Overview

overview

10

Static

static

3

Telegram Desktop.rar

windows7-x64

10

Telegram Desktop.rar

windows10-1703-x64

3

Telegram Desktop.rar

windows10-2004-x64

7

Telegram Desktop.rar

windows11-21h2-x64

10

Analysis

  • max time kernel
    277s
  • max time network
    306s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-03-2024 17:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Telegram Desktop.rar

  • Size

    802.5MB

  • MD5

    c27b7a4ff8387a553aa8ece1233f6f70

  • SHA1

    436290ab35fd3e4de206d9a260c249f4ee14b4cc

  • SHA256

    29d1b3fbd0c2615f298de1abbbb110757c4ed6a04b4e3957212e0d8796c37b44

  • SHA512

    4793d7a3c3ed65cab477c75406dd56d416baa952f25b2812b673922bffc8ac76ae4844de21946ac7e281230c4e42ae8f8ab2f37e374de2e0ab5e5309642ff99d

  • SSDEEP

    12582912:fpcYZCKX/IwdHf9eeXZRvu2zVVx3LziQSLoULgG8LfQa6FWQwUyu0VJARhNzVTI:Rc4X/h/1Jdu2zjxLzicU0GoILJnaJks

Score
10/10
quasarvenomratbitcoindevilians02evasionpersistencepyinstallerratrootkitspywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

BITCOIN

C2

23.105.131.186:7812

Mutex

VNM_MUTEX_jTeJaJnI35a3HyFP0B

Attributes
  • encryption_key

    370UTlW1JPDmtk3VcEH8

  • install_name

    Window Security.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update

  • subdirectory

    windows Security Update 32

Extracted

Family

quasar

Version

2.1.0.0

Botnet

devilians02

C2

150.136.114.11:2222

Mutex

VNM_MUTEX_KAFL0oh3oOLVnswazh

Attributes
  • encryption_key

    Wi8wlts7Jd3enUchOiDe

  • install_name

    Fake btc sender.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Fake btc sender

  • subdirectory

    SubDir

Signatures

  • Contains code to disable Windows Defender 7 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
    evasiontrojan
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 7 IoCs
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat
  • Drops startup file 2 IoCs
  • Executes dropped EXE 51 IoCs
  • Loads dropped DLL 57 IoCs
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 15 IoCs
  • Detects Pyinstaller 4 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Telegram Desktop.rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Telegram Desktop.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2004
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\New folder\*\" -spe -an -ai#7zMap1769:1502:7zEvent3349
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2532
  • C:\Users\Admin\Desktop\New folder\3301 Ransomware Builder\3301 Ransomware Builder.exe
    "C:\Users\Admin\Desktop\New folder\3301 Ransomware Builder\3301 Ransomware Builder.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:2264
  • C:\Users\Admin\Desktop\New folder\B0SS RAT-Fixed (Eng)\B0SS RAT\BOSS RAT.exe
    "C:\Users\Admin\Desktop\New folder\B0SS RAT-Fixed (Eng)\B0SS RAT\BOSS RAT.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Users\Admin\Documents\CLIENT.EXE
      "C:\Users\Admin\Documents\CLIENT.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1780
  • C:\Users\Admin\Desktop\New folder\Bitcoin Fake Transacation V3\Bitcoin Fake Transaction V3.exe
    "C:\Users\Admin\Desktop\New folder\Bitcoin Fake Transacation V3\Bitcoin Fake Transaction V3.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\AppData\Roaming\Windows Security.exe
      "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:904
      • C:\Users\Admin\AppData\Roaming\Windows Security.exe
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Security.exe" /rl HIGHEST /f
          4⤵
          • Creates scheduled task(s)
          PID:2344
        • C:\Users\Admin\AppData\Roaming\windows Security Update 32\Window Security.exe
          "C:\Users\Admin\AppData\Roaming\windows Security Update 32\Window Security.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:892
          • C:\Users\Admin\AppData\Roaming\windows Security Update 32\Window Security.exe
            "C:\Users\Admin\AppData\Roaming\windows Security Update 32\Window Security.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1748
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows Security Update 32\Window Security.exe" /rl HIGHEST /f
              6⤵
              • Creates scheduled task(s)
              PID:1356
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2612
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1312
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
            5⤵
              PID:3020
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\tvEMHiRO5eK3.bat" "
            4⤵
              PID:2340
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                5⤵
                  PID:2212
                • C:\Windows\SysWOW64\PING.EXE
                  ping -n 10 localhost
                  5⤵
                  • Runs ping.exe
                  PID:2028
                • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                  "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1632
                  • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                    "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2980
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\YndtvgyHZn4K.bat" "
                      7⤵
                        PID:2108
                        • C:\Windows\SysWOW64\chcp.com
                          chcp 65001
                          8⤵
                            PID:2600
                          • C:\Windows\SysWOW64\PING.EXE
                            ping -n 10 localhost
                            8⤵
                            • Runs ping.exe
                            PID:2272
                          • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                            "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:1236
                            • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                              "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                              9⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2748
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\4r9uAkSjC9Mo.bat" "
                                10⤵
                                  PID:1020
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 65001
                                    11⤵
                                      PID:268
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 10 localhost
                                      11⤵
                                      • Runs ping.exe
                                      PID:1624
                                    • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                      "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                      11⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:1472
                                      • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                        12⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2304
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\3WnXEctbV3CL.bat" "
                                          13⤵
                                            PID:2792
                                            • C:\Windows\SysWOW64\chcp.com
                                              chcp 65001
                                              14⤵
                                                PID:580
                                              • C:\Windows\SysWOW64\PING.EXE
                                                ping -n 10 localhost
                                                14⤵
                                                • Runs ping.exe
                                                PID:2920
                                              • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                14⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2256
                                                • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                  "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                  15⤵
                                                  • Executes dropped EXE
                                                  PID:1236
                                                • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                  "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                  15⤵
                                                  • Executes dropped EXE
                                                  PID:2132
                                                • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                  "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                  15⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2432
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\q06DEBMOaktJ.bat" "
                                                    16⤵
                                                      PID:2208
                                                      • C:\Windows\SysWOW64\chcp.com
                                                        chcp 65001
                                                        17⤵
                                                          PID:2864
                                                        • C:\Windows\SysWOW64\PING.EXE
                                                          ping -n 10 localhost
                                                          17⤵
                                                          • Runs ping.exe
                                                          PID:1188
                                                        • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                          "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                          17⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          PID:1072
                                                          • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                            "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                            18⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1504
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\XYTkjTa51bVq.bat" "
                                                              19⤵
                                                                PID:912
                                                                • C:\Windows\SysWOW64\chcp.com
                                                                  chcp 65001
                                                                  20⤵
                                                                    PID:580
                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                    ping -n 10 localhost
                                                                    20⤵
                                                                    • Runs ping.exe
                                                                    PID:1616
                                                                  • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                                    "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                                    20⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:1864
                                                                    • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                                      21⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3044
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ncPsCyUncB8h.bat" "
                                                                        22⤵
                                                                          PID:2824
                                                                          • C:\Windows\SysWOW64\chcp.com
                                                                            chcp 65001
                                                                            23⤵
                                                                              PID:2572
                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                              ping -n 10 localhost
                                                                              23⤵
                                                                              • Runs ping.exe
                                                                              PID:600
                                                                            • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                                              23⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:856
                                                                              • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                                                24⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1652
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\vT5ZDVFyRnph.bat" "
                                                                                  25⤵
                                                                                    PID:1616
                                                                                    • C:\Windows\SysWOW64\chcp.com
                                                                                      chcp 65001
                                                                                      26⤵
                                                                                        PID:2480
                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                        ping -n 10 localhost
                                                                                        26⤵
                                                                                        • Runs ping.exe
                                                                                        PID:2412
                                                                                      • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                                                        26⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        PID:1364
                                                                                        • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
                                                                                          27⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1512
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\8J9J9fvBz1B0.bat" "
                                                                                            28⤵
                                                                                              PID:2224
                                                                                              • C:\Windows\SysWOW64\chcp.com
                                                                                                chcp 65001
                                                                                                29⤵
                                                                                                  PID:1592
                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                  ping -n 10 localhost
                                                                                                  29⤵
                                                                                                  • Runs ping.exe
                                                                                                  PID:2472
                                        • C:\Users\Admin\Desktop\New folder\BitcoinFakeTransaction\BitcoinFakeTransaction.exe
                                          "C:\Users\Admin\Desktop\New folder\BitcoinFakeTransaction\BitcoinFakeTransaction.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of WriteProcessMemory
                                          PID:2496
                                          • C:\Users\Admin\AppData\Roaming\WmiPrv\WmiPrvSE.exe
                                            "C:\Users\Admin\AppData\Roaming\WmiPrv\WmiPrvSE.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            PID:836
                                        • C:\Users\Admin\Desktop\New folder\BTC Fake Transaction\BTC Fake Transaction.exe
                                          "C:\Users\Admin\Desktop\New folder\BTC Fake Transaction\BTC Fake Transaction.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:2948
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 1372
                                            2⤵
                                            • Loads dropped DLL
                                            • Program crash
                                            PID:2828
                                        • C:\Program Files\7-Zip\7zG.exe
                                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\New folder\Dedsec Cracking\Dedsec Cracking\" -spe -an -ai#7zMap27489:142:7zEvent24123
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          PID:1324
                                        • C:\Users\Admin\Desktop\New folder\Fake btc\Fake btc sender.exe
                                          "C:\Users\Admin\Desktop\New folder\Fake btc\Fake btc sender.exe"
                                          1⤵
                                          • Modifies Windows Defender Real-time Protection settings
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Windows security modification
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1344
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            "schtasks" /create /tn "Fake btc sender" /sc ONLOGON /tr "C:\Users\Admin\Desktop\New folder\Fake btc\Fake btc sender.exe" /rl HIGHEST /f
                                            2⤵
                                            • Creates scheduled task(s)
                                            PID:1808
                                          • C:\Users\Admin\AppData\Roaming\SubDir\Fake btc sender.exe
                                            "C:\Users\Admin\AppData\Roaming\SubDir\Fake btc sender.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:564
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "schtasks" /create /tn "Fake btc sender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Fake btc sender.exe" /rl HIGHEST /f
                                              3⤵
                                              • Creates scheduled task(s)
                                              PID:1772
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            "powershell" Get-MpPreference -verbose
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2856
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
                                            2⤵
                                              PID:2028
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
                                                3⤵
                                                  PID:1708
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\ksfm52sbHJbs.bat" "
                                                2⤵
                                                  PID:2828
                                              • C:\Windows\system32\conhost.exe
                                                \??\C:\Windows\system32\conhost.exe "207039401312277927451084189953182075752183276409520047088661638924639-1056592979"
                                                1⤵
                                                  PID:1356
                                                • C:\Users\Admin\Desktop\New folder\fake btc sender\Fake Bitcoin Sender by KaLi HaX.exe
                                                  "C:\Users\Admin\Desktop\New folder\fake btc sender\Fake Bitcoin Sender by KaLi HaX.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:2720
                                                • C:\Users\Admin\Desktop\New folder\RAT\RAT.exe
                                                  "C:\Users\Admin\Desktop\New folder\RAT\RAT.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:2520
                                                  • C:\Users\Admin\Desktop\New folder\RAT\RAT.exe
                                                    "C:\Users\Admin\Desktop\New folder\RAT\RAT.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:2064
                                                • C:\Users\Admin\Desktop\New folder\Steam Gift Generator 2023\Steam Gift Generator 2023.exe
                                                  "C:\Users\Admin\Desktop\New folder\Steam Gift Generator 2023\Steam Gift Generator 2023.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:1700
                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Cracked.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Cracked.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1120
                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Cracked.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Cracked.exe"
                                                      3⤵
                                                      • Drops startup file
                                                      • Executes dropped EXE
                                                      PID:2704
                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2012
                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2744
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat"
                                                        4⤵
                                                        • Loads dropped DLL
                                                        PID:1956
                                                        • C:\Windows\SysWOW64\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          5⤵
                                                            PID:1332
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              6⤵
                                                                PID:2088
                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:580
                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2240
                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\Steam Gift Generator 2023\password.txt
                                                      1⤵
                                                        PID:2572
                                                      • C:\Users\Admin\Desktop\New folder\Valorant Checker by Xinax\Valorant Checker by Xinax.exe
                                                        "C:\Users\Admin\Desktop\New folder\Valorant Checker by Xinax\Valorant Checker by Xinax.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:2688
                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1744
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:3036
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:2460
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:2960
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:2368
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Cracked.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:1808
                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Valorant Checker by Xinax.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Valorant Checker by Xinax.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1512
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Valorant Checker by Xinax.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Valorant Checker by Xinax.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:1684
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Valorant Checker by Xinax.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Valorant Checker by Xinax.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1944

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                        Filesize

                                                        67KB

                                                        MD5

                                                        753df6889fd7410a2e9fe333da83a429

                                                        SHA1

                                                        3c425f16e8267186061dd48ac1c77c122962456e

                                                        SHA256

                                                        b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

                                                        SHA512

                                                        9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                        Filesize

                                                        344B

                                                        MD5

                                                        f546f05eb4c1f5736a3d646a2cc665b6

                                                        SHA1

                                                        8814b6af06c6e7cf29c68d23efbad2867989abaf

                                                        SHA256

                                                        4b849385701b74be2c95372228b285895387b041c4bfc132f4cf3afa787dfe63

                                                        SHA512

                                                        aaec0463316d7af530c0b6c388b07e7bceec88402524027de5ccc44eb42428f5a9384645f4ea1aa1a876090693e0230952916541b4b76854677be748ffb2a1a2

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\3WnXEctbV3CL.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        6949028f128753baa70b2b081ebaccfc

                                                        SHA1

                                                        9758a1b32cd841f7482dbc3a0d23ec119f54ccb9

                                                        SHA256

                                                        d6bede5e0049f02e520303fa32be52e7ec38dd6fe1ff8adcb8f39eb3d520ee9c

                                                        SHA512

                                                        052d481f02357220eaddfe54655c5a0c5ce9cb4705492545bf708d33433e47ede5d3f4e197e5c6e9faa118cb665a9437c86a91c725ad8a5c18fcca706c0f3f05

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\4r9uAkSjC9Mo.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        f7f786c7aa17149c52cc632eda28527f

                                                        SHA1

                                                        9516c357dba8b0456eb0dac99b7111522d52d4f9

                                                        SHA256

                                                        8a769e5b122eef13987b95214c7ab8afe3d6a5ba412e1a4f78f6fec24e8b35e7

                                                        SHA512

                                                        1e43d1351da369a334350a568dbb960d17ed38119d3386d464f005bb4c862dd9f900349d7977bb1030df0823149e8a2be895462e16b4c7b8f063b912309e37bd

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\8J9J9fvBz1B0.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        6f5448de891df0015bdf07a48063e121

                                                        SHA1

                                                        2b7959814628f0fe305d082da33ef9f9d9359dd2

                                                        SHA256

                                                        431cae88d81117a9167b4a8d2859568afda05b3592be8744bee6b54e67d37148

                                                        SHA512

                                                        605b861370c3b1c0c68027da56342e8dfc171b4ae9f9889a95e71702ca4d78c579300ef1eab4804c5b6d39999e9716f4728b6c7ad702e6d1b76ed077c7016f45

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Cracked.exe
                                                        Filesize

                                                        197KB

                                                        MD5

                                                        9e75e419855a7be226913b7c2ed94285

                                                        SHA1

                                                        e950b71779dd03cb89485d0da29a1b272604c29b

                                                        SHA256

                                                        76225779bcbf97c311ea4d8de6f957982dda1629b911bc83b3ebf351523b1fa5

                                                        SHA512

                                                        dc01c299627f3233cec3cb70e6e202f2e0cfea7768a02ce9a22dedeea12c78fd04cf237d04a47e838d32a29b2fd62db69839d2f80e7993b35deaa0dd27c6f512

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Steam Gift Generator 2023.exe
                                                        Filesize

                                                        968KB

                                                        MD5

                                                        24b68c6e4934846fc1c1624f524774eb

                                                        SHA1

                                                        eec667115c99b3c9633d206a0030cafa80fa4998

                                                        SHA256

                                                        b638097153eb4b1dfc4b9f8bbeb36a1d7f581ec435e218845ad14d2c235b457c

                                                        SHA512

                                                        e7eae961942dbafd058bfcebbd4f13f048f3e92edfeb83d1cb083836bdf4df39dbccae9fa08d2a5562f3747b58b183c8b3155da2bc68faa51ff90034a94cd9aa

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\Tar4A21.tmp
                                                        Filesize

                                                        175KB

                                                        MD5

                                                        dd73cead4b93366cf3465c8cd32e2796

                                                        SHA1

                                                        74546226dfe9ceb8184651e920d1dbfb432b314e

                                                        SHA256

                                                        a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

                                                        SHA512

                                                        ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\XYTkjTa51bVq.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        180709da746d6381bf56b468f20edd33

                                                        SHA1

                                                        b57b54e719bb81873ab13578fa83a50c62fe4ddb

                                                        SHA256

                                                        affe7ee8d6e03f216d6f01f230b9c77a28f348eddff24fc350944abcdbf130f7

                                                        SHA512

                                                        7e9de2fe67bf2324a11bbc41ced1641087eed95435bcf552d94057d281c1d13a3730e2eb1b582cac72c0c2da5b584d90d41f116165674aaf3219da1de1f2dcfd

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\YndtvgyHZn4K.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        699067331e52caa327dbb85d006c85e1

                                                        SHA1

                                                        12a866735b729444af3e9721b2fcb25d3f6f8d9b

                                                        SHA256

                                                        836262de3c01fc940dc5bfe1d826335d12d1bbc073a3aa7eff21ba0f6e08ff65

                                                        SHA512

                                                        6109c58e4588b4a96124e6e909cbfaedb3fbafda8478ab02b5a5db6517fd31123db3d7e26ed48b71deb28916a60eaa412f1f80a853918533dce80f8d8292050e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\ksfm52sbHJbs.bat
                                                        Filesize

                                                        221B

                                                        MD5

                                                        5135b979a9f398a25b6ae9608670d53b

                                                        SHA1

                                                        3ca0e32ff8792514ff4569433d2696597b11cf9e

                                                        SHA256

                                                        661012419e0cb2019015b2c875005f934e351be567d5360564c9a18b8ceb4611

                                                        SHA512

                                                        adbeb34aeda7a3a0ee65f88d85e1a603e49eb215af17d406d957c9def4d89aa281eaa0e2adbd42a9e2e19fe7aed6460eb9cd4e381d24d470e23844fc5bb3ed6b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\ncPsCyUncB8h.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        8b43d1b49a239e58d54adb5a62aaed2e

                                                        SHA1

                                                        376b91568cf87f9d95a161611e1fa3bda1ae51d0

                                                        SHA256

                                                        83a394000379da693ce68dc19cfb7b374321a23d3a62646422db8f4116808898

                                                        SHA512

                                                        04883708cf3b61dd5d55516791a09ce82578613cd838e1ef6de06fe709e7f2c8a34f5222f41329438b78ce6fd6ee7492390f551e29704ed25788d4c66e3172d1

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\q06DEBMOaktJ.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        8069b2dde81658e07fe33ae17d8f3bc4

                                                        SHA1

                                                        3c1caaacb8eff0a8a5824ca19590684fd719c02f

                                                        SHA256

                                                        17636ad6881d4b06ff80d1de46864ae60204f254651462389b749acadd492f1e

                                                        SHA512

                                                        97f4ee84af5ec8c0ed732c1b2733a076bdd322f13942fef18e917141c709b2f01f43160233ce221d6a3e8cb349a5df02e68887858b72c68778e97e4865a957b0

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\tvEMHiRO5eK3.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        5573629d932843e1bbff7943c1e81a63

                                                        SHA1

                                                        15a82e01bf02fe248cfec291db3062e6f1e7c091

                                                        SHA256

                                                        95bf77dc0a39cfbdd3e57a9be4b4370bc26b9d6db2d55c4e96a1aa85b3234d91

                                                        SHA512

                                                        eae8c9a44fc5c7d4f5b23ee47d83d21979d0fc87e8cd9ada5aed194a3d59a274580221d2aa425e37dfd33ac8bc07a7c25c093c3bb7dac85c8d6a87f3e7ac393b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\vT5ZDVFyRnph.bat
                                                        Filesize

                                                        210B

                                                        MD5

                                                        dfdf90af6bfde5677f756449c520e51d

                                                        SHA1

                                                        2ebcc313bb936d258465a3b325acb37a245f3022

                                                        SHA256

                                                        814d926b4f3cb82684509d8edf4012e6bbb9453d3fb76742bc0dcd1c1335f334

                                                        SHA512

                                                        c0674e141b71199d912c8f568e556c1be46aa1243a9f9573a8f5076f7369a6820e61ce04ed739fe8bec7d70f0953c4054398b2c81f9cfe6378301ee664e1403b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                        Filesize

                                                        7KB

                                                        MD5

                                                        17aa20339d00d1d080eed5a9c3f8cd4e

                                                        SHA1

                                                        d8ae77ffb8d3b8443fdab0b7b4af682e9f236846

                                                        SHA256

                                                        593acd938a3da674f4730f2515bb990df827d16daf65313e434901b72b7242c0

                                                        SHA512

                                                        6a5b8603e55c47addeebdef266b3258faf4ea6470d89f55bfe1b00d3605bd0fea386dc4e2dd026a43e990d0c34876e17095972f87352971db886b3da8f50f1f1

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\Windows Security.exe
                                                        Filesize

                                                        820KB

                                                        MD5

                                                        0dc9aba9df1e1c3f6d9dc98633260e60

                                                        SHA1

                                                        b78d7946aa344eeb0d50f25ebbc525c608bf3ecd

                                                        SHA256

                                                        8edc6e2a826910600187023e17c0dc19b203a100767367ef79611d89ebfdc4ff

                                                        SHA512

                                                        07a2f9656e28af347716ca4113216c82335a0e8bd7e3f9578e2c79115c703272a8345038e43054b6a6e4a86fd7e18a8d22044816405bb5d95b29da7975b08d74

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\bCKCiADRfy\NsTBLfnFEE.exe
                                                        Filesize

                                                        192KB

                                                        MD5

                                                        540d36ae3db00dc8cf44931adbcd6e2e

                                                        SHA1

                                                        43dfc7e9215b732d2301ed93e206f469f05e0326

                                                        SHA256

                                                        baaf567df2d5beb6fb629f394496f913ce0f9801faa9943cdb4fe141021da7fe

                                                        SHA512

                                                        9fa6346dde6e3e5aa9dd7abd0f9e9d4fa38a0341a23621f5013e4796f1c80f087a89ec49c65d4a5f38c8ff2bca00941d616475ff14af1420666fff6b2873c930

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\windows Security Update 32\Window Security.exe
                                                        Filesize

                                                        576KB

                                                        MD5

                                                        625ece3010013ab4f4ea9297805721a8

                                                        SHA1

                                                        ee0ee11e9bd6f2b7bf8fd291235f092ea5b2365f

                                                        SHA256

                                                        e717c7612d8f6fddeaedd24cd555abfc6fc5e96656da5ed0e768942b74831310

                                                        SHA512

                                                        256de0899d7270085851984d5f011105fa54c09aee6bcbdbbcf91aea4773bd1b7458b4b43f1c41deb459152b0adf77fbcc237b025068ebb2de61ecf9f91bf252

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\3301 Ransomware Builder.zip
                                                        Filesize

                                                        4.1MB

                                                        MD5

                                                        b3ee7ea938fc0cfd904bb538b68f4285

                                                        SHA1

                                                        1f0b35cd884389fc6baaff960bb3990d1c5ccf19

                                                        SHA256

                                                        c3b7154ebf43c5cc53821962b04e3e7eea4339ae2038391413912d0f81f91d73

                                                        SHA512

                                                        e8ae5e13287afc42c31f7406cf2589faed3201174551f902e9930b76d06f222eb6e9f603a516fd1da6559f86d6522870f45ad7cd2d58f3c1fd5b460e5df06102

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\3301 Ransomware Builder\3301 Ransomware Builder.exe
                                                        Filesize

                                                        3.6MB

                                                        MD5

                                                        268335a5943b556ca17e9ae30275b2bf

                                                        SHA1

                                                        550ad6c729c3e276fd5563e70d43c3dff81bdc66

                                                        SHA256

                                                        198530fbc168fda943acfe1b75541f99605f9f6c90aaa7d34786c33fb1f7e22c

                                                        SHA512

                                                        2b39bb1ecee14fa07b01bb01ffcc421658683f494bea2cf672cc13d57e0d82db9577730052576825b3c5bdd2953b2fe91da0fcd91b9c29f5faf173c824933a30

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\3301 Ransomware Builder\3301 Ransomware Builder.exe
                                                        Filesize

                                                        3.6MB

                                                        MD5

                                                        69d7e627588135d4851830e8988708f0

                                                        SHA1

                                                        b3352988ea09d029b74c511eae38ec735e220357

                                                        SHA256

                                                        43667b7427aef36bd83b7d51d92cb77bb567517d73a8c3735455eca057319e50

                                                        SHA512

                                                        96a0e1686a657fc29bbc49c5ef500f391822be938202b3cb70c3d2ee8d5863e54a37f1624644443dac2b5d6cfe97b0d3fbe3e8cf4a21615c8ffa0c8c8afbe8fc

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\B0SS RAT-Fixed (Eng).zip
                                                        Filesize

                                                        2.4MB

                                                        MD5

                                                        80c83bae718958a60ee2cbf99ea785da

                                                        SHA1

                                                        8dc35fb5545583f5a36422c493a5229801b259c4

                                                        SHA256

                                                        edbbc785f6fb3819560a45a3caed249225e1128c2aa68f5c68582b4120c422d4

                                                        SHA512

                                                        ab280defd15c6b255dd86454aa471f6f85d3032c79d8201a5b739348fec81ff65805117198efbe9289508924cae697f6ae0bca587b5aa8545afaaad4191dc47a

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\B0SS RAT-Fixed (Eng)\B0SS RAT\BOSS RAT.exe
                                                        Filesize

                                                        2.0MB

                                                        MD5

                                                        4df17525959ed87ac5cb31cb2399db13

                                                        SHA1

                                                        f035e334f17c1ff9f93de1a584c73bb00e13a8b6

                                                        SHA256

                                                        cf3b334cd120cff7c617c9e1bcb2ade22e172f64489c3f980c0ee7ecaced79ff

                                                        SHA512

                                                        6459f628f732b48ce3904bd7a6bcf22dcef085418e42b90e97a0223580df4941f21997aecb8fda6ff75b9514d63cb246dce0e214b10babbb43d966bcf2e3ad87

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\BTC Fake Transaction.rar
                                                        Filesize

                                                        207KB

                                                        MD5

                                                        eb99b4e8d702f46303f069a16b2cc4b2

                                                        SHA1

                                                        1783a69c3ed1d0b0833e904a68b56b41eecfa94c

                                                        SHA256

                                                        cb2084f18a1be5cde59a204eda3d83198e590c5700781c2b92974a5ad3c86ffb

                                                        SHA512

                                                        00bc0f27f231ec0a166ac52858dc7a81eb0541f7b5f3dba65077bbeb1f66c806fdc0c73711c0c95f93c7c9b4f44228076a9283a7defc1d50a7241ae4a312d29d

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\BTC Fake Transaction\BTC Fake Transaction.exe
                                                        Filesize

                                                        88KB

                                                        MD5

                                                        8f72c00dfb7831d77fb9491c977c0996

                                                        SHA1

                                                        34910f0379406a6f6f2599e36c8acf173e6023d9

                                                        SHA256

                                                        91f6ebd7961eadc13050cf83573bb0e79b848c26df5a697602d572727d20022c

                                                        SHA512

                                                        9b0abfa658482246bc7fcc4bb74bcc9fd4a9921f82bb2fef3b4a1f2176ee77b583d207cf9986b16ae0715309b615d9efb7c649d34f7b0fb6c9ac9fdcf4146b80

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\Bitcoin Fake Transacation V3.rar
                                                        Filesize

                                                        939KB

                                                        MD5

                                                        d79e5524cb33eea6f3e929a5610d2cc0

                                                        SHA1

                                                        e6a44a46d6756048427800229fe39f3dd9a020a3

                                                        SHA256

                                                        603c354efe61d6d91589f58043edc934f42eb157e1550537dc40dd399755f1cf

                                                        SHA512

                                                        21635d5e97050da29a37a1832b8d85783bbc421a36bf64653e6dab7bf5c194fa9f1974deee882b3d9e826dc97078db1f84838cfcee081519de5d8d46e3f554da

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\Bitcoin Fake Transacation V3\Bitcoin Fake Transaction V3.exe
                                                        Filesize

                                                        1.3MB

                                                        MD5

                                                        eba58c770a9912467c74203650367fce

                                                        SHA1

                                                        342ae4a2714c0b3511e013f51a21e5739dcfd097

                                                        SHA256

                                                        e688c1b8bd1e34c34172497162daa1f46df0de2ae168d661ac2b62d513f3f08f

                                                        SHA512

                                                        1827b88d319cd43b6142ac8959b0318855429b35520116b9d6a700f0b43a6acaccfa6e558b10f8cab7c405ef0ee8dcf19a38464e81d6604d3eba4383b0cfbbf8

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\BitcoinFakeTransaction.zip
                                                        Filesize

                                                        1.4MB

                                                        MD5

                                                        d8e9207d0e5894a2d8f94ad8cdfcbf90

                                                        SHA1

                                                        18fe030bee89ca9dcab7a3deb11354a6351e68b3

                                                        SHA256

                                                        16cb231e8affd11fa6200becf4746928492db58051df83d4dd3dedddf33dbd18

                                                        SHA512

                                                        a14792efafd7b24144595aaa41e878b5b6a41916b76f3ba9fbdf7fe4a5d46cc4d1ae656350f6daf21cbe6a7dcdc009e319d71d0542cd8ecf3c815af63f62fa85

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\BitcoinFakeTransaction\BitcoinFakeTransaction.exe
                                                        Filesize

                                                        605KB

                                                        MD5

                                                        4eb3bd08932bb9000f1dce389bdded6f

                                                        SHA1

                                                        8aedf59a815f67437d979b506eff4191d8c2b04d

                                                        SHA256

                                                        c038cf88206371d35a0e89612d8781cdfa69cc37fc5391a8e92d252ac6b9f0b1

                                                        SHA512

                                                        2a5366cebc3d56130ece83d2e5b64415b07c3c6e40f48048aabfafc9f6202d85da29023a2be586dc86300e58800086cb81662329e125b42fedde6e45b748e66f

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\DedSec Latest FUD Ransomware.zip
                                                        Filesize

                                                        1.9MB

                                                        MD5

                                                        06d546860301ec7d57c39d6bd0b49230

                                                        SHA1

                                                        ad89a2bf428de71e23d63b02e1ef9be731ec9a98

                                                        SHA256

                                                        53bb6bec77252f2988cef21d98f037ce6a347c66f3d48b286b422630ebcbd917

                                                        SHA512

                                                        753cbf31976a8abc4645368db98a66c94af673bf1f47dc663809c9afb72cb9b473160bd82e046e59f9927358846d9414f5afcee98237dec40d07c3640e00493a

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\Dedsec Cracking.rar
                                                        Filesize

                                                        2.1MB

                                                        MD5

                                                        8fc72d8853630b375e3e9252690eeeb6

                                                        SHA1

                                                        3b605a8642469fde89c0520f3d4ab818a09f1e1e

                                                        SHA256

                                                        c64d63f0bed3108a717d9a1f8e6e0d3fcf581a4cfa6a58f94e39c351e4a69eff

                                                        SHA512

                                                        decc6e632b8b4191de2d635f46353d1fd645420b9ec6f177364a2b0b75419cfe3273999e43314900224c3c67ea22e6741c61ffbf0131afc74acad34238797f87

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\Dedsec Cracking\Dedsec Cracking.zip
                                                        Filesize

                                                        18.1MB

                                                        MD5

                                                        26d8883d9e6a2d43e0254d8e979ce1e8

                                                        SHA1

                                                        b65a6f1fe53cda8862c358fca1ced807c9373a21

                                                        SHA256

                                                        53044d9efb80b1a5c6280b948bc0fecd28589234b2883965709244ab8560ad03

                                                        SHA512

                                                        77c2187d3db343f2ee7c0049d46ca5eeb793a3442bd97048871ebd82175fb4407cb1818d0fb3a3da6a8f16cc7eb810d649d4ec6973d0081e7d66a1c380e376b2

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\Fake btc.rar
                                                        Filesize

                                                        1.6MB

                                                        MD5

                                                        e4be4ff9459ff8f70de923e6e7d8e698

                                                        SHA1

                                                        e9def6ce730ba69a9f404f5413c8065a3220437f

                                                        SHA256

                                                        00601986ced2b040bc5156cf06113c671d1620aaca7f026b6cb6397da595bef4

                                                        SHA512

                                                        178235d36f57e5d749e637a2105a5ee6ab9d7b52570fe10c51f960a0b95b59cb22a8e853075ce44f96d93f25c7476589752f7c41d4647f902aed30ede5bdcff2

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\Fake btc\Fake btc sender.exe
                                                        Filesize

                                                        534KB

                                                        MD5

                                                        550e53562096dd81e9ca099a00b73490

                                                        SHA1

                                                        4c619e297859fe1c4c32f67b2a43de811ac0fa64

                                                        SHA256

                                                        e92524417654c046f35a67e8dfca0b8f411e796ee33c9b900cdaabcd012219e9

                                                        SHA512

                                                        c74ebdb4f8b1166886b6cdee6513243d48dabd2b627f347eb8445ec951c213f9ac1b6b74f3c9f17f1d6544f78612c5fc489d14e64d2a476bc6890b788228569a

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\RAT.zip
                                                        Filesize

                                                        1.7MB

                                                        MD5

                                                        2cca9b35515dc4e7b082b587949fb804

                                                        SHA1

                                                        412ca0e9799f11d8b16e9b9f13554e4bf203080d

                                                        SHA256

                                                        13ebf5478941e2628fbda63df338e93851e09a3c32e803aa70b538cbf1795b76

                                                        SHA512

                                                        81c85900851701362d11c11cdce0a7e175a3c5c84cb3e93ae3b202f2bcfaa6cbbfe519658047aeeb84e9c4c197821c2df1f6008109aeb2f9429d3fb6cadc21f0

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\S500 G3 RAT.zip
                                                        Filesize

                                                        1.0MB

                                                        MD5

                                                        b382e37640a54697e39085bfd4062167

                                                        SHA1

                                                        435f69c258339e04d60a4b2fe310856de128e749

                                                        SHA256

                                                        f2cfde9b034aabb5ea4a281009327d1d9fcd9281094094b819c8ff8550eb199f

                                                        SHA512

                                                        f9994b64320d5a8f519128186d470dbb03048d050867f67440b88426f215fc8d5f24c4c1f0282a9ccc528335cb3e201f71a84acfb7810cb6e7b6ea4d2d038f9b

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\Steam Gift Generator 2023.rar
                                                        Filesize

                                                        842KB

                                                        MD5

                                                        fe5eacf3576e18d32f210f1f3bfb5817

                                                        SHA1

                                                        530eb60e1263004e80519244512965a49a13eae9

                                                        SHA256

                                                        24be4c2e7310d0836243e7fbb03cdbe85c10a256200e19fbe34303b8b47732e6

                                                        SHA512

                                                        705cd56a704cca656bbcb713db3d7920c0a131a6bbc990116af516dfbd2bdef583b33fc62b74c32282bed3af813ceecd5701b45ded747cbda5b905da1f99cf94

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\Valorant Checker by Xinax.rar
                                                        Filesize

                                                        1.1MB

                                                        MD5

                                                        07eda6b17f47e4719d4bb379972343f2

                                                        SHA1

                                                        497f596235f2872a889f24df35698d8a02b1010b

                                                        SHA256

                                                        0b090fc7d683f556e209c5ffcc78ef7da18b5c95b5fa0f1c259f92e05ae34ee9

                                                        SHA512

                                                        70b8e2db5be75465d0fc567fe00911a2c1b3ab8e919fe1f856cbbe27abe2e243cdc04ccfe624638360885d62c11c5c8ab6ec7eb885a48b30dc1dcfe38b28c117

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\fake btc sender.rar
                                                        Filesize

                                                        2.4MB

                                                        MD5

                                                        d4a00a5b4f3ec0f85ca04ed3ed06ab06

                                                        SHA1

                                                        d4091247245e772a57af4952c8459b55545b9958

                                                        SHA256

                                                        ca5dcd04f58d702895f33212b6eb577c481e60f7842b760be2d5ecf7baa66104

                                                        SHA512

                                                        553b60de60cefd94372fff26840005bb12beeb72f0fae60556eb765a62a878055c63a02d2d8b7ebabf80903c86b8e5d740a43669684efd19029569285b0e4547

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\New folder\fake btc sender\Fake Bitcoin Sender by KaLi HaX.exe
                                                        Filesize

                                                        585KB

                                                        MD5

                                                        88f3a3e207cd7bd90b509cd0cd8ac993

                                                        SHA1

                                                        1d06e1284f74659bb1af349e493363ab6dbdfb8c

                                                        SHA256

                                                        27d1a8c1417f018bff9687fe79de9dae6f75237e91df8e35e2b25028e7110ceb

                                                        SHA512

                                                        efa227eebb50e82bf791255ec9a348c8e3ff1c42ffb0d8f8685572f9aa5f17d1430813bc5f0e16a19f34429e178ebdfc8185ba9a5b0d8ed11a408a5a0edb5946

                                                        Download Submit

                                                      • \Users\Admin\AppData\Roaming\WmiPrv\WmiPrvSE.exe
                                                        Filesize

                                                        162KB

                                                        MD5

                                                        cdfc8f8cf86df2ce518543d3eaf97fd7

                                                        SHA1

                                                        c074d1cb625aaac484e8f0dc5331293c7ed2b547

                                                        SHA256

                                                        8ef0ca821104f5e4033d66f7a1a5ce831393517aa046cf70b7b2c96cc8c214ea

                                                        SHA512

                                                        bb82ca01fc69ab6c9a5f5ac497d2fe291b3b64a861958f2ead1428f43d127136f67539e7b34e8f95d46d3faedfac65100d7d7e6a55c16d9fefc32f5c89c81e9b

                                                        Download Submit

                                                      • \Users\Admin\Desktop\New folder\3301 Ransomware Builder\Interop.TaskScheduler.dll
                                                        Filesize

                                                        39KB

                                                        MD5

                                                        621563a32f8add313fedbe16b3e644a8

                                                        SHA1

                                                        3c7143ca7bb9877acc163416b044c20ebbb53a59

                                                        SHA256

                                                        4ea7be5abb776fb7c2b82f748c92d6e77d6c1a0505b436a0594a504816345eb0

                                                        SHA512

                                                        465ece63d2d7b5fc0dd4e8455ae64e7e20f58297514e6192c7142cc7152031f879a23b43cfa646b54410f4469d63fb9caec8471619292c4497799f11149d5f4a

                                                        Download Submit

                                                      • \Users\Admin\Desktop\New folder\RAT\RAT.exe
                                                        Filesize

                                                        6.2MB

                                                        MD5

                                                        f856199b92bcff496e3f5cfdf39e475d

                                                        SHA1

                                                        40b0a8aaf83c6cfe8ca369a44305613426efc7c4

                                                        SHA256

                                                        037f959164faa6f379e31162648abc93198a19b244bab1dae3ef136d31e445b9

                                                        SHA512

                                                        2642846f8b5ed82158472ce581b7bec4c4fc86ad06513324e17b7640dede4ed1c0c5ff3bdd845b21a086ddd36caf9e9feafa8212798f7f9d246d16f09b9a0ef5

                                                        Download Submit

                                                      • \Users\Admin\Desktop\New folder\RAT\RAT.exe
                                                        Filesize

                                                        5.7MB

                                                        MD5

                                                        0d0c01c6a0cdcc3840f38025ac7e68ff

                                                        SHA1

                                                        fcf6f33c9140f902446961644f48a738d7a2dc8a

                                                        SHA256

                                                        01d674b692b5f962e0685b8f1c07e362d678b9d2402815796aa7121c87338834

                                                        SHA512

                                                        eb70487df32a0dd5cb6006dcbb62b62622890ecba321425095f3e3c7712cf9fe03ce8dae3a9c12137fd5f0aa732436d0e84c217c5f7662627fd27b3277223c6f

                                                        Download Submit

                                                      • \Users\Admin\Desktop\New folder\RAT\RAT.exe
                                                        Filesize

                                                        7.1MB

                                                        MD5

                                                        c6c63626e4df4e1e1c21f07e4d71cb51

                                                        SHA1

                                                        d06984d8ce6d8fec998253c830ee38d66b526470

                                                        SHA256

                                                        b46689f98fa9f5650b252393a6726f1947ab851e73a2fba56a9452535d6155e7

                                                        SHA512

                                                        9176f9be04da654713d46a73422f495dca1df4d7cfb12e35ca428f7e0628141cb83827038f30d50282a131dd78270c87b8ec8474908049daf7cfa4873b48c4b1

                                                        Download Submit

                                                      • \Users\Admin\Desktop\New folder\RAT\RAT.exe
                                                        Filesize

                                                        6.9MB

                                                        MD5

                                                        6ed38e188611dc2672103086f30de951

                                                        SHA1

                                                        3e04695876e5b9a280c2f9e6bd88d373af03e514

                                                        SHA256

                                                        54839a95bb349aa61af39bbae8cda74da0a28184fe3351de98499c367d4d6548

                                                        SHA512

                                                        84f705409ea06fcafb9e32a6bbed5a8ed5324d5814a2368d98dc3692ccfe5936af9b3133bcd9c88a7d621b1e67a88588b38aa513e0e0511d3e2ae88a45ea0fd1

                                                        Download Submit

                                                      • \Users\Admin\Documents\CLIENT.EXE
                                                        Filesize

                                                        56KB

                                                        MD5

                                                        e780d3ba577dce5849d7c66ba169148b

                                                        SHA1

                                                        385a9016f7fef89d679fbcd9c834d411781e50ed

                                                        SHA256

                                                        3f9be5b14cac0dedeaa1b3fc6c5b6f5818c3a4993e0cfdb09d09772697df878c

                                                        SHA512

                                                        7f4741838f7f47b73ee4cfa33a024b17353cc3aa9b45620ad44185dab844e866eaddfd00007d3ee6c30db54de89e3e8aabae98ae74323cbceb41e980f632b7b3

                                                        Download Submit

                                                      • memory/836-583-0x0000000000740000-0x00000000007C0000-memory.dmp

                                                        Filesize

                                                        512KB

                                                        Download

                                                      • memory/836-528-0x0000000000460000-0x0000000000486000-memory.dmp

                                                        Filesize

                                                        152KB

                                                        Download

                                                      • memory/836-529-0x000007FEF35A0000-0x000007FEF3F8C000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                        Download

                                                      • memory/836-517-0x0000000001160000-0x000000000118E000-memory.dmp

                                                        Filesize

                                                        184KB

                                                        Download

                                                      • memory/836-580-0x0000000000440000-0x0000000000446000-memory.dmp

                                                        Filesize

                                                        24KB

                                                        Download

                                                      • memory/836-666-0x000007FEF35A0000-0x000007FEF3F8C000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                        Download

                                                      • memory/836-667-0x0000000000740000-0x00000000007C0000-memory.dmp

                                                        Filesize

                                                        512KB

                                                        Download

                                                      • memory/892-481-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/892-526-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/892-483-0x0000000000370000-0x00000000003B0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/892-480-0x0000000001200000-0x00000000012D4000-memory.dmp

                                                        Filesize

                                                        848KB

                                                        Download

                                                      • memory/904-433-0x0000000001380000-0x0000000001454000-memory.dmp

                                                        Filesize

                                                        848KB

                                                        Download

                                                      • memory/904-447-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/904-432-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/904-434-0x0000000004C70000-0x0000000004CB0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/904-436-0x0000000000250000-0x000000000025A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/1344-670-0x00000000003E0000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        560KB

                                                        Download

                                                      • memory/1632-642-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/1632-643-0x0000000000260000-0x0000000000334000-memory.dmp

                                                        Filesize

                                                        848KB

                                                        Download

                                                      • memory/1632-646-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/1632-662-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/1724-450-0x0000000000400000-0x000000000048C000-memory.dmp

                                                        Filesize

                                                        560KB

                                                        Download

                                                      • memory/1724-471-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/1724-448-0x0000000000400000-0x000000000048C000-memory.dmp

                                                        Filesize

                                                        560KB

                                                        Download

                                                      • memory/1724-593-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/1724-439-0x0000000000400000-0x000000000048C000-memory.dmp

                                                        Filesize

                                                        560KB

                                                        Download

                                                      • memory/1724-482-0x0000000004B60000-0x0000000004BA0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/1724-438-0x0000000000400000-0x000000000048C000-memory.dmp

                                                        Filesize

                                                        560KB

                                                        Download

                                                      • memory/1724-440-0x0000000000400000-0x000000000048C000-memory.dmp

                                                        Filesize

                                                        560KB

                                                        Download

                                                      • memory/1724-442-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1724-453-0x0000000004B60000-0x0000000004BA0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/1724-441-0x0000000000400000-0x000000000048C000-memory.dmp

                                                        Filesize

                                                        560KB

                                                        Download

                                                      • memory/1724-452-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/1724-444-0x0000000000400000-0x000000000048C000-memory.dmp

                                                        Filesize

                                                        560KB

                                                        Download

                                                      • memory/1748-527-0x0000000004C30000-0x0000000004C70000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/1748-664-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/1748-525-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/1748-493-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1748-665-0x0000000004C30000-0x0000000004C70000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/1780-437-0x000007FEF3F90000-0x000007FEF497C000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                        Download

                                                      • memory/1780-417-0x000000001AF00000-0x000000001AF80000-memory.dmp

                                                        Filesize

                                                        512KB

                                                        Download

                                                      • memory/1780-416-0x000007FEF3F90000-0x000007FEF497C000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                        Download

                                                      • memory/1780-415-0x0000000000330000-0x0000000000344000-memory.dmp

                                                        Filesize

                                                        80KB

                                                        Download

                                                      • memory/1880-431-0x0000000070140000-0x00000000706EB000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                        Download

                                                      • memory/1880-421-0x0000000070140000-0x00000000706EB000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                        Download

                                                      • memory/1880-422-0x0000000000990000-0x00000000009D0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/1880-423-0x0000000070140000-0x00000000706EB000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                        Download

                                                      • memory/2264-454-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/2264-451-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/2264-403-0x0000000000140000-0x00000000012A0000-memory.dmp

                                                        Filesize

                                                        17.4MB

                                                        Download

                                                      • memory/2264-402-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/2264-418-0x0000000006BF0000-0x0000000006C30000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2264-407-0x0000000001730000-0x0000000001740000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/2304-1036-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2496-460-0x0000000001020000-0x0000000001060000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2496-461-0x0000000001020000-0x0000000001060000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2496-458-0x0000000001170000-0x000000000120E000-memory.dmp

                                                        Filesize

                                                        632KB

                                                        Download

                                                      • memory/2496-457-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/2496-459-0x0000000006DD0000-0x0000000006F30000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                        Download

                                                      • memory/2496-518-0x0000000001020000-0x0000000001060000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2496-500-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/2496-581-0x0000000001020000-0x0000000001060000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2612-496-0x000000006EC10000-0x000000006F1BB000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                        Download

                                                      • memory/2612-497-0x0000000002D90000-0x0000000002DD0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2612-502-0x000000006EC10000-0x000000006F1BB000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                        Download

                                                      • memory/2612-501-0x0000000002D90000-0x0000000002DD0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2612-498-0x000000006EC10000-0x000000006F1BB000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                        Download

                                                      • memory/2612-499-0x0000000002D90000-0x0000000002DD0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2704-1055-0x0000000000400000-0x0000000000408000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/2704-1056-0x0000000000400000-0x0000000000408000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/2748-998-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2948-490-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/2948-466-0x0000000004B10000-0x0000000004B50000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download

                                                      • memory/2948-464-0x0000000000F50000-0x0000000000F6A000-memory.dmp

                                                        Filesize

                                                        104KB

                                                        Download

                                                      • memory/2948-465-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/2980-653-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2980-661-0x0000000073ED0000-0x00000000745BE000-memory.dmp

                                                        Filesize

                                                        6.9MB

                                                        Download

                                                      • memory/2980-663-0x0000000004460000-0x00000000044A0000-memory.dmp

                                                        Filesize

                                                        256KB

                                                        Download