ec33d8ee9c3881b8fcea18f9f862d5926d994553aec1b65081d925afd3e8b028

Resubmissions

31-12-2023 09:11

231231-k5vvksadc3 6

29-12-2023 08:53

231229-ktts5sgbh8 10

Analysis

max time kernel
378s
max time network
1388s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDesk.exe
Size

5.3MB
MD5

75eecc3a8b215c465f541643e9c4f484
SHA1

3ad1f800b63640128bfdcc8dbee909554465ee11
SHA256

ec33d8ee9c3881b8fcea18f9f862d5926d994553aec1b65081d925afd3e8b028
SHA512

b3a48230fc6f20038c938e5295b68a3f020b94e220ca2fab6a894d126dc41f6f1021c239613bf9d6de84370ad7df9d9a91baf716a87d43eb101ee3e48578e5ff
SSDEEP

98304:j5ObAu2pmits24nYhQCWQdaQQo/mJPv4KYZPKBhYI5RuN4OL2wIjcsJWNg3:IAnRu24nR5QcTvYdmPuWOL2TcQWe3

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-1803-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2384-1838-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2496	1688	WerFault.exe	66
708	940	WerFault.exe	68

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{920E6DB1-9907-4370-B3A0-BAFC03D81399} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000020e457ef343ada01	AnyDesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{16F3DD56-1AF5-4347-846D-7C10C4192619} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000020e457ef343ada01	AnyDesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000020e457ef343ada01	AnyDesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{08244EE6-92F0-47F2-9FC9-929BAA2E7235} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000602c66ef343ada01	AnyDesk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	AnyDesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000602153ef343ada01	AnyDesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99FD978C-D287-4F50-827F-B2C658EDA8E7} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000c08255ef343ada01	AnyDesk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000020e457ef343ada01	AnyDesk.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2916	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2820	AnyDesk.exe
2820	AnyDesk.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	AnyDesk.exe
Token: 33	2316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2316	AUDIODG.EXE
Token: 33	2316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2316	AUDIODG.EXE
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2916	AnyDesk.exe
2916	AnyDesk.exe
2916	AnyDesk.exe
2916	AnyDesk.exe
2916	AnyDesk.exe
2916	AnyDesk.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
2916	AnyDesk.exe
2916	AnyDesk.exe
2916	AnyDesk.exe
2916	AnyDesk.exe
2916	AnyDesk.exe
2916	AnyDesk.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2160	AnyDesk.exe
2160	AnyDesk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2820	812	AnyDesk.exe	28
PID 812 wrote to memory of 2820	812	AnyDesk.exe	28
PID 812 wrote to memory of 2820	812	AnyDesk.exe	28
PID 812 wrote to memory of 2820	812	AnyDesk.exe	28
PID 812 wrote to memory of 2916	812	AnyDesk.exe	29
PID 812 wrote to memory of 2916	812	AnyDesk.exe	29
PID 812 wrote to memory of 2916	812	AnyDesk.exe	29
PID 812 wrote to memory of 2916	812	AnyDesk.exe	29
PID 2404 wrote to memory of 912	2404	chrome.exe	36
PID 2404 wrote to memory of 912	2404	chrome.exe	36
PID 2404 wrote to memory of 912	2404	chrome.exe	36
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1932	2404	chrome.exe	38
PID 2404 wrote to memory of 1580	2404	chrome.exe	39
PID 2404 wrote to memory of 1580	2404	chrome.exe	39
PID 2404 wrote to memory of 1580	2404	chrome.exe	39
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40
PID 2404 wrote to memory of 2288	2404	chrome.exe	40

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of SetWindowsHookEx
    PID:2160
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66d9758,0x7fef66d9768,0x7fef66d9778
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1108 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:2
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1296 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:2
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3316 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3552 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=536 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2600 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3524 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3188 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=896 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2524 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1204 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1972 --field-trial-handle=1276,i,5266296038570851502,5428223598085214104,131072 /prefetch:8
  2⤵
  PID:2928

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2300

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\" -spe -an -ai#7zMap28114:106:7zEvent1990
1⤵
PID:2380

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\*\" -spe -an -ai#7zMap9200:1392:7zEvent1295
1⤵
PID:1788

C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 864
  2⤵
  - Program crash
  PID:2496

C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\Spark\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\Spark\[email protected]"
1⤵
PID:940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 632
  2⤵
  - Program crash
  PID:708

C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]"
1⤵
PID:1276
- C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]" /watchdog
  2⤵
  PID:2976
- C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]" /watchdog
  2⤵
  PID:2348
- C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]" /watchdog
  2⤵
  PID:1292
- C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]" /watchdog
  2⤵
  PID:2736
- C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]" /watchdog
  2⤵
  PID:1392
- C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ\[email protected]" /main
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2888

C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\Illerka.C\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\Illerka.C\[email protected]"
1⤵
PID:2596

C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\HMBlocker\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\HMBlocker\[email protected]"
1⤵
PID:2384
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 6 /f
  2⤵
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
  2⤵
  PID:2096
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
    3⤵
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\HMBlocker\[email protected]\"" /f
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\HMBlocker\[email protected]\"" /f
    3⤵
    PID:108

C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\FakeActivation\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\FakeActivation\[email protected]"
1⤵
PID:1224
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  PID:2044

C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\DesktopPuzzle\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\DesktopPuzzle\[email protected]"
1⤵
PID:2836

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7a1a01bb-cb88-4993-b83e-40ba89e3b19d.tmp

Filesize
224KB

MD5
01d016fe9841bcc96fd08ed999e18165

SHA1
0ea476fdc44b23a186dc8a17e83ec6e4b904a0ae

SHA256
2796760d49457945caa47d3b8683d0696a22d284a9cde150c9eca4db462c1be0

SHA512
f183ca28485eca4c87c56012d2896c7fde8a93028e5fb879d6c054a38804d7b856fd5d434a0d5e9889d1ac58c30f097f33c2aa87e3a52047237febf43d2cae07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2348bc50c4872ef2f8e5306ce356807d

SHA1
f9eeb7020c905f184b1c479b42cfcc375ee8a2c7

SHA256
b420ba006e8fb9db5a0d5016dae97b7a6b5fc2ca1a619e92a7595c65903dae45

SHA512
2ca36e13a7e8e37e397a9f09ea5ff29e94c2ccb0f27e6398a4bfa25ce062d6391ae5a565cd114faddb561cd25ced29ba2f29051c39d43a48c0d56f372333a6e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf7f3302.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\98ea7406-663c-4a7f-bf30-efdfa67b4514.tmp

Filesize
5KB

MD5
79c348109778ec0b28c08ae72b2d1adc

SHA1
daefd517aa0cae1dc1d4679b3e81692980cd9929

SHA256
3b1f650b1814cec1cfcdca5a3176564b1620106270620cff3bc15a38b832ba57

SHA512
4a1170122325fad12ef43777945cea11cd7892dbb3a202df5ad458c1d777a9f154c4cd6647e5f2c93e245c948367002d46fe127a2f925782af3b342544d7c0fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1d8dc3c201dd76aa58d567dfd6d6c5aa

SHA1
a8a6f383ae046fac9f41f5cdc9fe5d3b07832855

SHA256
b1db41f6f6598275f519306fe3f2ec7b3da52763dcd1cebccd40c66e76ba1a14

SHA512
d441d37794ae2f15b37e5d99f1029913bbcbc3798af874bb1feba37ae0138d3eba2f271b8a2e04998d38f74add393c8f8e25a7a0f2c8c431fe47ab3fb8449de8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
00fa89e79b88974edfae9addbcc425b1

SHA1
fe5123b246f46bf6ae13c9db473cae6dd6015345

SHA256
2ea3e4acf4e5cc80580fa14ae74e69d2545602ad17f884fbb1ef52cd286fc16b

SHA512
bf2a167517ece14dc2352aaebde23e469b1fef43813e7ff6350ff636cfbebdc712af28ec1180f0e16697c1507cf15638e722293d85e5ba024f6f3fa8c157bc01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
07c8d512c350c52d32102714b70bab4a

SHA1
d25fc6f6841ac139e53abfb5a625824f67bf1ec8

SHA256
3ce84960b0af29f7addeddc12f5b473893a33ef05738fd38774de8da80007f7a

SHA512
78741dd05e83b744805470787eeed539429d10672557317c5e807378be8b9322f2fc8d1a4b4d8717bed2d48bdeebc529a1623344ebb7bd3d2cac912be27d1580

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
bb777eda60e3fbf73768dd25f1fa0993

SHA1
5e6a8535594563e4a98bea796379fd68a116e925

SHA256
f778aca1a67288ddf691d6cab2492f852081e8a2c710dbc8a4337095fc499536

SHA512
329530a4364f06b0d029782848ee55a05b17d8848de8552c4343cd29f8f97ef6ae423dc876ee4a8002a8bd57a705ec9643d959b0b4d62ab9a6c04053f761cd45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
63974948021f1c3dd2eb83846362663b

SHA1
8831dbe050f859e69bb15e905028180f879b2c6b

SHA256
12a854573556bc4760e5f01180827c9972356360bb58b461ad9e6ddcf05397f7

SHA512
76a219ff82a90589f8ecce0bf1313ba6de85d38200d878155308c355c758d299084ae35d0296c5720aa622dbb98bd539a955a9e00cd4f7eae3152905febdbc8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
f005745504ff50d009fb41537771a605

SHA1
fa8280d22680256ba48357580cc6208682c01e54

SHA256
7ff207af426b01aadb213a64f5cdcbdc2db882ab6ecd801ca4e0a343139d9e39

SHA512
a90763401bc056bed6324d4fb00ca51b88f6616e68d51dd07c2854089f7237aefbbfb4d672f230aa206270344a8834f1c9f1dd660ebe135685077475086595ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b24d180b28fd866b5ad22318923740b4

SHA1
88e3ada3ef6ee9da0954a8b37b598b2e554ce90f

SHA256
8fac5735e78cbf9f64dbfe7308a97983ea6ec51df6912d3642d1d2e5e7fff299

SHA512
63c1706f5f02d78a150abab00610a6e22f76b3e1f33c3446c013c3d0bce75b054b78483eab9ea68142b0a97203714aba0c8e738fa74dc1aa3fc62990700ef3aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
359B

MD5
4868e6d220c7484e9773913d4a2341fd

SHA1
5f15b4dde10daeca574e78c45293a29cfbb3ed9d

SHA256
551d1e6ce41c3e5de7647114cb1aeea629462b45657d1ed7fa911859c9d2868b

SHA512
28475aee08d13f7d2bf465d008fc00b9065cdd5cec3d4067fa656307b94d50b79965da30eade9c91f39e1da7b8203946bfa80a3d50d54914f7e456bbedd32134

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2464143d951f30098b718ededfc6df8a

SHA1
0bc7c9615e8fc377c85f20245dc3256cdf8536cf

SHA256
a52350cca6131429fd55f7a05249c954d265b259cc89ec2f5924e79a44158520

SHA512
ad3134bf115d58b7567dc170ce287a637d9f2428ada6e0ca8b8233472ffb45943e74f9c957e5642855a4e0fa24ef8acce834187c21ecc84137d066fdd931780b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
57a5cd0f614b3887f44c5d4d71b68cb7

SHA1
02a3be21cdf615122dd2cf92ad766d0200ef85b4

SHA256
0e797a231d22458c6205fc60a55fe3cbf7050f2b3ec63e882e21908efb663774

SHA512
891eb30f926eb4a278a5890881f5c5d5ae4de17e429abd8e3ff9277a49992fe59fe310d87aecc8eeadf5ad0a11d3eadfb6a34f775fd78a5ffa9821bceea860cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
dc4f405f1ab260b933ecd5cae4a38277

SHA1
d0245c4427dcc6689f7bf363bee9b3812d15dc56

SHA256
dbc85ff3e598bd77abe05df97670419184b77836b3e3bc98075e1214ccbf7063

SHA512
b6cd00919a3bdd24bada98245009afd9b83a5f64901529daf1bfc222e79220e54da23d0db15c8b67c342b724c90ef05eec428f248f8065df5180415f8c911309

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
27d8d587170531be5a72bb580da5fc73

SHA1
d12b522c5427c662ac4d84ac8d7826d2a4a7bcde

SHA256
1bfbab17de1e68509d25c5d7008bc6e4d69922d1e9c724142598d3f24fa4f808

SHA512
596861972eaef2a2c6f7bfa687b7d3f0a7f81005629f4888fa81a2d0047b196785857454ed242f3668ae56edfc2b0ea1450473338cd6a919119c4af235a208e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d4a0b9b4a8602b1a1a8305154b65010e

SHA1
55f092c2ecf2f81508767678db5ac8154aa21c3b

SHA256
152670c85e7799d817d17689ca0ee5615cc0dab404d41b5bde910e27e36300dd

SHA512
a312c4cfed72bb47a18ff2fc7efc9aca7e83fe24aa562b82e36051365e3c92c9369cb6ad0c67188eb45567111a97ea39cc9283ea9f8fdfde06da811a9539deb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0211a0479597ae6492e45e835ee9a65f

SHA1
b3e72aeb589ca71b9a5c43ae61e9247d778ac060

SHA256
4bbbd07e4bc3bd2f7fde87b923291fbcb5a4d39e1208b2840ea0befa64071d46

SHA512
eca5b48ec1a2787476260045aeb54e3a93ee4ca09199a66a64d9b4c57ca9f86a4561b5ab8f7eac312cca01bbcd37a4c14aa5a8511c1806d2ef9fe186331da729

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9848200266d4477fa65a2d65dede4c6b

SHA1
79b7650dff966866c28492dfaac80cea0e68916b

SHA256
5511073f3ca444d145771d349f2014472baff8129fb1f5cc352f5086c0a52cd1

SHA512
94d39848e50d5e7bcc5c34ffd07f1639c4ce65a5bff94511eb7174f41759d01ef7476019be0cc3ecf438d65fcc407e5b274e79f3a5b27c3121acc5bff3e33432

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
d6208387085187aa2ca45c23a42e6814

SHA1
d52eb0ba8f5e5b210117671bfb8b661589801c17

SHA256
05e7ed779df897c4cb8695e7138adecd01b0dba4d7fbf5df0353593716c6a892

SHA512
e69c7e3ffbc2378d739b04eb2fdee0021b91254bc62b69d4039cfd7a3b7720bd00e06746f3c98e52d723514c064f0381ccbe8e4c0f8f2320cb197c9ce567d782

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fb5842e6-8ed7-4856-b357-ed4d62b5fae2.tmp

Filesize
5KB

MD5
e149dec9d6c23d51fccd41b7690675a0

SHA1
71c69467edf0ec1e7129ff733a74c6c8afabed3b

SHA256
2e92d8ac19a86565178afb2ab98f69da0c6ba2428f04e99c8faee26d67f1d2f1

SHA512
aebfd60c20e0da27d8c5d03019fbdd298d4bae62fbf047ad8c6acbe77740512bc7007dbe046895e914312b82a269cb407270068e447028f7a8521e122c72bb9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
224KB

MD5
3db776e0de5f8fdb1422708ce76f481f

SHA1
dbe1b62686a62807cdac640e4c9d6673063ce29f

SHA256
6b3c16f05c8cb024255462e901ca7f15a917b7fb20be9101b53b05233713bd39

SHA512
68f86545a6a053791718223fff404831b6b78785bbde9aba5d779b68a2d2c85452b4e6d1cf82f199ea2f33cf0a49d3f855907d75b508fe75c73e480642193d1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
76KB

MD5
9c1ac05adad796437898c2cb57018d56

SHA1
5e30641f5a1dbbd256f69ff3afa502ddcd55da3c

SHA256
746fc4a35a0086e0f8a5a60d8c21ab339ce5e025485aaccb73c443f140423b7a

SHA512
6efac82e972fc998f42dc04676f9feeae0b6ceafff165662f64ea5f987c630e0ecf1f836be94123b9a69cab55a7f887409c7184e5b048e04b4d3c3768696c5da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
82KB

MD5
95382fb81fa375cc84bb1fb9a59813fe

SHA1
9bf617bb4309aebd4418e52c493fe3b9f34436f5

SHA256
1ccc14cac870db843f9775e6450ae89bb5ebca1d1cb94be5074023f63e357f11

SHA512
c73acfc03a1b7263a082c926df32a67cfd07cbe9f8cda22ad13a283735ec26b1afb13c6466251f8cb6588c59c44aa8ec39fc1ce753cfeb35a5b6fe877f60e761

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab255E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25AF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
6KB

MD5
ad02ab977624c32d9c394355498be5d2

SHA1
d33eb8a40a30f1dbd4217169d560c81969088b81

SHA256
93953eba175cd4bd1b455967e54e0b820e170a9b3bff51f2e05a251056b21b01

SHA512
d09146bc1c12e518ee24f37881de157e913fc13721b348e52673b1279ecb693e0c6c9187473654a8c330347722bf6c7f0f8c54ed9fb183547e51c79efbf248e6

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
39KB

MD5
88d0a8d7e8c14a42f5f8ff79add22c3e

SHA1
669e6686deb16d943f86ccb3e73e4262198d81e0

SHA256
47c034ec65de1986a0891e9aa5bc24ea9ec6cf7504c826e1df1906c066f5bbee

SHA512
366c251c9afddf0249dcf99b4fbdf320609607383ae579a429e8bd7dcf2828c695a3a5ccb98a7b9013874d0b2e7c58ad674661bba48e67297bb88292c9b85aa9

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
877c5d0aff5b1fd57ad98c6b99e14ca2

SHA1
771573e9f02c88869c2108c56747a56579eede8c

SHA256
c8d439af83faad92acf3f9f1f05e0462e222033f4bc16001d7db964848215778

SHA512
ae36ee19ca9dd308d1862d33e88fa59d6bc7e71571319f036e75da5ea87f3b17ae331664afbea41542fdf15ab63815fa16d7b13f6d844cef29631cd581406cb8

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
3abaa4e6debe4c27c44089c6b607de36

SHA1
4244b9023da9ca7cc73b4760fdc22e36312198f5

SHA256
310d600bde26f15bc27fa54356bc9a9546b91f5bd1d7f2594baab39ad0543c76

SHA512
d70af2847ec67b1b6139b86756c04025b73674bc0cab51b4d15a063f1eabce7563f9a6b1bd318a0bd5c2c581bd0b77b2df2e02ed40e9639fbd8ff4303fa2f855

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
25c942829d19df96cc336a65b27b8c28

SHA1
1e67e302d437658c7a37579cfe857d6bf322aaa2

SHA256
0e12d5b3dfdbecbc638c64f7fa3bc0ba470433895a1b2ca75e5cda80d3fb085a

SHA512
2df34f98defd3532e1c115e526d65f2b3aaaab57336f08254e2fd95f053de567197e013e8b8f5670aebcad2d62ddd0dfabbc2c07e524e8ef0ea84784371132bd

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
681B

MD5
b4873e4d1ca97a859a4475fda2fd95e4

SHA1
98f90cb13be21eaa1c8cc688828e6d0401a5986c

SHA256
e7bfc376f566b29c6e4108e5d7181a26f8b77c24da1cbb3a571768831cfbc79b

SHA512
3ec7507dc3c7f2880d579adc3319f0726aaf65b6f10c80270f49ff52b0ed3d45cb0635e820adde2b9a3404d8c636559cf4e0e458eca6395361a8a6553c77ba00

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
745B

MD5
61fee6b8f0506835b323b3a8755685e5

SHA1
63dea99b26c986990ed785034d374f71152816fc

SHA256
9f917b4d1cfac0be8e17ee5a3fd4759b7025644ccea29a8c4f967dd87c7425ae

SHA512
b3f5ba05d714735bf350e953b3c8b1417ba5d7d4406581951c313506c4a20b9a1bd875fd3810764c91699967ba22429e981d40c1a043f7c5cfd5aa8b7f57dd0b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
4c46d8ec190f1112f4b7876ffd4ca4fb

SHA1
d11986eb75d99279da273eaca6bf159b24a35fcb

SHA256
1518b747deac4cd2e92f3f5cb53b6122b7427217ae1d08ba7ca70e7d4eef15a4

SHA512
8410776384d9d6cb54f18a77b754f772e4fda8caf449c3334b628bfbf22dc14c51c64810586c2149fe8cbbc0089255f057053c3e4bd556a199c48d501525ecd1

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
8bd642725b7fcdddd74f93c1f825d2c5

SHA1
5cd29055f48f964cf0b3e83d519df4bc1e316b9c

SHA256
dd0e14b38f5080f4cd0e7e3d7f73f9f6adb2aa80a5a6e0addaf6ea4c30b62cc7

SHA512
0c37a862d39dc25f8734aa1637efa1396a7b1fee76b5795f7dd68a492153da9444bff2bb7a547d7710025eba726d6564ba31317ebb9fbf6a2e7edb1d0b7185db

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
b4e945ce3eeeffebc9869aa7e4c0ed30

SHA1
60fe6aa527ff82f5e5b9fe9ce175fe05d9a278f1

SHA256
86bc46ca1d9d17764bb43a2b85e3af0a82ce285cfb2727628b5cb1763d0e70c7

SHA512
ea72cf2a30427e32941cf2f83c5c0a14f2fe313b4300cc20b754e0b185b6dbf713fc57fa2910dcd44eda63ea63f4e1d03fd767ffbac93486338dbd479085f313

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
6537f0b85bb4497298459910b4a2be9d

SHA1
5ad28c6fbf5ccd22dbea0b107e96d9188f3bc0c4

SHA256
fe6a94e01bd05f2fb8b8c4625a00be59264861284d9ac690d4e88f8d13ee10b8

SHA512
2743f7aa8fce5749e7474c0877e7e3b95b7a03d582e8dd06423919d3ad24f44de1a5072d7792d6d5da5a86040dca5e056a270e5aa84cfe63ffb247347d300b23

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
e9e12123f1e9bff13db8d20f81b4e087

SHA1
0405d4dcc775596b868a96926053c3abd47ec8d8

SHA256
1293552d19e378c3f06c42cd5d32d2c29fd40838c421ca5d591fbcafbb63ebad

SHA512
d9db638b21a479dce27f13acfd2f20198af71bd1747fdd4ada6db97476a8a7d27dc5763fd4041b77ab4cc1141db5de708694176a4d503dea99897ad454398e34

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
5KB

MD5
58c98f80b9b304dbb42df6b306c84e43

SHA1
e27448b5137ab1232d46153dec9a6905ef8b209c

SHA256
bbdede79f6279fa053b6ac18da014eaaf9b58fe83a31967a4ccc79bfdbf621e7

SHA512
1d0b37687b64ceb15432b27029db6fb71e70afccac6304dfc11ea221d5f5f9403356690291fb59efc45e0c70098e66353e8c3683cf50e8c48449dbb97cb74a8e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
8119843a09f76519ffac5a1019916d6c

SHA1
75a8d37e5e3348de3a2d7bb2b6d688f48598ede9

SHA256
78d2b19332481e6f0df842a51b40e38f60aedfd06d82efafc591fdba9b066fc7

SHA512
2431835afbf9ebb572e41ecfd8029084fd33d9f2cf383abbf69db58e68f220c12f554063865e133cd650f3c9ef73b22300fa0c91708737477fff0de8ae8dea22

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master.zip

Filesize
512KB

MD5
9d2e3c2428af8ec2c38ddd3fda458377

SHA1
9e49ce0b97592e930b4849018125892d5742616e

SHA256
4fd6febac23874a0a1afaec90afdaf259662d061da550590240f6c56d3675834

SHA512
a6af5fd33de4e7c2dafe58a43046fa1e5e8a7f609a0464e48b0845814f7b246b3f010b6b10b98e7f700acbd1fbe39d12802ce6a5043d7dcdb426cba1673544a5

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\000.zip

Filesize
119KB

MD5
d113bd83e59586dd8f1843bdb9b98ee0

SHA1
6c203d91d5184dade63dbab8aecbdfaa8a5402ab

SHA256
9d3fe04d88c401178165f7fbdf307ac0fb690cc5fef8b70ee7f380307d4748f8

SHA512
0e763ff972068d2d9946a2659968e0f78945e9bf9a73090ec81f2a6f96ac9b43a240544455068d41afa327035b20b0509bb1ad79a28147b6375ed0c0cf3efec5

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\ColorBug.zip

Filesize
28KB

MD5
34071c621da9508f92696709d71bb30a

SHA1
5817a14b8da5da5aecd59f5016c2b02fbbe2f631

SHA256
ff2e6648e019087c2ec3c0f9eab548a761122b696caca171ab88e414ba5615cd

SHA512
eb4c3b5ce9a4d6e979565d44c1a1432272bd2b9d1b83ca6b03ddc9982a5a6c341126ba71bbfd0e8d443ffa93265b6d205c187f586ff0bcb708965d2db6c98b45

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\DesktopPuzzle.zip

Filesize
121KB

MD5
6ec216cae1f0e898635d296bbb1a7539

SHA1
8725949a62c581e4c55d7338dcf3f67997840278

SHA256
431b9b7321f734a3f11b23e638199ff1f0d9abe9374ec299484d9e47f20b4ee2

SHA512
b619a5e8ccc0473d99453108085b1678a75dc816bbeb1d5301cd265ff8aee18e214d4e7b877d0d5d13921238d45581cb89021c4dbfb9ba2f3bddb4d4f297ddfe

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\FakeActivation.zip

Filesize
275KB

MD5
6db8a7da4e8dc527d445b7a37d02d5d6

SHA1
4fcc7cff8b49a834858d8c6016c3c6f109c9c794

SHA256
7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984

SHA512
b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\HMBlocker.zip

Filesize
38KB

MD5
5968e8a8caa61b46ba347f8c521c1f2e

SHA1
88f9a7ce6e77d191c9a57ecf238ef5e9e9ba6c7c

SHA256
a181f8925c8c66614be38de89e6dc38cf85715379a10de8d9f9d70b04891ca35

SHA512
6b0659ff7a5548cd1b752a72a70b147d1c9676dce14148430961a7b5204d4e3a42de5530d423ebb879f8e5c72785a45e5b20bd40cbf93cfaefe981534e96cbe3

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\Illerka.C.zip

Filesize
64KB

MD5
9f7249077b949c96bfa3fbafc38e4ee2

SHA1
1fec3d58de9f782dfaabc323222f89adea6b7d05

SHA256
519fb20d9caba12bac93c363bb64d8bade4971fad49e8bf489d1e512784c28c0

SHA512
088ce74aee633ae25ef764555f1a2686f32efde5b28cb1afebad9926ab69f574506e3dc68b7b2d8f966bc19b96b50f9cbbd28beed0afd70cdad6d77581e072f6

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\Spark.zip

Filesize
1.6MB

MD5
860168a14356be3e65650b8a3cf6c3a0

SHA1
ea99e29e119d88caf9d38fb6aac04a97e9c5ac63

SHA256
1ae2a53c8adc94b1566ea6b3aa63ce7fe2a2b2fcbe4cec3112f9ebe76e2e9bf9

SHA512
0637e4838beded9c829612f0961d981ee6c049f4390c3115fed9c4e919561ad3d0aa7110e32c1d62468a7e4cdc85d2f2e39a741939efd1aafae551de705aab61

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\TaskILL.zip

Filesize
14KB

MD5
f3f982622520af32cc86d3a22f352af0

SHA1
99b7c8a8afa3cfc7292893d7b2253a581249d9d4

SHA256
653b5c625dc6f24dcab5aaf33e77fd3c994f4783884c21d0a71b5c1fefbeb4e1

SHA512
27482f0293b88c1a31dd1132401b4df19d3636f1a31f2b607ccf9a28dde0165381d65d9d0c492ab6c300bd1da0aac9e8df8c7cb3394cea35c90ce1a544a0576e

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\YouAreAnIdiot.zip

Filesize
223KB

MD5
a7a51358ab9cdf1773b76bc2e25812d9

SHA1
9f3befe37f5fbe58bbb9476a811869c5410ee919

SHA256
817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612

SHA512
3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\YouAreAnIdiot\AxInterop.ShockwaveFlashObjects.dll

Filesize
17KB

MD5
451112d955af4fe3c0d00f303d811d20

SHA1
1619c35078ba891091de6444099a69ef364e0c10

SHA256
0d57a706d4e10cca3aed49b341a651f29046f5ef1328878d616be93c3b4cbce9

SHA512
35357d2c4b8229ef9927fa37d85e22f3ae26606f577c4c4655b2126f0ecea4c69dae03043927207ca426cc3cd54fc3e72124369418932e04733a368c9316cf87

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\trojans\YouAreAnIdiot\YouAreAnIdiot.exe

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
memory/812-20-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/812-142-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/812-301-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/812-299-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/812-280-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/812-1-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/812-0-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/812-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/812-186-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/812-300-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/812-23-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/812-31-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/940-1789-0x0000000000C40000-0x0000000000CC0000-memory.dmp

Filesize
512KB

Download
memory/940-1790-0x0000000004390000-0x00000000043D0000-memory.dmp

Filesize
256KB

Download
memory/1688-1778-0x0000000001000000-0x0000000001072000-memory.dmp

Filesize
456KB

Download
memory/1688-1786-0x00000000004F0000-0x0000000000530000-memory.dmp

Filesize
256KB

Download
memory/1688-1783-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/1688-1779-0x00000000004F0000-0x0000000000530000-memory.dmp

Filesize
256KB

Download
memory/2044-1836-0x0000000000020000-0x000000000004E000-memory.dmp

Filesize
184KB

Download
memory/2160-347-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/2160-332-0x00000000041F0000-0x00000000041F1000-memory.dmp

Filesize
4KB

Download
memory/2160-321-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2160-333-0x0000000004220000-0x0000000004221000-memory.dmp

Filesize
4KB

Download
memory/2160-363-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2160-336-0x0000000004270000-0x0000000004271000-memory.dmp

Filesize
4KB

Download
memory/2160-337-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/2160-335-0x0000000004260000-0x0000000004261000-memory.dmp

Filesize
4KB

Download
memory/2160-334-0x0000000004240000-0x0000000004241000-memory.dmp

Filesize
4KB

Download
memory/2160-367-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2160-331-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

Filesize
4KB

Download
memory/2160-356-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2160-341-0x0000000004660000-0x0000000004661000-memory.dmp

Filesize
4KB

Download
memory/2160-340-0x0000000004650000-0x0000000004651000-memory.dmp

Filesize
4KB

Download
memory/2160-339-0x0000000004640000-0x0000000004641000-memory.dmp

Filesize
4KB

Download
memory/2160-338-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/2160-342-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/2160-343-0x0000000004780000-0x0000000004781000-memory.dmp

Filesize
4KB

Download
memory/2160-345-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/2160-344-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/2160-353-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/2160-346-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/2160-351-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/2160-352-0x0000000004210000-0x0000000004211000-memory.dmp

Filesize
4KB

Download
memory/2160-348-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/2160-349-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/2160-316-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2160-350-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/2384-1838-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2384-1803-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2384-1807-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2416-1840-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/2596-1799-0x0000000000C30000-0x0000000000C70000-memory.dmp

Filesize
256KB

Download
memory/2820-70-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-19-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-39-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-354-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-76-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-151-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-309-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-361-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-203-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-30-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2820-12-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2820-290-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2836-1837-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2916-61-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2916-232-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2916-362-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2916-291-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2916-160-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2916-129-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2916-72-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download
memory/2916-11-0x0000000000CB0000-0x0000000002480000-memory.dmp

Filesize
23.8MB

Download