b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[email protected]
Size 6.1MB
Sample260930-m9bcvadg42
SHA256 b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77
MD5 04155ed507699b4e37532e8371192c0b
SHA1 a14107131237dbb0df750e74281c462a2ea61016
SHA512 6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371
SSDEEP 98304:hvOOFJ+Z8eAgy7SH9s76RSvyqJOBgECfMfYv+85JH0DVczt8A:hvOOFJ+ggr9s76R+wcMAv+IHCczt8
TLSH
T152567C15BA409003E2737A76CDA352CD5819BE661D34542B26A43F4CBF70B83FA36B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware bootkit defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
defense_evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	IS300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	IS300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	[email protected]

Drops file in Drivers directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	[email protected]
File opened for modification	C:\Windows\System32\Drivers\etc\hosts	IS300.exe
File created	C:\Windows\System32\Drivers\etc\hosts	IS300.exe
File opened for modification	C:\Windows\System32\Drivers\etc\hosts	IS300.exe
File created	C:\Windows\System32\Drivers\etc\hosts	[email protected]
File opened for modification	C:\Windows\System32\Drivers\etc\hosts	[email protected]
File created	C:\Windows\system32\drivers\etc\host_new	[email protected]
File created	C:\Windows\system32\drivers\etc\host_new	IS300.exe
File created	C:\Windows\system32\drivers\etc\host_new	[email protected]
File created	C:\Windows\system32\drivers\etc\host_new	IS300.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	IS300.exe
File created	C:\Windows\System32\Drivers\etc\hosts	IS300.exe
File created	C:\Windows\System32\Drivers\etc\hosts	[email protected]
File opened for modification	C:\Windows\System32\Drivers\etc\hosts	[email protected]
File opened for modification	C:\Windows\system32\drivers\etc\hosts	IS300.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	[email protected]

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secure Veteran.exe\Debugger = "svchost.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init32.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe\Debugger = "svchost.exe"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secureveteran.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe\Debugger = "svchost.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdfndr.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secureveteran.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Save.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe\Debugger = "svchost.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveDefense.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus\Debugger = "svchost.exe"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecuritySoldier.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Anti-Virus Professional.exe\Debugger = "svchost.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\homeav2010.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~2.exe	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frmwrk32.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartprotector.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pc.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe\Debugger = "svchost.exe"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe\Debugger = "svchost.exe"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securitysoldier.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SafetyKeeper.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smart.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gav.exe	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frmwrk32.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows Police Pro.exe\Debugger = "svchost.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Quick Heal.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pav.exe\Debugger = "svchost.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frmwrk32.exe	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secureveteran.exe\Debugger = "svchost.exe"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Quick Heal.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntispywarXP2009.exe\Debugger = "svchost.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Debugger = "svchost.exe"	IS300.exe

Executes dropped EXE 2 IoCs

pid	Process
108	IS300.exe
2272	IS300.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\f3f8e\\IS300.exe\" /s /d"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]\" /s "	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\f3f8e\\IS300.exe\" /s "	[email protected]

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\	[email protected]
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\	IS300.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\	[email protected]
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	[email protected]
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	[email protected]
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	IS300.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\	IS300.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	IS300.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\H:	IS300.exe
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\T:	IS300.exe
File opened (read-only)	\??\Z:	IS300.exe
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\D:	IS300.exe
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\K:	IS300.exe
File opened (read-only)	\??\Q:	[email protected]
	\??\F:\	IS300.exe
File opened (read-only)	\??\I:	IS300.exe
File opened (read-only)	\??\P:	IS300.exe
File opened (read-only)	\??\I:	IS300.exe
File opened (read-only)	\??\N:	IS300.exe
File opened (read-only)	\??\P:	IS300.exe
File opened (read-only)	\??\R:	IS300.exe
File opened (read-only)	\??\V:	IS300.exe
File opened (read-only)	\??\Z:	IS300.exe
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\V:	IS300.exe
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\H:	IS300.exe
File opened (read-only)	\??\R:	IS300.exe
File opened (read-only)	\??\S:	IS300.exe
	\??\F:\	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\M:	IS300.exe
File opened (read-only)	\??\M:	IS300.exe
File opened (read-only)	\??\W:	IS300.exe
File opened (read-only)	\??\W:	IS300.exe
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\J:	IS300.exe
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\X:	IS300.exe
File opened (read-only)	\??\D:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\Y:	IS300.exe
File opened (read-only)	\??\D:	[email protected]
	\??\F:\	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\O:	IS300.exe
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\L:	IS300.exe
File opened (read-only)	\??\X:	IS300.exe
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\Q:	IS300.exe
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\U:	IS300.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	IS300.exe
File opened for modification	\??\PhysicalDrive0	[email protected]
File opened for modification	\??\PhysicalDrive0	IS300.exe
File opened for modification	\??\PhysicalDrive0	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	IS300.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	IS300.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	IS300.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	IS300.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IS300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IS300.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IIL = "0"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltHI = "0"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IIL = "0"	IS300.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltHI = "0"	IS300.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltTST = "40306"	IS300.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IIL = "0"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltTST = "40276"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltTST = "40292"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IIL = "0"	IS300.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltHI = "0"	IS300.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltTST = "40287"	IS300.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltHI = "0"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%"	[email protected]

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "IS300.DocHostUIHandler"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\ = "Implements DocHostUIHandler"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\ProgramData\\f3f8e\\IS300.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IS300.DocHostUIHandler\Clsid	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IS300.DocHostUIHandler	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IS300.DocHostUIHandler\Clsid	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "[email protected]"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "IS300.DocHostUIHandler"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\ = "Implements DocHostUIHandler"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\ProgramData\\f3f8e\\IS300.exe"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IS300.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "[email protected]"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IS300.DocHostUIHandler\ = "Implements DocHostUIHandler"	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IS300.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	IS300.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IS300.DocHostUIHandler	IS300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IS300.DocHostUIHandler\ = "Implements DocHostUIHandler"	IS300.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]
4432	[email protected]

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3224	mofcomp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4432	[email protected]
4432	[email protected]

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4432	[email protected]
4432	[email protected]

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4432	[email protected]
4432	[email protected]

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3224	4432	[email protected]	89
PID 4432 wrote to memory of 1468	4432	[email protected]	91

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp "C:\Users\Admin\AppData\Local\Temp\55.mof"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3224
- C:\Windows\SysWOW64\netsh.exe
  netsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\[email protected]" "Internet Security Guard" ENABLE
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1468

C:\ProgramData\f3f8e\IS300.exe
"C:\ProgramData\f3f8e\IS300.exe" /s /d
1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]" /s
1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:5464

C:\ProgramData\f3f8e\IS300.exe
"C:\ProgramData\f3f8e\IS300.exe" /s
1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 666ec003330f57d76086bfb562811d7f8388e95eb473b90005156e15f2cec62b
MD5 b528b33a3cea014802ebd94a1a1b67dc
SHA1 556cf31684a10c1c17789e96efc38b64e56fe21d
SHA512 fa807589b7a0877465eb1e3903c9a4e2d665a21a51100f8deee4cd675bf92ba5a0027e484804cbbf9fe131033d6efee4132f82cd33ced6387fe6ee866e8d5f5b
TLSH
T11F315FBC9007A3C0015CED9AD39A8CD7834623627E522A268B7C76453E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 d09ecf444fa949bea1ce70f9fe5b2af90bc018b024cb3d7914dd4b10f866205b
MD5 9781316233103d918d31021e605e2e99
SHA1 838551ebb87d35fbfa2be9565045c543be0e2587
SHA512 f4a65f238545ce1ee74c59d96d46fb5a9ac37a240b178db6a3b3c50f24bc357d30644d98467cb391a6e18635d076e3a7babf380425c20d512d03ad4d0203e757
TLSH
T126212DBD9007E3D0515DEE9AC38E5CD6434663616D423A278B2CB5453D5BB12CFCA0EA
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 2775b035fb6622b24e2b0bfe3c868ad28c207b4a74c32b01ae2e2b13a128d6af
MD5 53f3818fd7d2d761ada44da96a975b77
SHA1 e1d2ebb76defbe11b85fca0473a0b08986cdd4e2
SHA512 f29873be80eeabe9e85e945bf74b728075ac87e3b5792bc444d6abc65ba9f7ef09b7021582eafb8c8f213e09916346a501c31f74f357480fcd29e812fdb5f10e
TLSH
T1E32121688007E2C4250DDC9693A64C93938722567D523A12C77C76413E5F701CFCA4E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 2e3c5a5e12a42e269d40da5394c545a19361ab3b87bf8c592d1fdc3a641c9dd3
MD5 01b848c1f141e11b7dfd6125bc5fc8f9
SHA1 692fa9e182aa4f9496833aa96638740851cfc55e
SHA512 045748558bc916f1b17bcb9bb4fda6f27e62796b53e3d9139ce19aed3d90732abfc5d1602d5c7e412b95321de133c3203ebf0530cb64ceaaa0fc991d6a0d55b0
TLSH
T1DF315FBC9007A3C0014CED9A939E8CD7834623217E522A26C77C76453E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 c982ba54d80eca625cf0e9ea9258ba047363f4aebd2d65a94a2e2688aef22505
MD5 8fb9884a6ec4e43ff20188fbf9ae8fd0
SHA1 6b3ee1ec2b19b6e40c93fa229898246c7fca8cee
SHA512 218e652eb760b63288a4d819433fa95c2070418598c85666d5cd6c954c7804661472a984ea58279b356245cc1f10c1c1ac95949f91275f16cd903efb99966a2a
TLSH
T1E9315FAC9007A3C0014CDD9A939E8CD7934623617E522A26C77C76423E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 00de5144f67cf44aed5fd347a725be41eb87f9504fe317059e0c1084508bdd49
MD5 661a60371f79464b5dd91b905a43964a
SHA1 2eaa9531d66fa0fd3343b00babcf3da194043743
SHA512 b928e1265f43c6648c196891e8150b8bbbd3b425fc03a63bd28dfdb1a740f42dc4a393aea3892a8cbd98286e1b229c2fde3ad9f35375a181dbb992eac8210909
TLSH
T1AA315FAC9007A3C0015CDD9AD39A8CD7934623617E522A26CB7C76423E5F712CFCA0EA
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 64eeb0cd7fbf09857725e9a865b64c3f00d1ebdfc6c28bde25474c86686fca07
MD5 48792a5ab57985a63401cbda15e56d62
SHA1 9cd00ee8d28ed86e37b972a57795c10c7f70099a
SHA512 3ba1eec13026f801ca42f0ef7ecaacb8834d052c05d10838e5ebbf7de1364ab5da9312b60b81bef2738e81ad6a82deba30e2759ea7beee59170cc4c818eb4e63
TLSH
T13C315FAC9007A3C0015DDDD6D38A8CD7934623617E522A26CB7C76423E5F712CFCA0EA
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 51d20e02a9439c8cb9944df89cb7f7e8b9331a37f27e3c6c0cdf2da775a0b04b
MD5 841467a2ae06ce5c0ed3beac6b580e0c
SHA1 a8633227ac1059d3b9b234ac7cbee5e7ff99c37b
SHA512 45609c0a0c7345930068629885d415eeebe6d55a6d6ec60182934fc8fe5bfe51f83ba792b5764284112b9f2a5bb354020a809695c7b08a61b957ba0a02debd67
TLSH
T195315FAC9007A3C0015DDDD6938E8CD7934623617E522A26CB7C76423E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 263B
SHA256 56f2d13b8cfc4e158815649a5fdac376e43844ff844b1fd4983e42186bea2892
MD5 035927252f9748b63ad9a4404b2ac6ff
SHA1 eb1062f1e905f736cba6c9db563c62d4828dfd02
SHA512 9f097f5e8ac38488d62f1280258c76be5355fb4e3d525848cf4b80cdda69fce6b54b6483e65ca65618bc05638a24bc66705d741c37eb515a5e806dd2e58ff758
TLSH
T1DFD02B18A813E2B47518FD1895A95D839383718CA53235804D0CA4017C6F20296DDC95
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 381B
SHA256 eb3fcccc83f1a32bd785dc022b0433239c93f7c0290ef24d33375fd1faf88b41
MD5 f3277330733ff0e2bdba69f3b3ccfe54
SHA1 40b677bfa5c2551a28f38a2a103a97e3b887e5ae
SHA512 b7137a267819347042d746271993694c59c01470519510cc17a9f0869781e10f809e84a6993b7fcd5c70db2f2a3e470540750c70a1b46528a36cbcaf64257661
TLSH
T140E0F198D403B2E42514FE59865C09D2978361C8642336108A6CA4043C2F201E7DCCB9
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 438B
SHA256 71fc072bdf3df27af0e11c770d544be06912b04b9545ea2b09717522cee1dfe7
MD5 44dd4f20d66622a9c23f9ddbf3b9eb53
SHA1 517542d84f6f634b7a5e0ba3197cce58025311f4
SHA512 0147456972ab74d0246539983987d0cb82eab4c906bc50403493e5950563dc5c597b5f9bdd46b11d388bcc03bcf070f64b25c53bc8ffc3d0e0851febde87bab7
TLSH
T1C7F023ACD403E2E43528FF85C79C08D283C272C868233A608A2CA1083C1F302E7DCC68
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 02c86c0d17511347bba30defc8c63472cdbff23529e74460afbb2193f9b68701
MD5 96c3f69227e88ade491203bc5ae6de71
SHA1 988f311849bd2ca0bd3e337fc6838a19f70a19eb
SHA512 456bc01d94a7e9fd8c099d78626fab56780c808940d1ece452c825b0013ef8d04dab4c6862215c4ab426c5acfa6088b47d94bab5593e02bfc4f68d49678fe3d4
TLSH
T1CA210F6C8007E2C4561DDD9AD39A8CD3938623667D623A12CB7C76423E5F702CBC94EA
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 cd857ed39554c1ca7b9da105078e1a7e1c4a72d63d638c7c70f130377fa650be
MD5 cb4097de50d63e91bac54501c64b75a5
SHA1 0585d7635af63c7a7d1f26fc3b4555e0c44f7af0
SHA512 4bc515550de53edfaaed5756aa4080e71908ef1c2968508506a37082888acb8fb355b5589386095a720f654dac5cd14f86b2d63a4998fd02162e37feccf0623b
TLSH
T19D315FAC9007A3C0015CDD9AD38E8CD7934623627E522A26CB7C76413E5F712CFCA0EA
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 fb6b1905404c71678abc9a795d31d47548538c5d970ec39851fdac6f8245671c
MD5 d1f3d1d18ce8ada5d26b36f27a49d693
SHA1 0a1d14d33e1f63ae86fd9d5f69bd8d9967e78286
SHA512 558497def8cd94f85bf1a300d1bfe85d5de4a86cee21978b7e31b186460fc52f3a86d079035e23be169de82b9d8fcf54eb6c55e505eabf2f240bfd794a0ec986
TLSH
T1323130AC9007A3D0116DDD9A939E8CD7934623617D923A268B7C76413E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 47b4984c8295158d68f01fb4e7b04962659e42524b7c5f1141d13e9e4bec8025
MD5 b4d8f866ae5ba0e1ac17f009ce583bb5
SHA1 89e6a9e5b20a5c44c7a353e5d7a23d5cd2355ef5
SHA512 2e75602c8fe16b2363f733e2e63ac5570a01a3c935caf15617fd0b4903d02d460c455e3759e845ad8765f96775278b5ee30d5fb3d4afb1a8aa14df95d681b72f
TLSH
T106315FAC9007A3C0014CDD9A938E8CD7934623617E522A26CB7C76413E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 a9862ec1a56cbec9e905fddce259f69614d22e132e0bc45c9ee0646cf40e5141
MD5 163af0443cd93896ab6ffa2dd4b5367f
SHA1 6247d01db0895c2fca39ac908ec64fc9759db1b3
SHA512 51ae0e3214bd60ec57c0f4be83480881bdab1cc7d88fbb03d8e3905af9e6e919e0893bb0d218e323b5981ab464801cc62377fdc342d8d74bce112568ed422872
TLSH
T120315FAC9007A3C0014CDD9A938E8CD7934623617E522A268B7C76413E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 928B
SHA256 9699058ae01b96f519f8b9e79ea47c26133863018c654a3c590fc897894f158d
MD5 97ba8992567497f4171aa11ae737551f
SHA1 098b7703de3282149ef41b0b6c628e69f669ef77
SHA512 bb406697f4e6590880912c1069eb2d277dcedf0a3fb84cd62657fdbee204c1256f162f55c2b87c5c951a3d0e9758d8ad9e736d0347f16f0239e141c9e89c71be
TLSH
T1C211EFAD90176BE41518E99AA35D4DD3A3033364AE522E158BBC76092C5F3128BC90E3
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 bebd2a0b32477e09778cd72f3cec076c9d7bba429e90174230a5bc8d38e865d8
MD5 b5457c36d65d99d2fd4f095d32675f46
SHA1 65923edd8f43e87295594348b6616355109721eb
SHA512 044dc13e88217cb6a3de4d3549d30d5cf3c501b5ea27cae241e45e5bd71d2511308fe1836b886e3eeeb99c082c5b65e5d51e988d3383ef259cd37f8ae210d9a1
TLSH
T11421F0A88007E2C4151CED96D39A8CD3934763667D523E16CB7C76413E5F702CBCA4E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 42e5f780a98bd99a94f7b8d3c4f24cfadad80bf8eff7606597b7143b53f9803e
MD5 85a3a4e980fbb8338c67f8e2892706b5
SHA1 071e492b063add2063a22e81b485af7bb94fbe92
SHA512 a3003208459ed20c0cac8e619eabb83d6fec819d8644ad4b3f4c500e7ddbccaaae107129c0b7831c5eff0a5efc0c10f3dbff6a1bdbeea764a8d208f78ba268bf
TLSH
T163314EA89007E3D0114CDD9A939E8CD3934623627E523A2ACB7C76413E5F712CF8A0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 ff297981d3c9b794e0edf0e573d8f7020f65ae7d219e9bbffb85fd2dbb0fc361
MD5 f97a32c21d8dbd576da0ad19eafc7382
SHA1 ea0b8ca1a747e9956034d20a8c23aa5627a99fc5
SHA512 9525d247e05cac9bcd05901eab4fda5f73b42b01fcadca1735f1b07bc7e2f186be334ee5e53a555a3620e617d3bde545d4e9a9b600adfd4afb7c8a9a65a70238
TLSH
T174312FAC9007A3D0115CDD9A939E8CD7934623617D522A26CB7C76453E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 e79ebc9a4c92c6e7d88b639f96df451cc8c7de25b4cd7301696516f2d7c10be1
MD5 711c8c138023167f7545d53876e2c622
SHA1 c09f9a2934a41373f010bba1d4dbd8917c3801a5
SHA512 2baafdc35effb3040964fda898c21b0ebc93a38466ad475a7067bdc2485d7fd237432d966d87865cdbe3886bec26047f3693d142b11e56680a652ba0e4f94ca7
TLSH
T1BC315FAC9007A3C0015CDD9AD39E8CD7934623617E522A26CB7C76413E5F712CFCA0EA
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 01bf4dc8c920460d55c4c3eb222d99bfc4c9dda9b8b89f58ecf0aab094cd8f95
MD5 9d2127eeaa029ff776522f9d85896bd9
SHA1 b90f294ae1faa50a8e080e4404b43247dde0043a
SHA512 4369979f960a474ebbbf51ec6dcb4fbfb5ebc3a54f5819b8e7ba0f1a3de98861ea8479b5c9b9448a47d7e3092107e1e0cf76bd62281d8928eb0bca8aa88fe453
TLSH
T13B3152BC9007A3C0015CDD96D3994CD7834623617D522A16C77C76413D5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 fbc99e4ed8c544d6d81e45952805e052c5e88fa5f24d1d73a4e6d6a0de9df0f3
MD5 0df438ac7c9462274615f1898cdd6583
SHA1 9a6b44458cd0ba12faa7abc12a272d3adc567555
SHA512 088d5375069e61b5d1beeadc801b2538fbf64eaeb1f4e61145eb2bac593b4e61aa7d224249f0e537fe739c5f15a3bcd3f8758c4943599b6273e741b68d380aca
TLSH
T18F315FBC9007A3C0015CED9AD39A8CD7834623627E522A268B7C76413E5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 6b316610924efd5ff34a8fc59bf4661273c1d760f7144f13d4a0be43fceb1b0e
MD5 6522d0116d3dd7f88cdaf1a0db824389
SHA1 473cba5a1b7f36629970a582c42e92a3fbeabae2
SHA512 740dc7d11f8d3185bdb3f599ef627e9d6906906f702945a7ab160161973994c8f158cc2fc00fb30ad254a6403a4b992ac94f86cc3c5b703d94b9c60c01a7823e
TLSH
T1282111689007E2C4650DDD9693A64C93938722567D623B12C77C76427E9F702CFCA4EA
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 185B
SHA256 c47da9be4fc4d757add73c49654c9179067af547d0cc758d6356e2955bbfcb61
MD5 b8224e5293d4fad1927c751cc00c80e7
SHA1 270b8c752c7e93ec5485361fe6ef7b37f0b4513b
SHA512 8fed9a509e46319529145fa2159251e43040d26080af84e44badaab1dd339c767ff75a2c473bc0abfb448b03beb96718ee34ba6bc150ed3085322878b55a22f2
TLSH
T175C022096C23D2743829BE0894B82E038282B04CE03234900A0CA810B06B24116DCC89
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 813B
SHA256 e4492a8c9fb2e67d4b1cf1f9cdf583be2f3f94cf5ac293c0b95b0888a5a36349
MD5 a745f00799786f0bd02f45e8edc7013e
SHA1 6b766d422b4494340272525440e015de6518e4cb
SHA512 7b3d8fb06cb7e3d656c63980aae8cfa67c102aa8ecffeb5ce3bbcb2af125869ea2c3029c5414935ebaf12b8fbd9648b70f546a42d1d119a5efda759c7d43fb65
TLSH
T1C001D0AD50175BE40418ED99E35D5DD793033335AF521D198BBC76052C5F3524ACD0D7
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 d6ea1a22b344a3ce614fe816fac8f5222e8d7b8378601eefcf9297a0c26c8c1e
MD5 df392c6158b74f254f3b172b0d93a5b6
SHA1 f6b4dc6423d4f94f9ddaad33f1d5e0e4ef0682ca
SHA512 5359d16d3c1b6320f3237e6ba16e5dd33fd314ca6cd32831f2a5ecbf51a7a5557525753e3d2308b4ecf39c2c4f37d630de1dc9da287327b8c3fd5576620f30d7
TLSH
T1042140AC8007A3D0441CDD8A939D4DD3434263616E922926CB7C72413D5F712CBCD0EA
MD5 SHA1 SHA512 TLSH

Submit Download

ISLNOYRG.cfg

Path C:\ProgramData\ISCXFTKRCCG\ISLNOYRG.cfg
Size 1KB
SHA256 6866b179d75dda567eabb3ab30628bb4d2d1f64081820762427fa065b9c09686
MD5 8d22e7e723c58dbd9068d67c4844cedc
SHA1 371a0f41e27d008f489237dae7b621ebb1634e19
SHA512 ad56a7eb1887d41e1151a179f93b8ab76463388ed998710234d9bff70972392766a5c9c42de2dee66d59e0763f3213941982ea94f2270de4c95f35c96491f90a
TLSH
T1433152BC9007A3C0015CDD96D3994CD7834623617D522A16C77C76453D5F712CFCA0E6
MD5 SHA1 SHA512 TLSH

Submit Download

IS300.exe

Path C:\ProgramData\f3f8e\IS300.exe
Size 6.1MB
SHA256 b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77
MD5 04155ed507699b4e37532e8371192c0b
SHA1 a14107131237dbb0df750e74281c462a2ea61016
SHA512 6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371
SSDEEP 98304:hvOOFJ+Z8eAgy7SH9s76RSvyqJOBgECfMfYv+85JH0DVczt8A:hvOOFJ+ggr9s76R+wcMAv+IHCczt8
TLSH
T152567C15BA409003E2737A76CDA352CD5819BE661D34542B26A43F4CBF70B83FA36B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55.mof

Path C:\Users\Admin\AppData\Local\Temp\55.mof
Size 344B
SHA256 3c77f5f888d417a7a31284cb8c5e3bdb4d926c4a274cecac8a8b2920659d5927
MD5 3754f8f8abad5bad797085d0717a9766
SHA1 48d92f36cb721b390e216aa03b27b41f25c563fc
SHA512 c59f322ece53c757767e52fe9bfbc3526a13afe9ec7503e3d1cae683eeb55cbb808a1bce720fd58f97f286756d314124bcf797c2167275e08ed93ba759bf3985
TLSH
T111E0DF90622B9E591989ABA00022332B3C28119093E61254B918D1A931E7DC6C3F68CD
MD5 SHA1 SHA512 TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 8KB
SHA256 ab802b1ea250c007783d90039543034524a0ba28f55606621767a7873b699f47
MD5 ad5133522b39246284fecda8c65ef144
SHA1 68e81ab4c30420776fddeacfbceec31696d9b288
SHA512 ca8aa081db2a416fdbbb626d1cf3a229298877b55939a7865d98f8a186d68511ddec134d076e25742b1d2797ae11972f66d2e8e1ef8530c7c2fb245cbdafe7c6
SSDEEP 96:Ii7TkixDCyb56s8bpkl1k5qRLpkY1klhbpkgR1k2O2tV5dRXS/xQkR1BD:zkixm0MsSqowrkhbRBOsB9Y6kR1
TLSH
T1DE02D2022BD4FE67F059063A495A9E1AB3347C13BD426B9BB781730A7D76E440427A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 8KB
SHA256 1f0cb4578a8f3bc17a3bb109f7cf6e4505c0e97417db771b2cab036e73da4361
MD5 7a666ecf20e01d9c5a216cadf656be2e
SHA1 9b7bf1ffe88fd76792551985db3ea19baacc120d
SHA512 002f8561c90efe5fbfbad21942cd497b97a4fb001cc02b0b122e89ab5c6b0c4968b39ce74f0851cecbef0a6e8ae5f05eb43fe139124b9a5e4d5cf3c834fc4b95
SSDEEP 96:xi7TkixDCyb56s8bpkl1k5qRLpkY1klhbpkgR1k2O2tV5dRXS/xQFRhBVBD:ekixm0MsSqowrkhbRBOsB9Y6FRhT
TLSH
T19202D0022BD4EE67F059063A495A9E1AB3247C13BD426B9BF781730A7E76E440427AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 8KB
SHA256 672cb5b62516180cea29a85a1df5554bb49dfb3cddd76f2695530227434d0520
MD5 590ee63885fd78b0a4471ce5bf00d88b
SHA1 bc39c8aac007601010341bcff3e154e3d5ca322d
SHA512 e9869bdc2203323aefd372d6ea47f80a5fe8bdc13cadc4ebb6096885aacb1c04651e96bc650eae88d3b55ff17415247646251c054d5c2e7b1c071c3ea27c6662
SSDEEP 96:ai7TkixDCyb56s8bpkl1k5qRLpkY1klhbpkgR1k2O2tV5dRXS/xQzRHBD:lkixm0MsSqowrkhbRBOsB9Y6zRH
TLSH
T13102E2022BD4FE67F059063A495A9E1AB3347C13BD426B9BF781730A7E76E440427AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 145e69800041c806caec10dd3a340654178e0deda382a4a49518bc527fee7333
MD5 fae32c311ede632d78e5ebe13036bfc7
SHA1 f6a2b8506b09cc7020e6ea777501ac2fd47c355a
SHA512 650d81ac1301776e839518904b7d4b5e8dc17cad3706101743ea05f71a457a1f5e21a350e4e0cfc3f0d15144b7e26ad0fab74027500d1fe3e793ff4404191b09
SSDEEP 96:xH4UTUbqGq6fUgC1zS4SSl4dv9jgunXH/+FFBw88u8L4cnYQOnv:umR6fUgCBSS6/4Bw88Av
TLSH
T162E12E7890488B7F74B677ACAC6888316AB2017BBBBF68D750B554C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host_new

Path C:\Windows\System32\drivers\etc\host_new
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

memory/108-970-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/108-988-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/2272-1347-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-994-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1368-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-252-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-0-0x00000000133B8000-0x00000000133BA000-memory.dmp

Download

memory/4432-1349-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1353-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1357-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1384-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1362-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-250-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1371-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1374-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-969-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1376-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1379-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/4432-1381-0x0000000013140000-0x0000000013764000-memory.dmp

Download

memory/5464-990-0x0000000013140000-0x0000000013764000-memory.dmp

Download