Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    107s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-03-2024 00:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    74cdac95ce4d55dbc351fe96a3be596b709e4ef3add0427b5f3ec62d48019de6.exe

  • Size

    231KB

  • MD5

    3c99e1c4ab1f94fa9384cd0667a2b166

  • SHA1

    abd4d2d15008bf4f202febc98acfe76c8aef0f52

  • SHA256

    74cdac95ce4d55dbc351fe96a3be596b709e4ef3add0427b5f3ec62d48019de6

  • SHA512

    446c5ef0834ad3b913ecd81b4a85c6deb371dbc6d6d4abd878b6fbf7a212ce12b59277c4736ffafe046fd0d192d6aed86127a45eee1d4e614d9381ed65ee5adf

  • SSDEEP

    3072:alaTm6Kv797l/8cVZE1tFAe/G1ov3AMtL/EtHgfJPs8qZvoh:9m6Kv5V8VLr74C4AfJk

Score
10/10
dcratdjvugluptebalummasmokeloadervidar95002d0a9d65ffced363a8f35f42a529pub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.4

Botnet

95002d0a9d65ffced363a8f35f42a529

C2

https://steamcommunity.com/profiles/76561199654112719

https://t.me/r2d0s
Attributes
  • profile_id_v2

    95002d0a9d65ffced363a8f35f42a529

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0

Extracted

Family

lumma

C2

https://relevantvoicelesskw.shop/api

https://resergvearyinitiani.shop/api

https://associationokeo.shop/api

Signatures

  • DcRat 5 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Vidar Stealer 5 IoCs
    stealer
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 4 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 6 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 47 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\74cdac95ce4d55dbc351fe96a3be596b709e4ef3add0427b5f3ec62d48019de6.exe
    "C:\Users\Admin\AppData\Local\Temp\74cdac95ce4d55dbc351fe96a3be596b709e4ef3add0427b5f3ec62d48019de6.exe"
    1⤵
    • DcRat
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:220
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8916.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:2772
    • C:\Users\Admin\AppData\Local\Temp\9DC7.exe
      C:\Users\Admin\AppData\Local\Temp\9DC7.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Users\Admin\AppData\Local\Temp\9DC7.exe
        C:\Users\Admin\AppData\Local\Temp\9DC7.exe
        2⤵
        • DcRat
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\bb765205-c72c-4587-8a15-d91788a3cffc" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:2728
        • C:\Users\Admin\AppData\Local\Temp\9DC7.exe
          "C:\Users\Admin\AppData\Local\Temp\9DC7.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3360
          • C:\Users\Admin\AppData\Local\Temp\9DC7.exe
            "C:\Users\Admin\AppData\Local\Temp\9DC7.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1876
            • C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build2.exe
              "C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build2.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2300
              • C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build2.exe
                "C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build2.exe"
                6⤵
                • Executes dropped EXE
                PID:1588
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 2040
                  7⤵
                  • Program crash
                  PID:1768
            • C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build3.exe
              "C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build3.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:972
              • C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build3.exe
                "C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build3.exe"
                6⤵
                • Executes dropped EXE
                PID:2540
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  7⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:4960
    • C:\Users\Admin\AppData\Local\Temp\BB63.exe
      C:\Users\Admin\AppData\Local\Temp\BB63.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3520
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:452
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
            PID:4500
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 840
              3⤵
              • Program crash
              PID:1760
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 1232
              3⤵
              • Program crash
              PID:4504
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4500 -ip 4500
          1⤵
            PID:4424
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4500 -ip 4500
            1⤵
              PID:4524
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1588 -ip 1588
              1⤵
                PID:3376
              • C:\Users\Admin\AppData\Local\Temp\6A60.exe
                C:\Users\Admin\AppData\Local\Temp\6A60.exe
                1⤵
                • Executes dropped EXE
                PID:3624
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 1144
                  2⤵
                  • Program crash
                  PID:3716
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 1172
                  2⤵
                  • Program crash
                  PID:4500
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6CA4.bat" "
                1⤵
                  PID:3980
                  • C:\Windows\system32\reg.exe
                    reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                    2⤵
                      PID:3280
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3624 -ip 3624
                    1⤵
                      PID:4444
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3624 -ip 3624
                      1⤵
                        PID:2772
                      • C:\Users\Admin\AppData\Local\Temp\80E8.exe
                        C:\Users\Admin\AppData\Local\Temp\80E8.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:4620
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          2⤵
                            PID:3872
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            2⤵
                              PID:3304
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              2⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3296
                          • C:\Users\Admin\AppData\Local\Temp\89D2.exe
                            C:\Users\Admin\AppData\Local\Temp\89D2.exe
                            1⤵
                            • Executes dropped EXE
                            PID:832
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              2⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3484
                            • C:\Users\Admin\AppData\Local\Temp\89D2.exe
                              "C:\Users\Admin\AppData\Local\Temp\89D2.exe"
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              PID:4232
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                3⤵
                                • Modifies data under HKEY_USERS
                                PID:2600
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                3⤵
                                  PID:3984
                                  • C:\Windows\system32\netsh.exe
                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                    4⤵
                                    • Modifies Windows Firewall
                                    PID:4172
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  3⤵
                                    PID:4904
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    3⤵
                                      PID:4892
                                    • C:\Windows\rss\csrss.exe
                                      C:\Windows\rss\csrss.exe
                                      3⤵
                                        PID:4904
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -nologo -noprofile
                                          4⤵
                                            PID:4952
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                            4⤵
                                            • DcRat
                                            • Creates scheduled task(s)
                                            PID:2152
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks /delete /tn ScheduledUpdate /f
                                            4⤵
                                              PID:2704
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              4⤵
                                                PID:1620
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                4⤵
                                                  PID:768
                                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                  4⤵
                                                    PID:5104
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                    4⤵
                                                    • DcRat
                                                    • Creates scheduled task(s)
                                                    PID:4124
                                                  • C:\Windows\windefender.exe
                                                    "C:\Windows\windefender.exe"
                                                    4⤵
                                                      PID:4804
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                        5⤵
                                                          PID:3476
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                            6⤵
                                                            • Launches sc.exe
                                                            PID:4224
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:1456
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3760
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies registry class
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:4832
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3900
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies registry class
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:4072
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4248
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1836
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                  1⤵
                                                    PID:1456
                                                  • C:\Users\Admin\AppData\Roaming\hradwbb
                                                    C:\Users\Admin\AppData\Roaming\hradwbb
                                                    1⤵
                                                      PID:2088
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3644
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3156
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:2508
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:4340
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3592
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1780
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4276
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:5092
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:4180
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4736
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:3844
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4004
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:1324
                                                                              • C:\Windows\windefender.exe
                                                                                C:\Windows\windefender.exe
                                                                                1⤵
                                                                                  PID:2512
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:2200
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:3932
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:616
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3420
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:3672
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3808
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3784
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4820
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4736
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:3080
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:2404
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:2720

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Reconnaissance

                                                                                                        Resource Development

                                                                                                        Initial Access

                                                                                                        Execution

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Persistence

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        2
                                                                                                        T1547

                                                                                                        Registry Run Keys / Startup Folder

                                                                                                        2
                                                                                                        T1547.001

                                                                                                        Create or Modify System Process

                                                                                                        1
                                                                                                        T1543

                                                                                                        Windows Service

                                                                                                        1
                                                                                                        T1543.003

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Privilege Escalation

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        2
                                                                                                        T1547

                                                                                                        Registry Run Keys / Startup Folder

                                                                                                        2
                                                                                                        T1547.001

                                                                                                        Create or Modify System Process

                                                                                                        1
                                                                                                        T1543

                                                                                                        Windows Service

                                                                                                        1
                                                                                                        T1543.003

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Defense Evasion

                                                                                                        File and Directory Permissions Modification

                                                                                                        1
                                                                                                        T1222

                                                                                                        Impair Defenses

                                                                                                        1
                                                                                                        T1562

                                                                                                        Disable or Modify System Firewall

                                                                                                        1
                                                                                                        T1562.004

                                                                                                        Modify Registry

                                                                                                        3
                                                                                                        T1112

                                                                                                        Credential Access

                                                                                                        Unsecured Credentials

                                                                                                        2
                                                                                                        T1552

                                                                                                        Credentials In Files

                                                                                                        2
                                                                                                        T1552.001

                                                                                                        Discovery

                                                                                                        Peripheral Device Discovery

                                                                                                        2
                                                                                                        T1120

                                                                                                        Query Registry

                                                                                                        4
                                                                                                        T1012

                                                                                                        System Information Discovery

                                                                                                        4
                                                                                                        T1082

                                                                                                        Lateral Movement

                                                                                                        Collection

                                                                                                        Data from Local System

                                                                                                        2
                                                                                                        T1005

                                                                                                        Command and Control

                                                                                                        Web Service

                                                                                                        1
                                                                                                        T1102

                                                                                                        Exfiltration

                                                                                                        Impact

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          028f1fcad4776a4ffb64fc2fbba3e1ae

                                                                                                          SHA1

                                                                                                          bb237a8f01cfb82599757c6113db507e8fab21cc

                                                                                                          SHA256

                                                                                                          82608c8500db0198ba1187f6b2e9aa00e0ff6b2af0077a8df4c32760fc3d3d8e

                                                                                                          SHA512

                                                                                                          5cb5c27275b596cb0c5f902f8cc2b845794fafb558e0bd9eff824b82568fa18e881a91a2bfc61c71f32da402611e304b1d936af85526997b03050f5df0a5c7de

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                          Filesize

                                                                                                          471B

                                                                                                          MD5

                                                                                                          6475b19cdf10d6f0ccf27ebf0fe76309

                                                                                                          SHA1

                                                                                                          6c3ca7a137c2b3041cdb22c994bba356e33f93c4

                                                                                                          SHA256

                                                                                                          635f833910db4e0915ecfe0d515341d4feec384dd83d6309f71f336c838a75d1

                                                                                                          SHA512

                                                                                                          9f695eae05fd9bc6f775cd2e8ec1a235976d82bf8b206449b0595e97afd335b31e79706b281b920e08de6d90a05a7e8b777f6d15bdbf815e61bf96e19542f4ce

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                                                                          Filesize

                                                                                                          724B

                                                                                                          MD5

                                                                                                          8202a1cd02e7d69597995cabbe881a12

                                                                                                          SHA1

                                                                                                          8858d9d934b7aa9330ee73de6c476acf19929ff6

                                                                                                          SHA256

                                                                                                          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                                                                                          SHA512

                                                                                                          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                          Filesize

                                                                                                          410B

                                                                                                          MD5

                                                                                                          4578b043f92f598726c37d5e3c57db3a

                                                                                                          SHA1

                                                                                                          6d234bc3de978485089749aee50f4b77af826f97

                                                                                                          SHA256

                                                                                                          af131ed251d0f6701ac5f62ad0bba0de2c9780c5cf516be615430694466346ca

                                                                                                          SHA512

                                                                                                          1846b4a77d9bf399de5d8baf1fc9d219deb480285a05c63f23f4eddb94466a002d3974ef65cafb9a25c3cc17454ecdc0a6290d8b0254c9a23c7347eb9696f2dd

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                          Filesize

                                                                                                          412B

                                                                                                          MD5

                                                                                                          227785a62bbf1d61c4da6f6f4450e03a

                                                                                                          SHA1

                                                                                                          abfc4c09da5bfa4c56e71ee421422c36e8b55265

                                                                                                          SHA256

                                                                                                          64fa89977f045bcc7b06fea5a523be688ea7b9d7632e028c87becafef6b55739

                                                                                                          SHA512

                                                                                                          6b41ca9340297142e79f85a785c82f12c13418748e62f469bebc6a805be4d15061b62151a2d5c1533eb6f417c9a1a5dba60dc495e6ea2fbfb8693d0121d19329

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                                                                          Filesize

                                                                                                          392B

                                                                                                          MD5

                                                                                                          42ef7cc075159ee9c1336d1544267dfb

                                                                                                          SHA1

                                                                                                          ec54e85f3320caf289f937eb6af2c939931baf28

                                                                                                          SHA256

                                                                                                          8e31caacfed1556ca956bb1fd687397ee3f04938d877c12c69b6ab6df3969407

                                                                                                          SHA512

                                                                                                          2e61b38c2f21b5d9ad6abe9946e91dacb1d80028221359ff248e80be65c16fd5ac8f7b4a370a39ce15122fc64fc1c6052d28a75c5542a161243fc1be1be9eb2e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build2.exe
                                                                                                          Filesize

                                                                                                          342KB

                                                                                                          MD5

                                                                                                          26544ec9adc1864de80222fb0b38e6dc

                                                                                                          SHA1

                                                                                                          2ca52374bb468a8e2c10d39b64d1e4e9d7d0adee

                                                                                                          SHA256

                                                                                                          03b38ccf2c3145839d5ea7c5ccec609de3a67a7e435e94ca05c8c080d9df4411

                                                                                                          SHA512

                                                                                                          f7eb99db8eb4df15ac252bd4523a407b32089d22c435303499bc3813ecdf1ffbc8483417bb97e901fba3e3f36c6e9e47eb30fa78b7c461d3f78f5d5899fae730

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\36d42105-7c9c-4b53-b58e-724de6a04dd8\build3.exe
                                                                                                          Filesize

                                                                                                          299KB

                                                                                                          MD5

                                                                                                          41b883a061c95e9b9cb17d4ca50de770

                                                                                                          SHA1

                                                                                                          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                                                                                                          SHA256

                                                                                                          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                                                                                                          SHA512

                                                                                                          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                                                                                          Filesize

                                                                                                          1022B

                                                                                                          MD5

                                                                                                          29a68b111b09263c1be555310b6b9b31

                                                                                                          SHA1

                                                                                                          5ca3933082bb405b20abdf7c1f4fa3382bcbbcbf

                                                                                                          SHA256

                                                                                                          854058f31e23e7edb25502f4781f21b7907b73ed963ea3c36153106727cffdb9

                                                                                                          SHA512

                                                                                                          d8768d40ec6ec2adee6ea81b588dfd30abb08392e31cbdcc028ed61b231c94ce08201aacf578bef4bba852f2f94d1242c24f21241fdfc449a0dff6b261a0ddac

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\39XIXV5T\microsoft.windows[1].xml
                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          29e3c94dfa03b794f03e17d8b45295d9

                                                                                                          SHA1

                                                                                                          1a598a72d3d486f77e861f98abcd2f4a8e936365

                                                                                                          SHA256

                                                                                                          7ff0263086f28cc1d842d07a23128b955780d3c8b85b130228c7f65ce2b4262a

                                                                                                          SHA512

                                                                                                          e2180d73f45da32ac4fb355546103496d73cdf7cb966c60f6a414bc7052e46431177e9009bdfd730d2fe6955b986392720fe3bdc8afbc0388f1b70e438a4ef9c

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6A60.exe
                                                                                                          Filesize

                                                                                                          6.5MB

                                                                                                          MD5

                                                                                                          9e52aa572f0afc888c098db4c0f687ff

                                                                                                          SHA1

                                                                                                          ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                                                                                                          SHA256

                                                                                                          4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                                                                                                          SHA512

                                                                                                          d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\80E8.exe
                                                                                                          Filesize

                                                                                                          124KB

                                                                                                          MD5

                                                                                                          15e99fef6ef1009225f7c4c6e150be76

                                                                                                          SHA1

                                                                                                          89bc8a468138da2fac12db6a0fb7b93ffd8703c3

                                                                                                          SHA256

                                                                                                          11d03ca1f0e3a488cd6ce3b2db917f470218473ed7cbbe75b1e7bf301ea23269

                                                                                                          SHA512

                                                                                                          3b8ef63d2f08ef6dc0d74e596c23afaa701b22d8dbf52fc1d073b0d285256f340587d9a933d7eb664f2a79df9e0576fa6737a9919304e67150e39e3d51c10480

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8916.bat
                                                                                                          Filesize

                                                                                                          77B

                                                                                                          MD5

                                                                                                          55cc761bf3429324e5a0095cab002113

                                                                                                          SHA1

                                                                                                          2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                                          SHA256

                                                                                                          d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                                          SHA512

                                                                                                          33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\89D2.exe
                                                                                                          Filesize

                                                                                                          4.1MB

                                                                                                          MD5

                                                                                                          f646f6506fa9b00d11c3887a190046aa

                                                                                                          SHA1

                                                                                                          12ce1eb4b7b5ff512502cf3d1264b100d4366671

                                                                                                          SHA256

                                                                                                          a2d867bfdb114e965fbf7fb6627507debad125403eab2a5a9a8df962e4a3c084

                                                                                                          SHA512

                                                                                                          32fc86c0ff592bebff2c8c553bdfaf7cbc62ab972a121b12631210cb036f121195ee47af48a41b5353520ade1023953b02c7094890f5b1c635a6396146079d29

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9DC7.exe
                                                                                                          Filesize

                                                                                                          726KB

                                                                                                          MD5

                                                                                                          04bc96aea2bb26b60d2e58de93e348ef

                                                                                                          SHA1

                                                                                                          395275166f1714d30b2235f85136531036570e55

                                                                                                          SHA256

                                                                                                          b93b406a1fd1cc9365a9920b2573f82abc226c2b16576499e2a628b343cc5868

                                                                                                          SHA512

                                                                                                          0e36ff2ba67194b604bf192b95e786d934ad0c854bb0875881ee805c2154e78b59ea9c5650f02b01a01c4beb1e98619ec012ae44018b7f42d236e3853d0dd91e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9DC7.exe
                                                                                                          Filesize

                                                                                                          704KB

                                                                                                          MD5

                                                                                                          e15aa0dfede3ec49838bcf8f32740cc6

                                                                                                          SHA1

                                                                                                          7f8fbd9f3d7a2ad08a928f2479188392f7cdc959

                                                                                                          SHA256

                                                                                                          755554266c7aa1208c66dd4e07fb43c785d7308b22161d0874cbfa2459527142

                                                                                                          SHA512

                                                                                                          38a6ffe839a583154fa296cfe1470c6b4b85687b0c040ff49f65bd3201502556fc705cf21d4dab9f0eb9db7eb74e9e3f167a49a67ee2010651454cc570c4a44e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BB63.exe
                                                                                                          Filesize

                                                                                                          351KB

                                                                                                          MD5

                                                                                                          cdecfa866f6afdc28197256d599ea9d6

                                                                                                          SHA1

                                                                                                          3de6536984bb94009be0b5b3761239fdc861b4aa

                                                                                                          SHA256

                                                                                                          5b65a8e580bd4add0ebc2759cc1a9619bdb24a011f0256373e493e3143a49427

                                                                                                          SHA512

                                                                                                          8e6d69703364b7b2b7eba2bfcf039ae0bda91e88ed6d47946eaa3e2dc4b19566dffa1da5c355929e0bbe2172095c39ab5c99e703c41f27d2ab092a8d738ca78d

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cklyxos4.r3q.ps1
                                                                                                          Filesize

                                                                                                          60B

                                                                                                          MD5

                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                          SHA1

                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                          SHA256

                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                          SHA512

                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                          Filesize

                                                                                                          281KB

                                                                                                          MD5

                                                                                                          d98e33b66343e7c96158444127a117f6

                                                                                                          SHA1

                                                                                                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                          SHA256

                                                                                                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                          SHA512

                                                                                                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\hradwbb
                                                                                                          Filesize

                                                                                                          231KB

                                                                                                          MD5

                                                                                                          3c99e1c4ab1f94fa9384cd0667a2b166

                                                                                                          SHA1

                                                                                                          abd4d2d15008bf4f202febc98acfe76c8aef0f52

                                                                                                          SHA256

                                                                                                          74cdac95ce4d55dbc351fe96a3be596b709e4ef3add0427b5f3ec62d48019de6

                                                                                                          SHA512

                                                                                                          446c5ef0834ad3b913ecd81b4a85c6deb371dbc6d6d4abd878b6fbf7a212ce12b59277c4736ffafe046fd0d192d6aed86127a45eee1d4e614d9381ed65ee5adf

                                                                                                          Download Submit

                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          3d086a433708053f9bf9523e1d87a4e8

                                                                                                          SHA1

                                                                                                          b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                                                                          SHA256

                                                                                                          6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                                                                          SHA512

                                                                                                          931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                                                                          Download Submit

                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          e0a18b11771840bb913ee604ab179353

                                                                                                          SHA1

                                                                                                          64e7bc1e4fce4349c645e88265b8a2dbb53d8b1c

                                                                                                          SHA256

                                                                                                          5c35d64f2ccc9057f15ee51135862fd02c9162da981108ec441fc17334184b24

                                                                                                          SHA512

                                                                                                          8099b8830bd77a3e7259995957ee7d096989cf8f597297a0bf61805279f2f12ce7f3552ba7fb06763847ecd06821715caaf483ff5e224360e4365a8c10a7865d

                                                                                                          Download Submit

                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          8577a96212b2371ef34c7636fff18b2c

                                                                                                          SHA1

                                                                                                          65eea44baa549f0ccbbdcc904db1ce1bc1af98ee

                                                                                                          SHA256

                                                                                                          04ecd544c45489a1ff0d66ce07ea771f0dc1529dfe6edf477189de0cf83c3efb

                                                                                                          SHA512

                                                                                                          03e9cfd8364237c1566a636aab13638ff2f5fe6d5ed74af8c80f5eebcf5634d3a0ef13d8346832208116e7367c24a30d504e9d6308d5b654e860f917dd013c52

                                                                                                          Download Submit

                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          65663059a6487e06a9e56bac85496463

                                                                                                          SHA1

                                                                                                          c61883d52ea2244b1c94dc355846e82ca31e24a6

                                                                                                          SHA256

                                                                                                          f6059c518aeda94933b1baf8d612d8617c7e0f905d13adec1e886f8b5de36741

                                                                                                          SHA512

                                                                                                          5c6a1e06f156badfa3c5df2de8421c10796399a1e49e9610e168f89412db91fec379094fad3a9ff319af2ad9239d70190511d3e86d305c5480a3ecd20766ef9c

                                                                                                          Download Submit

                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          0cf829da77fcf7b16968ab36e4e4c008

                                                                                                          SHA1

                                                                                                          8e8024aa4e9ddefbd14d306cf9f843911f8fe37a

                                                                                                          SHA256

                                                                                                          58918d07fa2515853844588b9ebc98ee09a937cfaf18cb6889b6038c0e643126

                                                                                                          SHA512

                                                                                                          5ef3209947da7abdb49728bdf3d6dcb6dd87d30e037e4f5bd5d03b4548869b701f082627247fd8b27bcd0848709b840e71d4c67cd69b45b77cd61c8a0fbbdfed

                                                                                                          Download Submit

                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          d8ce1db31aed7653e9cf76bbee344afe

                                                                                                          SHA1

                                                                                                          a9402c3e5c70ddc2628d13696f41402cf206a7d6

                                                                                                          SHA256

                                                                                                          e01720768ea1a443ab83274debd02273c65f88c6efd3381d8b161a9f390d4b6f

                                                                                                          SHA512

                                                                                                          ef849113880f95f99799dfd0db60e285da1089c56e8acab1c56d4fd992e54100f6973b682938290188e8daf0ebed9db9a06a291d3c2f087f3ed3e49aab494e21

                                                                                                          Download Submit

                                                                                                        • C:\Windows\rss\csrss.exe
                                                                                                          Filesize

                                                                                                          1.8MB

                                                                                                          MD5

                                                                                                          a26ea9ed3557b2ea7548404e0a4d50b2

                                                                                                          SHA1

                                                                                                          999475b655b7fc820e61e4481e0f53aeb0c73b12

                                                                                                          SHA256

                                                                                                          0f836bc078ab8c2095c0dd3f98b4a974e121a93af240a6d0f508ee9a18c2dc32

                                                                                                          SHA512

                                                                                                          372cd244ad5055bd1cb1f6d8490477c9cab95a05544f40c38a2e9c10a48fd1bcf6a43c8731407d7c25bc0ba8af08f6107d7d147efc33272127dddcacde6dc6f0

                                                                                                          Download Submit

                                                                                                        • C:\Windows\rss\csrss.exe
                                                                                                          Filesize

                                                                                                          1.9MB

                                                                                                          MD5

                                                                                                          77e03974baa75540f3a409abc316f11d

                                                                                                          SHA1

                                                                                                          9c4093109301075b9787d6695d0560a4adaae60d

                                                                                                          SHA256

                                                                                                          468a89aef9de646b04fc2fbd98829bc9168f7343aeb1577e92c5185f62a3549b

                                                                                                          SHA512

                                                                                                          f629368bcb066667381cb604e2b3d8a9840fa3e013ecf4e9c9e35c1ddfef7ed728c459ca646c5153458cc138951ebd2434552379a24ad38b5e78e2b69d8076f6

                                                                                                          Download Submit

                                                                                                        • C:\Windows\windefender.exe
                                                                                                          Filesize

                                                                                                          2.0MB

                                                                                                          MD5

                                                                                                          8e67f58837092385dcf01e8a2b4f5783

                                                                                                          SHA1

                                                                                                          012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                                          SHA256

                                                                                                          166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                                          SHA512

                                                                                                          40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                                                          Download Submit

                                                                                                        • memory/220-2-0x00000000006A0000-0x00000000006AB000-memory.dmp

                                                                                                          Filesize

                                                                                                          44KB

                                                                                                          Download

                                                                                                        • memory/220-3-0x0000000000400000-0x000000000053D000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/220-5-0x0000000000400000-0x000000000053D000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/220-1-0x00000000006B0000-0x00000000007B0000-memory.dmp

                                                                                                          Filesize

                                                                                                          1024KB

                                                                                                          Download

                                                                                                        • memory/832-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                          Filesize

                                                                                                          9.1MB

                                                                                                          Download

                                                                                                        • memory/832-181-0x0000000002970000-0x0000000002D6B000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.0MB

                                                                                                          Download

                                                                                                        • memory/832-182-0x0000000002D70000-0x000000000365B000-memory.dmp

                                                                                                          Filesize

                                                                                                          8.9MB

                                                                                                          Download

                                                                                                        • memory/832-183-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                          Filesize

                                                                                                          9.1MB

                                                                                                          Download

                                                                                                        • memory/832-224-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                          Filesize

                                                                                                          9.1MB

                                                                                                          Download

                                                                                                        • memory/972-122-0x0000000000A80000-0x0000000000B80000-memory.dmp

                                                                                                          Filesize

                                                                                                          1024KB

                                                                                                          Download

                                                                                                        • memory/972-123-0x0000000000A50000-0x0000000000A54000-memory.dmp

                                                                                                          Filesize

                                                                                                          16KB

                                                                                                          Download

                                                                                                        • memory/1496-20-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1496-36-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1496-23-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1496-26-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1496-25-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1588-71-0x0000000000400000-0x0000000000644000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.3MB

                                                                                                          Download

                                                                                                        • memory/1588-74-0x0000000000400000-0x0000000000644000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.3MB

                                                                                                          Download

                                                                                                        • memory/1588-75-0x0000000000400000-0x0000000000644000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.3MB

                                                                                                          Download

                                                                                                        • memory/1588-113-0x0000000000400000-0x0000000000644000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.3MB

                                                                                                          Download

                                                                                                        • memory/1836-298-0x0000016F16E90000-0x0000016F16EB0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                          Download

                                                                                                        • memory/1836-300-0x0000016F16E50000-0x0000016F16E70000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                          Download

                                                                                                        • memory/1836-302-0x0000016F17500000-0x0000016F17520000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                          Download

                                                                                                        • memory/1876-50-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-57-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-56-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-43-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-116-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-44-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-42-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-110-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-54-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1876-49-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/2300-69-0x0000000003000000-0x0000000003100000-memory.dmp

                                                                                                          Filesize

                                                                                                          1024KB

                                                                                                          Download

                                                                                                        • memory/2300-70-0x00000000049A0000-0x00000000049D1000-memory.dmp

                                                                                                          Filesize

                                                                                                          196KB

                                                                                                          Download

                                                                                                        • memory/2508-393-0x0000025451710000-0x0000025451730000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                          Download

                                                                                                        • memory/2540-128-0x0000000000400000-0x0000000000406000-memory.dmp

                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          Download

                                                                                                        • memory/2540-126-0x0000000000400000-0x0000000000406000-memory.dmp

                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          Download

                                                                                                        • memory/2540-121-0x0000000000400000-0x0000000000406000-memory.dmp

                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          Download

                                                                                                        • memory/3296-216-0x00000000723F0000-0x0000000072BA0000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/3296-172-0x00000000055A0000-0x00000000055B0000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download

                                                                                                        • memory/3296-165-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                          Filesize

                                                                                                          112KB

                                                                                                          Download

                                                                                                        • memory/3296-168-0x0000000005AC0000-0x0000000006064000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.6MB

                                                                                                          Download

                                                                                                        • memory/3296-174-0x0000000006910000-0x0000000006976000-memory.dmp

                                                                                                          Filesize

                                                                                                          408KB

                                                                                                          Download

                                                                                                        • memory/3296-173-0x0000000006790000-0x0000000006822000-memory.dmp

                                                                                                          Filesize

                                                                                                          584KB

                                                                                                          Download

                                                                                                        • memory/3296-171-0x00000000723F0000-0x0000000072BA0000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/3360-39-0x0000000002250000-0x00000000022EB000-memory.dmp

                                                                                                          Filesize

                                                                                                          620KB

                                                                                                          Download

                                                                                                        • memory/3484-213-0x0000000007930000-0x00000000079A6000-memory.dmp

                                                                                                          Filesize

                                                                                                          472KB

                                                                                                          Download

                                                                                                        • memory/3484-227-0x0000000072E20000-0x0000000072E6C000-memory.dmp

                                                                                                          Filesize

                                                                                                          304KB

                                                                                                          Download

                                                                                                        • memory/3484-242-0x0000000003030000-0x0000000003040000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download

                                                                                                        • memory/3484-241-0x0000000007CF0000-0x0000000007CFA000-memory.dmp

                                                                                                          Filesize

                                                                                                          40KB

                                                                                                          Download

                                                                                                        • memory/3484-239-0x0000000007C00000-0x0000000007CA3000-memory.dmp

                                                                                                          Filesize

                                                                                                          652KB

                                                                                                          Download

                                                                                                        • memory/3484-238-0x0000000007BE0000-0x0000000007BFE000-memory.dmp

                                                                                                          Filesize

                                                                                                          120KB

                                                                                                          Download

                                                                                                        • memory/3484-228-0x000000006E4E0000-0x000000006E834000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                          Download

                                                                                                        • memory/3484-226-0x000000007EE70000-0x000000007EE80000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download

                                                                                                        • memory/3484-185-0x0000000003080000-0x00000000030B6000-memory.dmp

                                                                                                          Filesize

                                                                                                          216KB

                                                                                                          Download

                                                                                                        • memory/3484-187-0x0000000005770000-0x0000000005D98000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.2MB

                                                                                                          Download

                                                                                                        • memory/3484-188-0x00000000723F0000-0x0000000072BA0000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/3484-190-0x0000000003030000-0x0000000003040000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download

                                                                                                        • memory/3484-189-0x0000000003030000-0x0000000003040000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download

                                                                                                        • memory/3484-191-0x0000000005EA0000-0x0000000005EC2000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                          Download

                                                                                                        • memory/3484-192-0x0000000005F40000-0x0000000005FA6000-memory.dmp

                                                                                                          Filesize

                                                                                                          408KB

                                                                                                          Download

                                                                                                        • memory/3484-225-0x0000000007BA0000-0x0000000007BD2000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                          Download

                                                                                                        • memory/3484-203-0x0000000006210000-0x0000000006564000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                          Download

                                                                                                        • memory/3484-218-0x00000000079E0000-0x00000000079FA000-memory.dmp

                                                                                                          Filesize

                                                                                                          104KB

                                                                                                          Download

                                                                                                        • memory/3484-208-0x0000000006610000-0x000000000662E000-memory.dmp

                                                                                                          Filesize

                                                                                                          120KB

                                                                                                          Download

                                                                                                        • memory/3484-209-0x0000000006C10000-0x0000000006C5C000-memory.dmp

                                                                                                          Filesize

                                                                                                          304KB

                                                                                                          Download

                                                                                                        • memory/3484-217-0x0000000008030000-0x00000000086AA000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.5MB

                                                                                                          Download

                                                                                                        • memory/3484-211-0x0000000006B10000-0x0000000006B54000-memory.dmp

                                                                                                          Filesize

                                                                                                          272KB

                                                                                                          Download

                                                                                                        • memory/3520-118-0x0000000002430000-0x0000000004430000-memory.dmp

                                                                                                          Filesize

                                                                                                          32.0MB

                                                                                                          Download

                                                                                                        • memory/3520-81-0x0000000000020000-0x000000000007E000-memory.dmp

                                                                                                          Filesize

                                                                                                          376KB

                                                                                                          Download

                                                                                                        • memory/3520-82-0x0000000072760000-0x0000000072F10000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/3520-92-0x0000000072760000-0x0000000072F10000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/3520-91-0x0000000002430000-0x0000000004430000-memory.dmp

                                                                                                          Filesize

                                                                                                          32.0MB

                                                                                                          Download

                                                                                                        • memory/3576-4-0x0000000002DE0000-0x0000000002DF6000-memory.dmp

                                                                                                          Filesize

                                                                                                          88KB

                                                                                                          Download

                                                                                                        • memory/3576-207-0x0000000002630000-0x0000000002631000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-146-0x0000000000870000-0x0000000000871000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-156-0x0000000003080000-0x0000000003081000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-151-0x0000000003070000-0x0000000003071000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-153-0x0000000000890000-0x0000000001575000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.9MB

                                                                                                          Download

                                                                                                        • memory/3624-147-0x0000000000890000-0x0000000001575000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.9MB

                                                                                                          Download

                                                                                                        • memory/3624-175-0x0000000000890000-0x0000000001575000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.9MB

                                                                                                          Download

                                                                                                        • memory/3624-154-0x0000000003080000-0x0000000003081000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-148-0x0000000000880000-0x0000000000881000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-149-0x0000000003050000-0x0000000003051000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-150-0x0000000003060000-0x0000000003061000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-155-0x0000000003080000-0x0000000003081000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-145-0x0000000000860000-0x0000000000861000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3624-137-0x0000000000890000-0x0000000001575000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.9MB

                                                                                                          Download

                                                                                                        • memory/3644-384-0x0000000000950000-0x0000000000951000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4072-292-0x0000000004630000-0x0000000004631000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4500-94-0x0000000000D40000-0x0000000000D41000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4500-93-0x0000000000D40000-0x0000000000D41000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4500-95-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                          Download

                                                                                                        • memory/4500-112-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                          Download

                                                                                                        • memory/4500-89-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                          Download

                                                                                                        • memory/4500-86-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                          Download

                                                                                                        • memory/4620-169-0x00000000723F0000-0x0000000072BA0000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/4620-170-0x0000000003110000-0x0000000005110000-memory.dmp

                                                                                                          Filesize

                                                                                                          32.0MB

                                                                                                          Download

                                                                                                        • memory/4620-161-0x0000000000DB0000-0x0000000000DD6000-memory.dmp

                                                                                                          Filesize

                                                                                                          152KB

                                                                                                          Download

                                                                                                        • memory/4620-240-0x0000000003110000-0x0000000005110000-memory.dmp

                                                                                                          Filesize

                                                                                                          32.0MB

                                                                                                          Download

                                                                                                        • memory/4620-162-0x00000000723F0000-0x0000000072BA0000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/5012-24-0x00000000023C0000-0x00000000024DB000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                          Download

                                                                                                        • memory/5012-21-0x00000000021C0000-0x0000000002261000-memory.dmp

                                                                                                          Filesize

                                                                                                          644KB

                                                                                                          Download