote to memory of 2768	2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe	30
PID 2128 wrote to memory of 2768	2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe	30
PID 2128 wrote to memory of 2768	2128	c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe	30
PID 2768 wrote to memory of 2912	2768	skotes.exe	32
PID 2768 wrote to memory of 2912	2768	skotes.exe	32
PID 2768 wrote to memory of 2912	2768	skotes.exe	32
PID 2768 wrote to memory of 2912	2768	skotes.exe	32
PID 2912 wrote to memory of 912	2912	b8a2442192.exe	33
PID 2912 wrote to memory of 912	2912	b8a2442192.exe	33
PID 2912 wrote to memory of 912	2912	b8a2442192.exe	33
PID 2912 wrote to memory of 912	2912	b8a2442192.exe	33
PID 2768 wrote to memory of 680	2768	skotes.exe	34
PID 2768 wrote to memory of 680	2768	skotes.exe	34
PID 2768 wrote to memory of 680	2768	skotes.exe	34
PID 2768 wrote to memory of 680	2768	skotes.exe	34
PID 912 wrote to memory of 1916	912	axplong.exe	35
PID 912 wrote to memory of 1916	912	axplong.exe	35
PID 912 wrote to memory of 1916	912	axplong.exe	35
PID 912 wrote to memory of 1916	912	axplong.exe	35
PID 912 wrote to memory of 1568	912	axplong.exe	37
PID 912 wrote to memory of 1568	912	axplong.exe	37
PID 912 wrote to memory of 1568	912	axplong.exe	37
PID 912 wrote to memory of 1568	912	axplong.exe	37
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 1568 wrote to memory of 2292	1568	alexshlu.exe	39
PID 912 wrote to memory of 664	912	axplong.exe	41
PID 912 wrote to memory of 664	912	axplong.exe	41
PID 912 wrote to memory of 664	912	axplong.exe	41
PID 912 wrote to memory of 664	912	axplong.exe	41
PID 912 wrote to memory of 812	912	axplong.exe	42
PID 912 wrote to memory of 812	912	axplong.exe	42
PID 912 wrote to memory of 812	912	axplong.exe	42
PID 912 wrote to memory of 812	912	axplong.exe	42
PID 812 wrote to memory of 1584	812	AllNew.exe	43
PID 812 wrote to memory of 1584	812	AllNew.exe	43
PID 812 wrote to memory of 1584	812	AllNew.exe	43
PID 812 wrote to memory of 1584	812	AllNew.exe	43
PID 912 wrote to memory of 844	912	axplong.exe	44
PID 912 wrote to memory of 844	912	axplong.exe	44
PID 912 wrote to memory of 844	912	axplong.exe	44
PID 912 wrote to memory of 844	912	axplong.exe	44
PID 844 wrote to memory of 1704	844	am209.exe	45
PID 844 wrote to memory of 1704	844	am209.exe	45
PID 844 wrote to memory of 1704	844	am209.exe	45
PID 844 wrote to memory of 1704	844	am209.exe	45
PID 2768 wrote to memory of 264	2768	skotes.exe	47
PID 2768 wrote to memory of 264	2768	skotes.exe	47
PID 2768 wrote to memory of 264	2768	skotes.exe	47
PID 2768 wrote to memory of 264	2768	skotes.exe	47
PID 1584 wrote to memory of 1620	1584	Gxtuum.exe	49
PID 1584 wrote to memory of 1620	1584	Gxtuum.exe	49
PID 1584 wrote to memory of 1620	1584	Gxtuum.exe	49
PID 1584 wrote to memory of 1620	1584	Gxtuum.exe	49
PID 1704 wrote to memory of 2532	1704	defnur.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3064	attrib.exe
1492	attrib.exe
2796	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe
"C:\Users\Admin\AppData\Local\Temp\c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\1011459001\b8a2442192.exe
    "C:\Users\Admin\AppData\Local\Temp\1011459001\b8a2442192.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\1002824001\13c5d97907.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1002824001\13c5d97907.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\10000331101\Office2024.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000331101\Office2024.exe"
        7⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:6788
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        9⤵
        
        PID:6860
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:6796
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:6872
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:6928
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        8⤵
        Launches sc.exe
        
        PID:7048
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        8⤵
        Launches sc.exe
        
        PID:7152
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        8⤵
        Power Settings
        
        PID:2276
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        8⤵
        Power Settings
        
        PID:2596
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        8⤵
        Power Settings
        
        PID:3212
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        8⤵
        Power Settings
        
        PID:2304
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "QKJNEQWA"
        8⤵
        Launches sc.exe
        
        PID:2800
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"
        8⤵
        Launches sc.exe
        
        PID:3532
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        8⤵
        Launches sc.exe
        
        PID:296
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "QKJNEQWA"
        8⤵
        Launches sc.exe
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\10000361101\stail.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000361101\stail.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\is-TIS3V.tmp\stail.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TIS3V.tmp\stail.tmp" /SL5="$140216,3664531,54272,C:\Users\Admin\AppData\Local\Temp\10000361101\stail.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:2268
        
        C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause video-minimizer_12122
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1176
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause video-minimizer_12122
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Video Minimizer 2.31\videominimizer.exe
        
        "C:\Users\Admin\AppData\Local\Video Minimizer 2.31\videominimizer.exe" -i
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\10009630142\asyno.ps1"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn Admin /SC minute /MO 120 /tr "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\10009630142\asyno.ps1"" /F
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
        7⤵
        Blocklisted process makes network request
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\1005970001\chrome11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005970001\chrome11.exe"
        5⤵
        Executes dropped EXE
        
        PID:2340
      - C:\Windows\System32\certutil.exe
        
        "C:\Windows\System32\certutil.exe" -silent -importPFX -p "" -f "C:\Users\Admin\AppData\Local\Temp\tmp2712.tmp"
        6⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\1006029001\l4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1006029001\l4.exe"
        5⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\onefile_1412_133784646027396000\l4.exe
        
        C:\Users\Admin\AppData\Local\Temp\1006029001\l4.exe
        6⤵
        
        PID:660
    - - C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe"
        5⤵
        
        PID:1668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 644
        6⤵
        Program crash
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe"
        5⤵
        
        PID:3024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 628
        6⤵
        Program crash
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\1006141001\networkmanager.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1006141001\networkmanager.exe"
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\1006184001\023a3f0f8e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1006184001\023a3f0f8e.exe"
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\1006185001\eba865b6c6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1006185001\eba865b6c6.exe"
        5⤵
        
        PID:2852
- - C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe
    "C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:680
- - C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
    "C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
      "C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2860
- - C:\Users\Admin\AppData\Local\Temp\1013561001\C1J7SVw.exe
    "C:\Users\Admin\AppData\Local\Temp\1013561001\C1J7SVw.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1548
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      PID:2236
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:2128
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:3064
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:2796
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2292
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2552
- - C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe
    "C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe"
    3⤵
    - Executes dropped EXE
    PID:2520
- - C:\Users\Admin\AppData\Local\Temp\1013765001\yiklfON.exe
    "C:\Users\Admin\AppData\Local\Temp\1013765001\yiklfON.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\1013765001\yiklfON.exe
      "C:\Users\Admin\AppData\Local\Temp\1013765001\yiklfON.exe"
      4⤵
      PID:4592
- - C:\Users\Admin\AppData\Local\Temp\1013771001\3EUEYgl.exe
    "C:\Users\Admin\AppData\Local\Temp\1013771001\3EUEYgl.exe"
    3⤵
    PID:2808
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1013771001\3EUEYgl.exe" & rd /s /q "C:\ProgramData\VA16PHVSJEKN" & exit
      4⤵
      PID:4952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4996
- - C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe
    "C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe"
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\1014031001\IGEaNGi.exe
    "C:\Users\Admin\AppData\Local\Temp\1014031001\IGEaNGi.exe"
    3⤵
    PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\1014031001\IGEaNGi.exe
      "C:\Users\Admin\AppData\Local\Temp\1014031001\IGEaNGi.exe"
      4⤵
      PID:6412
- - C:\Users\Admin\AppData\Local\Temp\1014060001\732e958cc5.exe
    "C:\Users\Admin\AppData\Local\Temp\1014060001\732e958cc5.exe"
    3⤵
    PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\1014060001\732e958cc5.exe
      "C:\Users\Admin\AppData\Local\Temp\1014060001\732e958cc5.exe"
      4⤵
      PID:3368
- - C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe
    "C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe"
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\1014305001\IGEaNGi.exe
    "C:\Users\Admin\AppData\Local\Temp\1014305001\IGEaNGi.exe"
    3⤵
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\1014305001\IGEaNGi.exe
      "C:\Users\Admin\AppData\Local\Temp\1014305001\IGEaNGi.exe"
      4⤵
      PID:4016
- - C:\Users\Admin\AppData\Local\Temp\1014317001\b7a4ed0858.exe
    "C:\Users\Admin\AppData\Local\Temp\1014317001\b7a4ed0858.exe"
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\1014319001\d19b28a3e1.exe
    "C:\Users\Admin\AppData\Local\Temp\1014319001\d19b28a3e1.exe"
    3⤵
    PID:5304
- - C:\Users\Admin\AppData\Local\Temp\1014320001\42e92ff879.exe
    "C:\Users\Admin\AppData\Local\Temp\1014320001\42e92ff879.exe"
    3⤵
    PID:5648
- - C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe
    "C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe"
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Local\Temp\1014322001\eb667c3038.exe
    "C:\Users\Admin\AppData\Local\Temp\1014322001\eb667c3038.exe"
    3⤵
    PID:6608
- - C:\Users\Admin\AppData\Local\Temp\1014323001\pcrndBC.exe
    "C:\Users\Admin\AppData\Local\Temp\1014323001\pcrndBC.exe"
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Temp\1014324001\9b0cdf634b.exe
    "C:\Users\Admin\AppData\Local\Temp\1014324001\9b0cdf634b.exe"
    3⤵
    PID:7164

C:\Windows\system32\taskeng.exe
taskeng.exe {7BCD3810-0156-4E97-B011-D7AD5FC5481F} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
PID:1232
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  PID:568
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:6536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3324
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  PID:5136
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6236

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1703190172-2199138051528710144-605368679-1193952934-20311859791247353636988327559"
1⤵
PID:664

C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
1⤵
PID:6160
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3124
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3204
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3148
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3980
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3824
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5524
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3392
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:5852
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:5872
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:5892
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5908
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5916
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\10009630142\asyno.ps1

Filesize
8KB

MD5
f70295b70c3e6286003abdc7da833a10

SHA1
7830ef4260e1f3f466a223180024e6c2b125f8fb

SHA256
26e911f2c072a6a642d64680d5aaa55f2069db9d0983bea65e2ca949b5f4cce2

SHA512
fb363f4f8d1c5025fc58c8b96a189902239c0863e2fbd1bb1bbdd072278f3263f7da5e45dea0e2fed292a60e711445d4a93e6649983115f01b2b9d694c5f3bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
026a5c9c022f151e5e12d9c584393da1

SHA1
1fbb19a06b05b72e8162677941bbae650301faaa

SHA256
2814e8849e099ed0e3ace8610738f8cb62896c33017d58878dec7221381d7cb7

SHA512
638123deb7e86fca3d6163c64662a1fba70f61a5cad8ed8e9108ad8e7fba88478423d416490b98c07036fd3d763a1f24ef19a20b3cd77a278e54d8e0e838e1fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15c6aab554dab17aa44eea36a5ebfb62

SHA1
6679e0e96e721ba976a159c5a6415ca82d475a49

SHA256
e2fe166831027fd88d2ee0c08a3201141d9ff282465f3f89a6662abf2cb78c6c

SHA512
1ac2a05992746a67a102d6b3136b52e02d02523df6b27220b2ceee3e42363fe572250cb42d1ef11dfde5f166b8fa5b2c9e63158a892783d527dead82b6658661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
135e39435afd2f4e9f65923572d228ca

SHA1
84ebbe0f6e63f74921da152d96e3f7a436fdd39a

SHA256
579b1a0f3f466f5008fc7d6dd300e68181953230236d50272463c243c2165bc7

SHA512
d44528e2af22737c08cd9cc04ca95079a021886f16939c3ca8b3cbad4031d1a638b3995ec6fb3056cd029ecefce7be49dc225b643f5c40331e3ecaea04fe76b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000331101\Office2024.exe

Filesize
2.7MB

MD5
df92abd264b50c9f069246a6e65453f0

SHA1
f5025a44910ceddf26fb3fffb5da28ea93ee1a20

SHA256
bc7d010eb971dbc9cbeedc543f93bb1b6924d57597e213dbe10c2c1efd8d0296

SHA512
a3f48831efa65cea6a2cf313f698b59d84119023196e11b1266d937a5b4c05aa4aab67c6d40450bef5c9245b46316980906fa73196d892f2880abc2b1b863455

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000361101\stail.exe

Filesize
3.7MB

MD5
05574162f8903085a1bf8093b0716157

SHA1
1babb85c7f120c92eb692cc401621db79d6ec420

SHA256
47531a0f2ae741c56b37899e4ea504cce24e8daa41876f37897f79d11858ba05

SHA512
a2bc8618fcd60d7dadbedc47beb4e93d5af8a095b42f63d950f004fd3b43a209fde7771cd40de3f9b182517b05f734472e665dc22a291c0b0c43a1fc9ccd2931

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe

Filesize
809KB

MD5
9821fa45714f3b4538cc017320f6f7e5

SHA1
5bf0752889cefd64dab0317067d5e593ba32e507

SHA256
fd9343a395c034e519aea60471c518edbd8cf1b8a236ec924acf06348e6d3a72

SHA512
90afec395115d932ea272b11daa3245769bdcc9421ecd418722830259a64df19ed7eacca38000f6a846db9f4363817f13232032ab30f2ab1aa7e88097361d898

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002824001\13c5d97907.exe

Filesize
2.8MB

MD5
6a3268db51b26c41418351e516bc33a6

SHA1
57a12903fff8cd7ea5aa3a2d2308c910ac455428

SHA256
eaebfc5e60378bbc47a603ca1310440c290a396cb2446de36ff6e7afb624ee0c

SHA512
43f257dbb7e444355e29a8023e8c8838c9e0ca7538a86c25ac41db1e0308bf73c3adda1b0fe5d0bcf536387b9ce5f8fed216f5f7d92c80bcc12e7bffde979b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe

Filesize
429KB

MD5
c07e06e76de584bcddd59073a4161dbb

SHA1
08954ac6f6cf51fd5d9d034060a9ae25a8448971

SHA256
cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

SHA512
e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe

Filesize
429KB

MD5
ce27255f0ef33ce6304e54d171e6547c

SHA1
e594c6743d869c852bf7a09e7fe8103b25949b6e

SHA256
82c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c

SHA512
96cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe

Filesize
3.6MB

MD5
378706614b22957208e09fc84fceece8

SHA1
d35e1f89f36aed26553b665f791cd69d82136fb8

SHA256
df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d

SHA512
bef7a09ce1ffd0a0b169a6ec7c143ca322c929139ca0af40353502ae22fed455fe10a9b80ba93cc399a88add94f921b7aa801033ddae351f8f8d477781ca476e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1005970001\chrome11.exe

Filesize
4.5MB

MD5
5b39766f490f17925defaee5de2f9861

SHA1
9c89f2951c255117eb3eebcd61dbecf019a4c186

SHA256
de615656d7f80b5e01bc6a604a780245ca0ccefd920a6e2f1439bf27c02b7b7a

SHA512
d216fa45c98e423f15c2b52f980fc1c439d365b9799e5063e6b09837b419d197ba68d52ea7facf469eae38e531f17bd19eaf25d170465dc41217ca6ab9eb30bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006029001\l4.exe

Filesize
5.9MB

MD5
d68f79c459ee4ae03b76fa5ba151a41f

SHA1
bfa641085d59d58993ba98ac9ee376f898ee5f7b

SHA256
aa50c900e210abb6be7d2420d9d5ae34c66818e0491aabd141421d175211fed6

SHA512
bd4ef3e3708df81d53b2e9050447032e8dcdcc776cf0353077310f208a30dab8f31d6ec6769d47fb6c05c642bdd7a58fb4f93d9d28e2de0efc01312fbc5e391e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe

Filesize
1.4MB

MD5
338cbbffa6028ee1a0beb3e7e6c4abd9

SHA1
bd008e415d2d85a124d33d455a2e2b0a0312be39

SHA256
1af9406ad522df70d8b59054cbdbef1a267fe199ab0ec1369523cdce9884bea6

SHA512
a8bb96d8ab47a3f57d5f1fc48c61392e9b28b379517cd12a468044d42a7ecdf9c099244d94784ff2411b358ea2272f8069a2fee2ea952b693ee460de0f689215

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe

Filesize
1.4MB

MD5
6e7ffd057086e44e4fcc01846cd2b152

SHA1
05712e7e7b8429b2dd201ea504dc32fefe5795da

SHA256
fbc587e990949e428e8ce7a2c74dbf85cd63ffa07370756ad854595fea0033d7

SHA512
8cab1824b32c54273658d28738109c8a1ef3170c1fbe02deeee40d40990acb6d45431bfb65a3facebee9a919bd972734012b1e8de035b9c1329f1bd0e709ecd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006141001\networkmanager.exe

Filesize
2.1MB

MD5
f8d528a37993ed91d2496bab9fc734d3

SHA1
4b66b225298f776e21f566b758f3897d20b23cad

SHA256
bc8458a8d78cf91129c84b153aafe8319410aacb8e14aec506897c8e0793ba02

SHA512
75dc1bbb1388f68d121bab26fc7f6bf9dc1226417ad7ed4a7b9718999aa0f9c891fed0db3c9ea6d6ccb34288cc848dc44b20ea83a30afd4ea2e99cff51f30f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006184001\023a3f0f8e.exe

Filesize
1.7MB

MD5
fa8bc0aa526b9961adf9260dc7ec9399

SHA1
044527ce83eb090a0c1ec2cdaddedc5f5405bf2d

SHA256
1722fc2ecb85459ab3e76adc12f5c29d3e3ee2b4b18dd48c5ef0e5d79b77330e

SHA512
2f0244f7f3cf90b0dd1e5d04db4e4d443a16e7779bf791dc68ed54f6d734e1d620193967e96ee881b03e5b6ef6a8609efdb890f5345db340d94fe70c2807c31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1006185001\eba865b6c6.exe

Filesize
2.7MB

MD5
f150e060b781896b4e6e1029ee1f5b74

SHA1
ef52c884174df898a956d9a40304e586e2382e2d

SHA256
0316ba41b0629155197d29677225f77581c470a5f91aea8dd6a38850cd510516

SHA512
40dc0453b3feece1d0ad5ed8de9cfd45465347190c1031791c6a035dc0e74bd842fa21e56b86feebe89892dfbd8bcdbf8d44bc658c0afcfb6deb6d0b5e18c18f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011459001\b8a2442192.exe

Filesize
1.8MB

MD5
3b5428fec258a2c2b250d9cc543fbe87

SHA1
fe28d0fb467baad2be5622e7aafc0c54586850be

SHA256
8c2b50cbbb58c0277697e4c82994fc810a882722cd83ef7b701b975959e5123a

SHA512
34d5abbba093d484200c733357bedc4de88480c891f93d1b3c24bbf14eb852aaada76537d6ed3564e9928982392ab7e4f678c5a901991ba81010004a189b2762

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe

Filesize
1.8MB

MD5
9d09272ac982d62d77946b1f957b6112

SHA1
f431d0c1aeed11eaa7a51d97a1a00e0c1f0530c2

SHA256
33b1f3d3f016753911b3e9efeb89ad133c855cd6e4850c0b43b1842ee90ad7fc

SHA512
33c1299c43775a31f27dd2b9747734efc8825b74f8237b489d334126917d0202a3477b4677ea674237a65ba475faac4a24b3a5e6b568d3e1eca9367b34767f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe

Filesize
9.9MB

MD5
53306653e88891da35bdfc1330a2dafd

SHA1
0870df54ca24e32bf88ccf00d7dd0ada3a0ea096

SHA256
fc3471e819eafc1640b51c5c8d4bd36db60dc96d912769fa0dfd619f3ec6ff09

SHA512
930ff27fc7377eaf0097cc6430f2c5486336c398a7ae08fadbcb0af62490b96c0b9ec3d36455c04e5a79d2405fc0c6f1f6a44b0298f3b6ff46f2a6c591aa51ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013561001\C1J7SVw.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe

Filesize
2.5MB

MD5
2a78ce9f3872f5e591d643459cabe476

SHA1
9ac947dfc71a868bc9c2eb2bd78dfb433067682e

SHA256
21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

SHA512
03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013765001\yiklfON.exe

Filesize
2.4MB

MD5
258fbac30b692b9c6dc7037fc8d371f4

SHA1
ec2daa22663bd50b63316f1df0b24bdcf203f2d9

SHA256
1c1cc887675c501201f7074794a443c3eb56bcd3d25980e4ef65e9b69d44c427

SHA512
9a4a810cf5c9232762149e8ec4677da7d4a58835174e504614d7aea09926ab084b574dab85c060fa2306e3423112c29455806d6c32db86e401573eb3f24ce0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013771001\3EUEYgl.exe

Filesize
1.8MB

MD5
3b8b3018e3283830627249d26305419d

SHA1
40fa5ef5594f9e32810c023aba5b6b8cea82f680

SHA256
258e444e78225f74d47ba4698d49a33e6d1f6ed1f3f710186be426078e2bf1cb

SHA512
2e9a42e53406446b503f150abfa16b994ee34211830d14ccbfbf52d86019dc5cca95c40222e5c6aed910c90988f999560ff972c575f9c207d7834abba6f04aa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe

Filesize
1.8MB

MD5
58f824a8f6a71da8e9a1acc97fc26d52

SHA1
b0e199e6f85626edebbecd13609a011cf953df69

SHA256
5e5b808ed64c4f40e07a4894e1da294e364383f0a51adb7ec8c7568afba3eb17

SHA512
7d6c752369ea83bad34873d8603c413e9372ff66adcaad11e7f23d3ce85827e057444b30eadf927329191825aef4dc37a1e68c30b71fae4ce6f53708102fb461

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe

Filesize
612B

MD5
e3eb0a1df437f3f97a64aca5952c8ea0

SHA1
7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

SHA256
38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

SHA512
43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014031001\IGEaNGi.exe

Filesize
419KB

MD5
ec5e3bc0d1d207a45d0f7e27e8f111c7

SHA1
2de3cb791c7e3aa0826c59b2f85fdb4335d9b84f

SHA256
4d0126ee20144c065da90de50807354877e8015c020a99a1d3f7cf3e051b5817

SHA512
cb660188329b067b69dc0e7d291b9fe545688c79ce9b0f117a63d0596e6a27f8cd7a1b199abc6f07284077213ac2a42ce0ad18376824fabbdd4437a5e10b5a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014060001\732e958cc5.exe

Filesize
710KB

MD5
28e568616a7b792cac1726deb77d9039

SHA1
39890a418fb391b823ed5084533e2e24dff021e1

SHA256
9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

SHA512
85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe

Filesize
898KB

MD5
5950611ed70f90b758610609e2aee8e6

SHA1
798588341c108850c79da309be33495faf2f3246

SHA256
5270c4c6881b7d3ebaea8f51c410bba8689acb67c34f20440527a5f15f3bc1e4

SHA512
7e51c458a9a2440c778361eb19f0c13ea4de75b2cf54a5828f6230419fbf52c4702be4f0784e7984367d67fabf038018e264e030e4a4c7dac7ba93e5c1395b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe

Filesize
384KB

MD5
dfd5f78a711fa92337010ecc028470b4

SHA1
1a389091178f2be8ce486cd860de16263f8e902e

SHA256
da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

SHA512
a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014322001\eb667c3038.exe

Filesize
1.8MB

MD5
e72fd16086a8ecf58337b89509435373

SHA1
8352b01f92cdfa8e5c932513e2ef6363a6a5871c

SHA256
1e76927aa56820767353dd841c3f309f91eb10decead250755a984791efad821

SHA512
3cb26d20b5138ebcdef1adaea9b8fa0bfc7b56862c3ac5b7500a419a6836e3e2656aab697f6459131b0d8672123411dc60d1e15d7c745aa881580ec5c6d3c841

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD45.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD86.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp234A.tmp

Filesize
2KB

MD5
1fceee67ba55935cf85a485b89140cb3

SHA1
8035f8f32ff7fdabdbd5bb3c9fab996557f408d0

SHA256
fe6c84ce001f82dcd74eefea1c50e4dcfa78b7defd63be49013527aebdb89717

SHA512
ed3b43b0aa18f902538ec131263ee06de57ca4fd60603b6447688141046249aaea402d588f9d44173d8cbf10eb63d170eb2f1ef118b2df57ee3b2c23f99b6a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Local\Video Minimizer 2.31\videominimizer.exe

Filesize
3.4MB

MD5
8b3e6dae10a8df6749671e2edd7293ef

SHA1
384a330c084651c5e400e1edb47491665681f9c9

SHA256
8f9bdb0ad286fc79d8d82aa2e0e133352cd0723243f7f6c390c85303dba16516

SHA512
2738a21783ea867e8fc6fa9aed4e753ac0040878b0748333a58dcbe3ca725c5b179ce8fd8f6083e4ea3bae71f1fbaac9290060e6bbeb539a4a8401725e8ee6f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KB7Y8GPBI83WB0YEGMT8.temp

Filesize
7KB

MD5
3e701bf5dcf5d3004699d4a412f1102b

SHA1
4b6033be3b91d1042e1cfc5a90b0025b7e1111fa

SHA256
1386f4c886497e085ea5f18fb63f982e0371f210d189f2031da10bf66105c2bd

SHA512
9dc6021d5657ac022564c51e816cfaa1a5f85224dfa42fe4f25bbb36c78dcf5c51a0bfdef3c88379d24defd3bedf2f886c5b1880a8b231a36ffe4af06cfd8353

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

Filesize
124KB

MD5
0d3418372c854ee228b78e16ea7059be

SHA1
c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

SHA256
885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7

SHA512
e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI2642\python310.dll

Filesize
4.2MB

MD5
c6c37b848273e2509a7b25abe8bf2410

SHA1
b27cfbd31336da1e9b1f90e8f649a27154411d03

SHA256
b7a7f3707beab109b66de3e340e3022dd83c3a18f444feb9e982c29cf23c29b8

SHA512
222ad791304963a4b8c1c6055e02c0c4c47fce2bb404bd4f89c022ff9706e29ca6fa36c72350fbf296c8a0e3e48e3756f969c003dd1eb056cd026efe0b7eba40

Download Submit
\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.1MB

MD5
710c44d15b43173067b038379c47ffe9

SHA1
c3a27447cb2c87d4830e0d425f614d46402708cb

SHA256
c0d8949a43e4f44feb242e6005244765936ea303098a7e517e0e5d2450c45a69

SHA512
77e6670f844a3e4debdb7c71d1c5701d55735da729d511ac02f7b9b84cd818aba491f912e097a332d80b14067f45a089f3484db95f0adc3aaece0c6d1a7ed695

Download Submit
memory/664-213-0x0000000000FD0000-0x00000000012CB000-memory.dmp

Filesize
3.0MB

Download
memory/664-553-0x0000000000FD0000-0x00000000012CB000-memory.dmp

Filesize
3.0MB

Download
memory/664-332-0x0000000000FD0000-0x00000000012CB000-memory.dmp

Filesize
3.0MB

Download
memory/664-337-0x0000000000FD0000-0x00000000012CB000-memory.dmp

Filesize
3.0MB

Download
memory/680-162-0x00000000003B0000-0x000000000084A000-memory.dmp

Filesize
4.6MB

Download
memory/680-180-0x00000000003B0000-0x000000000084A000-memory.dmp

Filesize
4.6MB

Download
memory/680-86-0x00000000003B0000-0x000000000084A000-memory.dmp

Filesize
4.6MB

Download
memory/680-309-0x00000000003B0000-0x000000000084A000-memory.dmp

Filesize
4.6MB

Download
memory/912-336-0x0000000006320000-0x000000000661B000-memory.dmp

Filesize
3.0MB

Download
memory/912-462-0x00000000061D0000-0x0000000006A1D000-memory.dmp

Filesize
8.3MB

Download
memory/912-635-0x0000000000920000-0x0000000000DD3000-memory.dmp

Filesize
4.7MB

Download
memory/912-212-0x0000000006320000-0x000000000661B000-memory.dmp

Filesize
3.0MB

Download
memory/912-571-0x00000000061D0000-0x0000000006A1D000-memory.dmp

Filesize
8.3MB

Download
memory/912-3451-0x00000000061D0000-0x0000000006431000-memory.dmp

Filesize
2.4MB

Download
memory/912-469-0x0000000000920000-0x0000000000DD3000-memory.dmp

Filesize
4.7MB

Download
memory/912-3428-0x00000000061D0000-0x0000000006431000-memory.dmp

Filesize
2.4MB

Download
memory/912-106-0x00000000061D0000-0x0000000006431000-memory.dmp

Filesize
2.4MB

Download
memory/912-105-0x00000000061D0000-0x0000000006431000-memory.dmp

Filesize
2.4MB

Download
memory/912-281-0x0000000000920000-0x0000000000DD3000-memory.dmp

Filesize
4.7MB

Download
memory/912-729-0x0000000000920000-0x0000000000DD3000-memory.dmp

Filesize
4.7MB

Download
memory/912-142-0x0000000000920000-0x0000000000DD3000-memory.dmp

Filesize
4.7MB

Download
memory/912-322-0x0000000006320000-0x000000000661B000-memory.dmp

Filesize
3.0MB

Download
memory/912-66-0x0000000000920000-0x0000000000DD3000-memory.dmp

Filesize
4.7MB

Download
memory/912-211-0x0000000006320000-0x000000000661B000-memory.dmp

Filesize
3.0MB

Download
memory/912-173-0x0000000000920000-0x0000000000DD3000-memory.dmp

Filesize
4.7MB

Download
memory/992-711-0x0000000002610000-0x0000000002618000-memory.dmp

Filesize
32KB

Download
memory/992-710-0x000000001B250000-0x000000001B532000-memory.dmp

Filesize
2.9MB

Download
memory/1508-554-0x0000000000400000-0x0000000000C4D000-memory.dmp

Filesize
8.3MB

Download
memory/1508-463-0x0000000000400000-0x0000000000C4D000-memory.dmp

Filesize
8.3MB

Download
memory/1508-742-0x0000000000400000-0x0000000000C4D000-memory.dmp

Filesize
8.3MB

Download
memory/1508-572-0x0000000000400000-0x0000000000C4D000-memory.dmp

Filesize
8.3MB

Download
memory/1508-564-0x0000000000400000-0x0000000000C4D000-memory.dmp

Filesize
8.3MB

Download
memory/1508-464-0x0000000000400000-0x0000000000C4D000-memory.dmp

Filesize
8.3MB

Download
memory/1508-565-0x0000000000400000-0x0000000000C4D000-memory.dmp

Filesize
8.3MB

Download
memory/1668-3230-0x0000000004DB0000-0x0000000004E3A000-memory.dmp

Filesize
552KB

Download
memory/1668-762-0x0000000000E70000-0x0000000000FDA000-memory.dmp

Filesize
1.4MB

Download
memory/1668-797-0x0000000004BA0000-0x0000000004CB2000-memory.dmp

Filesize
1.1MB

Download
memory/1668-799-0x0000000004BA0000-0x0000000004CB2000-memory.dmp

Filesize
1.1MB

Download
memory/1668-786-0x0000000004BA0000-0x0000000004CB8000-memory.dmp

Filesize
1.1MB

Download
memory/1668-796-0x0000000004BA0000-0x0000000004CB2000-memory.dmp

Filesize
1.1MB

Download
memory/1916-144-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1916-265-0x0000000000220000-0x0000000000481000-memory.dmp

Filesize
2.4MB

Download
memory/1916-107-0x0000000000220000-0x0000000000481000-memory.dmp

Filesize
2.4MB

Download
memory/1948-3264-0x0000000000280000-0x00000000006F6000-memory.dmp

Filesize
4.5MB

Download
memory/1948-3256-0x0000000000280000-0x00000000006F6000-memory.dmp

Filesize
4.5MB

Download
memory/2128-0-0x0000000000D90000-0x00000000010A5000-memory.dmp

Filesize
3.1MB

Download
memory/2128-4-0x0000000000D90000-0x00000000010A5000-memory.dmp

Filesize
3.1MB

Download
memory/2128-19-0x0000000000D90000-0x00000000010A5000-memory.dmp

Filesize
3.1MB

Download
memory/2128-18-0x00000000065E0000-0x00000000068F5000-memory.dmp

Filesize
3.1MB

Download
memory/2128-21-0x0000000000D91000-0x0000000000DF9000-memory.dmp

Filesize
416KB

Download
memory/2128-1-0x00000000777D0000-0x00000000777D2000-memory.dmp

Filesize
8KB

Download
memory/2128-16-0x00000000065E0000-0x00000000068F5000-memory.dmp

Filesize
3.1MB

Download
memory/2128-705-0x000000013F760000-0x000000013FBF0000-memory.dmp

Filesize
4.6MB

Download
memory/2128-3-0x0000000000D90000-0x00000000010A5000-memory.dmp

Filesize
3.1MB

Download
memory/2128-2-0x0000000000D91000-0x0000000000DF9000-memory.dmp

Filesize
416KB

Download
memory/2236-703-0x000000013F760000-0x000000013FBF0000-memory.dmp

Filesize
4.6MB

Download
memory/2236-1037-0x000000013F760000-0x000000013FBF0000-memory.dmp

Filesize
4.6MB

Download
memory/2268-731-0x0000000003900000-0x0000000003C76000-memory.dmp

Filesize
3.5MB

Download
memory/2268-650-0x0000000003900000-0x0000000003C76000-memory.dmp

Filesize
3.5MB

Download
memory/2268-717-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2292-134-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2292-141-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2292-130-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2292-128-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2292-126-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2292-136-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2292-138-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2292-139-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2292-132-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2340-636-0x0000000000CC0000-0x0000000001150000-memory.dmp

Filesize
4.6MB

Download
memory/2420-741-0x0000000001000000-0x0000000001270000-memory.dmp

Filesize
2.4MB

Download
memory/2420-3542-0x0000000005350000-0x00000000054B0000-memory.dmp

Filesize
1.4MB

Download
memory/2420-3546-0x0000000000540000-0x0000000000562000-memory.dmp

Filesize
136KB

Download
memory/2492-743-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2492-744-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2492-712-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2492-732-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2492-651-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2672-596-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2672-716-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2768-271-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-42-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-143-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-22-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-160-0x00000000061C0000-0x000000000665A000-memory.dmp

Filesize
4.6MB

Download
memory/2768-161-0x00000000061C0000-0x000000000665A000-memory.dmp

Filesize
4.6MB

Download
memory/2768-468-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-87-0x0000000006210000-0x00000000066C3000-memory.dmp

Filesize
4.7MB

Download
memory/2768-23-0x0000000000051000-0x00000000000B9000-memory.dmp

Filesize
416KB

Download
memory/2768-85-0x00000000061C0000-0x000000000665A000-memory.dmp

Filesize
4.6MB

Download
memory/2768-24-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-84-0x00000000061C0000-0x000000000665A000-memory.dmp

Filesize
4.6MB

Download
memory/2768-715-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-610-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-56-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-49-0x0000000000051000-0x00000000000B9000-memory.dmp

Filesize
416KB

Download
memory/2768-26-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2768-43-0x0000000006210000-0x00000000066C3000-memory.dmp

Filesize
4.7MB

Download
memory/2768-44-0x0000000006210000-0x00000000066C3000-memory.dmp

Filesize
4.7MB

Download
memory/2768-47-0x0000000000050000-0x0000000000365000-memory.dmp

Filesize
3.1MB

Download
memory/2852-3298-0x0000000000E30000-0x00000000010EC000-memory.dmp

Filesize
2.7MB

Download
memory/2852-3299-0x0000000000E30000-0x00000000010EC000-memory.dmp

Filesize
2.7MB

Download
memory/2912-46-0x0000000000A30000-0x0000000000EE3000-memory.dmp

Filesize
4.7MB

Download
memory/2912-65-0x0000000006700000-0x0000000006BB3000-memory.dmp

Filesize
4.7MB

Download
memory/2912-64-0x0000000000A30000-0x0000000000EE3000-memory.dmp

Filesize
4.7MB

Download
memory/3024-1036-0x0000000000D40000-0x0000000000EAA000-memory.dmp

Filesize
1.4MB

Download
memory/3024-3498-0x00000000023B0000-0x0000000002404000-memory.dmp

Filesize
336KB

Download
memory/3024-3229-0x0000000004DC0000-0x0000000004E4A000-memory.dmp

Filesize
552KB

Download
memory/3024-3231-0x0000000000C80000-0x0000000000CCC000-memory.dmp

Filesize
304KB

Download
memory/3024-1197-0x0000000004B80000-0x0000000004C98000-memory.dmp

Filesize
1.1MB

Download
memory/5648-3663-0x0000000000D50000-0x000000000100C000-memory.dmp

Filesize
2.7MB

Download
memory/5648-3662-0x0000000000D50000-0x000000000100C000-memory.dmp

Filesize
2.7MB

Download