Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2024 10:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6ca1274e2b896609e052a17f5de984ec78795a756cd22b3a5dc1a1803b2cb977.exe

  • Size

    1.8MB

  • MD5

    acf7e9b844bd35fbfa3deda44914ec62

  • SHA1

    fe30c1151dfdf70580330f9f9f1bc6021c3de62c

  • SHA256

    6ca1274e2b896609e052a17f5de984ec78795a756cd22b3a5dc1a1803b2cb977

  • SHA512

    a2b1f8453d33978e4c2b1db335972c2332260b0a20d497f2cefbd5cd414213ea5afd07f6121028724f88b3b908899a4adb327d55766ce83cbee66ec7ec0ac0c9

  • SSDEEP

    24576:OhNhj1lHGvmFaURlYVQHD6QMTZxRyc0H4yKNqGhnbg4xI3ViTQIvlNRdeRqdlVGN:Oh1lHQUTOoD2se4Gxxs0vjeRqdG

Score
10/10
amadeydcratdjvulummariseprosmokeloaderstealcbackdoordiscoveryevasioninfostealerpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.12

C2

http://185.172.128.19

Attributes
  • install_dir

    cd1f156d67

  • install_file

    Utsysc.exe

  • strings_key

    0dd3e5ee91b367c60c9e575983554b30

  • url_paths

    /ghsdh39s/index.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://associationokeo.shop/api

https://resergvearyinitiani.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 7 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ca1274e2b896609e052a17f5de984ec78795a756cd22b3a5dc1a1803b2cb977.exe
    "C:\Users\Admin\AppData\Local\Temp\6ca1274e2b896609e052a17f5de984ec78795a756cd22b3a5dc1a1803b2cb977.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Users\Admin\AppData\Local\Temp\1000022001\01e79bfed6.exe
        "C:\Users\Admin\AppData\Local\Temp\1000022001\01e79bfed6.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:3216
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
          PID:2880
        • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
          "C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3636
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:5044
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4172
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              5⤵
                PID:4216
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\270530367132_Desktop.zip' -CompressionLevel Optimal
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4044
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
            3⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            PID:4712
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2748
      • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
        C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:916
        • C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe
          "C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          PID:4428
        • C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe
          "C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:1400
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1228
                4⤵
                • Program crash
                PID:1260
          • C:\Users\Admin\AppData\Local\Temp\1000074001\Fullwork123.exe
            "C:\Users\Admin\AppData\Local\Temp\1000074001\Fullwork123.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4936
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:2404
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 1100
                  4⤵
                  • Program crash
                  PID:2636
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 608
                  4⤵
                  • Program crash
                  PID:4360
            • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
              "C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe"
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3608
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN boom8.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe" /F
                3⤵
                • Creates scheduled task(s)
                PID:1544
              • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
                "C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5092
                • C:\Users\Admin\AppData\Local\Temp\u3xg.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u3xg.0.exe"
                  4⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:840
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GIJEGDAKEH.exe"
                    5⤵
                      PID:3796
                      • C:\Users\Admin\AppData\Local\Temp\GIJEGDAKEH.exe
                        "C:\Users\Admin\AppData\Local\Temp\GIJEGDAKEH.exe"
                        6⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        PID:3520
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\GIJEGDAKEH.exe
                          7⤵
                            PID:3320
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 2.2.2.2 -n 1 -w 3000
                              8⤵
                              • Runs ping.exe
                              PID:3444
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 2332
                        5⤵
                        • Program crash
                        PID:1128
                    • C:\Users\Admin\AppData\Local\Temp\u3xg.1.exe
                      "C:\Users\Admin\AppData\Local\Temp\u3xg.1.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1852
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                        5⤵
                          PID:3380
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            6⤵
                              PID:952
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                              6⤵
                              • Creates scheduled task(s)
                              PID:5052
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 1528
                          4⤵
                          • Program crash
                          PID:3096
                      • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        PID:4992
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                      2⤵
                      • Loads dropped DLL
                      PID:1136
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                        3⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4804
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          4⤵
                            PID:2184
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\270530367132_Desktop.zip' -CompressionLevel Optimal
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2192
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                        2⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        PID:4752
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1400 -ip 1400
                      1⤵
                        PID:5020
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2404 -ip 2404
                        1⤵
                          PID:116
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2404 -ip 2404
                          1⤵
                            PID:3736
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5092 -ip 5092
                            1⤵
                              PID:3212
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 840 -ip 840
                              1⤵
                                PID:2636
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7C6E.bat" "
                                1⤵
                                  PID:4172
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                    2⤵
                                      PID:1200
                                  • C:\Users\Admin\AppData\Local\Temp\8CFA.exe
                                    C:\Users\Admin\AppData\Local\Temp\8CFA.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:5044
                                    • C:\Users\Admin\AppData\Local\Temp\8CFA.exe
                                      C:\Users\Admin\AppData\Local\Temp\8CFA.exe
                                      2⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:3224
                                      • C:\Windows\SysWOW64\icacls.exe
                                        icacls "C:\Users\Admin\AppData\Local\a859576a-36d9-44b6-83b2-4ab7b2392170" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                        3⤵
                                        • Modifies file permissions
                                        PID:4216
                                      • C:\Users\Admin\AppData\Local\Temp\8CFA.exe
                                        "C:\Users\Admin\AppData\Local\Temp\8CFA.exe" --Admin IsNotAutoStart IsNotTask
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:4756
                                        • C:\Users\Admin\AppData\Local\Temp\8CFA.exe
                                          "C:\Users\Admin\AppData\Local\Temp\8CFA.exe" --Admin IsNotAutoStart IsNotTask
                                          4⤵
                                          • Executes dropped EXE
                                          PID:784
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 568
                                            5⤵
                                            • Program crash
                                            PID:3624
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 784 -ip 784
                                    1⤵
                                      PID:840
                                    • C:\Users\Admin\AppData\Local\Temp\C001.exe
                                      C:\Users\Admin\AppData\Local\Temp\C001.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:1508
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1092
                                        2⤵
                                        • Program crash
                                        PID:3380
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C1E7.bat" "
                                      1⤵
                                        PID:4368
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                          2⤵
                                            PID:4952
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1508 -ip 1508
                                          1⤵
                                            PID:2604
                                          • C:\Users\Admin\AppData\Local\Temp\D224.exe
                                            C:\Users\Admin\AppData\Local\Temp\D224.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:3492
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              2⤵
                                                PID:3792
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 1192
                                                  3⤵
                                                  • Program crash
                                                  PID:4528
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 1208
                                                  3⤵
                                                  • Program crash
                                                  PID:228
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3792 -ip 3792
                                              1⤵
                                                PID:4640
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3792 -ip 3792
                                                1⤵
                                                  PID:2624
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:4716
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5020
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies registry class
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:2956
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3884
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3736
                                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:4396
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies registry class
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:2568
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3488
                                                • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                  C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:1908
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3752
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies registry class
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:1436
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2356
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4652
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3508
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3476
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:376
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:2280
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1068
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:1584
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:1128
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4192
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3752
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:1908
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:4936
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3756
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4492
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:1680
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4628
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:5076
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:1580
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:4340
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:2404
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:2664

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Reconnaissance

                                                                                        Resource Development

                                                                                        Initial Access

                                                                                        Execution

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Persistence

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        2
                                                                                        T1547.001

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Privilege Escalation

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        2
                                                                                        T1547.001

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Defense Evasion

                                                                                        File and Directory Permissions Modification

                                                                                        1
                                                                                        T1222

                                                                                        Modify Registry

                                                                                        3
                                                                                        T1112

                                                                                        Virtualization/Sandbox Evasion

                                                                                        2
                                                                                        T1497

                                                                                        Credential Access

                                                                                        Unsecured Credentials

                                                                                        5
                                                                                        T1552

                                                                                        Credentials In Files

                                                                                        4
                                                                                        T1552.001

                                                                                        Credentials in Registry

                                                                                        1
                                                                                        T1552.002

                                                                                        Discovery

                                                                                        Peripheral Device Discovery

                                                                                        2
                                                                                        T1120

                                                                                        Query Registry

                                                                                        9
                                                                                        T1012

                                                                                        Remote System Discovery

                                                                                        1
                                                                                        T1018

                                                                                        System Information Discovery

                                                                                        6
                                                                                        T1082

                                                                                        Virtualization/Sandbox Evasion

                                                                                        2
                                                                                        T1497

                                                                                        Lateral Movement

                                                                                        Collection

                                                                                        Data from Local System

                                                                                        5
                                                                                        T1005

                                                                                        Command and Control

                                                                                        Web Service

                                                                                        1
                                                                                        T1102

                                                                                        Exfiltration

                                                                                        Impact

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\ProgramData\Are.docx
                                                                                          Filesize

                                                                                          11KB

                                                                                          MD5

                                                                                          a33e5b189842c5867f46566bdbf7a095

                                                                                          SHA1

                                                                                          e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                          SHA256

                                                                                          5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                          SHA512

                                                                                          f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                          Download Submit

                                                                                        • C:\ProgramData\mozglue.dll
                                                                                          Filesize

                                                                                          593KB

                                                                                          MD5

                                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                                          SHA1

                                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                          SHA256

                                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                          SHA512

                                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                          Download Submit

                                                                                        • C:\ProgramData\nss3.dll
                                                                                          Filesize

                                                                                          2.0MB

                                                                                          MD5

                                                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                                                          SHA1

                                                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                          SHA256

                                                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                          SHA512

                                                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                          Filesize

                                                                                          471B

                                                                                          MD5

                                                                                          1912b0de9722581d54626ce20721f9b6

                                                                                          SHA1

                                                                                          f412c2f35cfcb0136eb91da25a55c418df42b343

                                                                                          SHA256

                                                                                          3bbddcc2d1995d3dc52f8085db9dc953da9a6035d528d44fd9ec800ab35a5429

                                                                                          SHA512

                                                                                          b1621b61d045e649abbaa9d6cd50a7ba1a1a66422f1025fd3719aca30fc584976ec0ec2a0d7a16545c6b6d110dc99359db8a95cc7624bb2fe562854ab0a8ecd1

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                          Filesize

                                                                                          412B

                                                                                          MD5

                                                                                          3f15296d466f713c824259f81216a992

                                                                                          SHA1

                                                                                          7cb718b3d4f9147f6affd2a6d2de223a220c8fa2

                                                                                          SHA256

                                                                                          f1c6ca2d2ab15de769512d2d4ebff6676638b71596059b4409c9f02ba59905f1

                                                                                          SHA512

                                                                                          8abe930afb7e4c3e0aa442158177cf53edfe1576a12e4219343ead3b64549759d5404426f125c3eb42f29eed4218a475572ef1635f96b289701f6dde1f710301

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                          Filesize

                                                                                          3KB

                                                                                          MD5

                                                                                          fe3aab3ae544a134b68e881b82b70169

                                                                                          SHA1

                                                                                          926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                                                                          SHA256

                                                                                          bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                                                                          SHA512

                                                                                          3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          7f5130f8643f9c281b6384704d27b900

                                                                                          SHA1

                                                                                          c384737918a1e492e8742800a251d31de1842de2

                                                                                          SHA256

                                                                                          e5a21b6e080bd51ab39ae0aa91aa0573951a52aafd2f021263141d0755e1cf8f

                                                                                          SHA512

                                                                                          ff471d00db8f4ec88cd0d52894e4f1a91ad32473cb173b7a5d431def9717cbe106c2ae431869651a3a9fc1801f9997a9d35d22a85cdb605ed98731e6dc129161

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S6429SHP\microsoft.windows[1].xml
                                                                                          Filesize

                                                                                          97B

                                                                                          MD5

                                                                                          7e39acb1017053b924cf303370a12e55

                                                                                          SHA1

                                                                                          9c440dcafded082c00184b9b56e227028d055085

                                                                                          SHA256

                                                                                          b869cba3bf0e6ac6a65964e24a354bb1a787cb2c72db5da939e5a077d7848209

                                                                                          SHA512

                                                                                          895d599af4410d14543a699ecb70555a7ce606d9550c220b715ba1d8c6ef9e24b715c983499a162a222fdaa474dfdee1ad016b47b831e72acc994bd7c53dba1c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                          Filesize

                                                                                          1.8MB

                                                                                          MD5

                                                                                          acf7e9b844bd35fbfa3deda44914ec62

                                                                                          SHA1

                                                                                          fe30c1151dfdf70580330f9f9f1bc6021c3de62c

                                                                                          SHA256

                                                                                          6ca1274e2b896609e052a17f5de984ec78795a756cd22b3a5dc1a1803b2cb977

                                                                                          SHA512

                                                                                          a2b1f8453d33978e4c2b1db335972c2332260b0a20d497f2cefbd5cd414213ea5afd07f6121028724f88b3b908899a4adb327d55766ce83cbee66ec7ec0ac0c9

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000022001\01e79bfed6.exe
                                                                                          Filesize

                                                                                          783KB

                                                                                          MD5

                                                                                          8eafe511c91d221466dab944d03dfdba

                                                                                          SHA1

                                                                                          58685faeba2ee036da3262ef88f488fc384f5dfd

                                                                                          SHA256

                                                                                          06e458b190772fa8ed6d7530ed2b03582dbed7ba2f4b4c82e70b082876d647e0

                                                                                          SHA512

                                                                                          78f91502791a2d0db601b84ede98c3d959dcadc1b2aeb15f88acf71ddcb1c88faad05d9a2170c75f6c55d8d1743f7ae6f7a2edb85a02b085acffd73736aa248b

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000022001\01e79bfed6.exe
                                                                                          Filesize

                                                                                          3.0MB

                                                                                          MD5

                                                                                          3dbac54e1748d85e4b7ac7a71b768fe5

                                                                                          SHA1

                                                                                          c7f78bb2b5d4633412ed1e76f1736501d1b25cc8

                                                                                          SHA256

                                                                                          c8804f8b97b9745078991fcd0441aad4693062255b8f15a73ae43f54b11066d7

                                                                                          SHA512

                                                                                          4a15aa50c5254c2499d1cd7ba5e5a9c8f07cc3189ae2f29cdd614c58f13f3877d05967967f2f5b709fe0ad36cd5c627a0d7715e6e9e82ad2dff7b94f7e64e4d2

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
                                                                                          Filesize

                                                                                          413KB

                                                                                          MD5

                                                                                          d467222c3bd563cb72fa49302f80b079

                                                                                          SHA1

                                                                                          9335e2a36abb8309d8a2075faf78d66b968b2a91

                                                                                          SHA256

                                                                                          fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

                                                                                          SHA512

                                                                                          484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe
                                                                                          Filesize

                                                                                          64KB

                                                                                          MD5

                                                                                          1dace520212f20c61af10b1ff3d6ad3f

                                                                                          SHA1

                                                                                          ba756d50b905698d90f89e04cae4fde6e9ca2ae7

                                                                                          SHA256

                                                                                          d161efd1375f826043601f9fdf75057632a0ff3c91c9f960cbb3810d72a1b15b

                                                                                          SHA512

                                                                                          57dd93ee6801d7cccfb657d9295c9fff7c400f8deb494f05a34df01555425bc36efcc62aecaecc688b84170c8a4827f8fcc11dd31cd4499a870800b5707c1a30

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe
                                                                                          Filesize

                                                                                          102KB

                                                                                          MD5

                                                                                          760c322956f992eb2223da3d9a5d3f26

                                                                                          SHA1

                                                                                          52f19f4f723c250eb985115bc211c1f1d9c3145a

                                                                                          SHA256

                                                                                          e4684a90226a2365f9947fc3e7deb419d859b010e69ecda2fd5d45a0f69f748a

                                                                                          SHA512

                                                                                          9e60556c388423b1f63c752930bcbd1822ce6bda233f2fb95a19f12b0bb3ef0fd38d736ccc7a0eb18df48531c5afeb766276ed9be2a406a46d7c0dbda6909623

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe
                                                                                          Filesize

                                                                                          350KB

                                                                                          MD5

                                                                                          04df085b57814d1a1accead4e153909e

                                                                                          SHA1

                                                                                          6d277da314ef185ba9072a9b677b599b1f46c35b

                                                                                          SHA256

                                                                                          91a36d137ebfa812b055728807e11338d15d3a5d869cb4babdf779266688e4dd

                                                                                          SHA512

                                                                                          f37678424e46e4f28e1047161db60ad737515558c8c8905ed598ca96b198304da7356e49e7bb9d1e77fe75372f0b5a7f670a353d093749c37bb85c40ec7fdafa

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000074001\Fullwork123.exe
                                                                                          Filesize

                                                                                          354KB

                                                                                          MD5

                                                                                          f72f6b9036a9273958dc09effeb0a10a

                                                                                          SHA1

                                                                                          88c6d3521a345c8fd688a7a35c25299cdf96c5cd

                                                                                          SHA256

                                                                                          5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc

                                                                                          SHA512

                                                                                          b5b72ff06efe22888ab2f8715b899477e73335fd04ae42a37a1e6da794a4e0b3d7ac6ad7f24e7dddaca91bc96484776bb1c49d5385096523e2cb380bed83f314

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                          Filesize

                                                                                          257KB

                                                                                          MD5

                                                                                          dd5fab176ea8a6829937e425bcb4007e

                                                                                          SHA1

                                                                                          557fdd24cef21a2364bdbce855ea475fd6fdf4bb

                                                                                          SHA256

                                                                                          4cdc21a7ed6bd8f9e38a0b86b58a03449adaf6d6b2455c41658586fc51130c73

                                                                                          SHA512

                                                                                          aa9a632c22f11bebe47fbbe0392f74cb545097b68940533c068e17c36797a4c7a7d7acec2335e410463d39a64da4f47bc5de801bea6e70993d85683d5a606c1f

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                                                          Filesize

                                                                                          418KB

                                                                                          MD5

                                                                                          0099a99f5ffb3c3ae78af0084136fab3

                                                                                          SHA1

                                                                                          0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                          SHA256

                                                                                          919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                          SHA512

                                                                                          5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
                                                                                          Filesize

                                                                                          437KB

                                                                                          MD5

                                                                                          b6df7bf133a1b4ed69985d6bb949d225

                                                                                          SHA1

                                                                                          7d27d0fc2f21a6a4701159a766096eb51ce0cc98

                                                                                          SHA256

                                                                                          222b002bfc2d9b651fbc19909ec186750afb845205b82a193a0bbdc5320766b8

                                                                                          SHA512

                                                                                          569857633f60f5eb93309b7d60aa7ebe8e5734f5339b1ed314a0c060626396e9700c1fab05f7ccdb7998c77c90ab1a46de8f2fc5f64c16bec3bc16742ba63b2e

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                                                                                          Filesize

                                                                                          293KB

                                                                                          MD5

                                                                                          5360fe5781d535acfbaeedd08e9c5b04

                                                                                          SHA1

                                                                                          1d1aede764c4396086a9847c193b1ee15b528ea2

                                                                                          SHA256

                                                                                          b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0

                                                                                          SHA512

                                                                                          68a8943c4bffa60864d90c286d0423a06f9ddaaa8f85d4c6d92e091f938c57dd1a92865014dfac6ad3ecc2dc67c9b3e161e479112d2aa77ab8b6a1b422b5f6bf

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\7C6E.bat
                                                                                          Filesize

                                                                                          77B

                                                                                          MD5

                                                                                          55cc761bf3429324e5a0095cab002113

                                                                                          SHA1

                                                                                          2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                          SHA256

                                                                                          d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                          SHA512

                                                                                          33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\8CFA.exe
                                                                                          Filesize

                                                                                          792KB

                                                                                          MD5

                                                                                          bfb6814f5a0f83e408910fb6e6f80672

                                                                                          SHA1

                                                                                          1ecb6006d83a7570d2b90d25f0b67b91681eadf3

                                                                                          SHA256

                                                                                          ad2b04ab01eb9dc003a5f5e0b5920d253b424d4c37e497a61d91f0a21b03f3a7

                                                                                          SHA512

                                                                                          95647032d104dc1eaaf3abce85e34cef3248787e5b0f5d580c13efb46afed680eb7beb5328e67373033c3a13b643dfc1c853cd028924fd2c990ac0bbfaddebd7

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\C001.exe
                                                                                          Filesize

                                                                                          6.5MB

                                                                                          MD5

                                                                                          9e52aa572f0afc888c098db4c0f687ff

                                                                                          SHA1

                                                                                          ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                                                                                          SHA256

                                                                                          4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                                                                                          SHA512

                                                                                          d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\D224.exe
                                                                                          Filesize

                                                                                          351KB

                                                                                          MD5

                                                                                          40408d90b261f8716b703db1715df09f

                                                                                          SHA1

                                                                                          ac4ccd5c3d585ff9f8ee24dc79fbaa2b918212ab

                                                                                          SHA256

                                                                                          5ef8a6fc75231cb5751d95fd0fd21e6e9486097939c1f5a61930b01d59880c4a

                                                                                          SHA512

                                                                                          c5f58b8862888d7019a736ec9652ae958265169d944447f96d96a43677f211d017fb60dbb090f35d98d2444c5cf9017b556737780f4399a0c156fdfb0b53b29d

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\GIJEGDAKEH.exe
                                                                                          Filesize

                                                                                          106KB

                                                                                          MD5

                                                                                          fe380780b5c35bd6d54541791151c2be

                                                                                          SHA1

                                                                                          7fe3a583cf91474c733f85cebf3c857682e269e1

                                                                                          SHA256

                                                                                          b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                                                          SHA512

                                                                                          ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qtskk01t.qsi.ps1
                                                                                          Filesize

                                                                                          60B

                                                                                          MD5

                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                          SHA1

                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                          SHA256

                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                          SHA512

                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\u3xg.0.exe
                                                                                          Filesize

                                                                                          293KB

                                                                                          MD5

                                                                                          0efb69d32b90cb021bf55a1930478807

                                                                                          SHA1

                                                                                          f34a8756c8cf320ffea9c7278710fa45e9ea1517

                                                                                          SHA256

                                                                                          fe956573db3426031c409a5d834fdc5f8ea633b0aa2a4c2c71789ee1e6c344c9

                                                                                          SHA512

                                                                                          001f232e9c5bc89a3e064d94ed396c9337014685b3db5203ad4244843b1670d66f2153d1287d5df4c636c533e65af07059767e668f4d426784fa9b7095e9c69c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\u3xg.1.exe
                                                                                          Filesize

                                                                                          1.7MB

                                                                                          MD5

                                                                                          eee5ddcffbed16222cac0a1b4e2e466e

                                                                                          SHA1

                                                                                          28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                                                                                          SHA256

                                                                                          2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                                                                                          SHA512

                                                                                          8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                                                          Filesize

                                                                                          128B

                                                                                          MD5

                                                                                          11bb3db51f701d4e42d3287f71a6a43e

                                                                                          SHA1

                                                                                          63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                                                          SHA256

                                                                                          6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                                                          SHA512

                                                                                          907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                          Filesize

                                                                                          85KB

                                                                                          MD5

                                                                                          a8b8739e0e80622c8284e20daa7cfca6

                                                                                          SHA1

                                                                                          c9d8b0a48612083e4d1a2789bd7efdf02065dedd

                                                                                          SHA256

                                                                                          13fc753f189b64db0cabe9d1e0236c77999c652241579f7b829c98f81c7eb110

                                                                                          SHA512

                                                                                          2f8fe7a860bf3fa6fab6d9f35052d0b10cd984a632f95fa9efbc54562fa219efc5c28d61dc1f26d4dc1e50340dc9905447dfa163433e71dfa3005c6d00a03f7a

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                          Filesize

                                                                                          109KB

                                                                                          MD5

                                                                                          726cd06231883a159ec1ce28dd538699

                                                                                          SHA1

                                                                                          404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                          SHA256

                                                                                          12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                          SHA512

                                                                                          9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                                                          Filesize

                                                                                          1.2MB

                                                                                          MD5

                                                                                          15a42d3e4579da615a384c717ab2109b

                                                                                          SHA1

                                                                                          22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                                                          SHA256

                                                                                          3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                                                          SHA512

                                                                                          1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                                                                          Filesize

                                                                                          109KB

                                                                                          MD5

                                                                                          154c3f1334dd435f562672f2664fea6b

                                                                                          SHA1

                                                                                          51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                                                          SHA256

                                                                                          5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                                                          SHA512

                                                                                          1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                                                          Filesize

                                                                                          1.2MB

                                                                                          MD5

                                                                                          f35b671fda2603ec30ace10946f11a90

                                                                                          SHA1

                                                                                          059ad6b06559d4db581b1879e709f32f80850872

                                                                                          SHA256

                                                                                          83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                                                          SHA512

                                                                                          b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                                                          Download Submit

                                                                                        • memory/784-517-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                          Filesize

                                                                                          1.2MB

                                                                                          Download

                                                                                        • memory/784-520-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                          Filesize

                                                                                          1.2MB

                                                                                          Download

                                                                                        • memory/784-518-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                          Filesize

                                                                                          1.2MB

                                                                                          Download

                                                                                        • memory/840-326-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                          Filesize

                                                                                          972KB

                                                                                          Download

                                                                                        • memory/840-450-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                          Filesize

                                                                                          6.9MB

                                                                                          Download

                                                                                        • memory/840-462-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                          Filesize

                                                                                          6.9MB

                                                                                          Download

                                                                                        • memory/1400-193-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1400-190-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                          Filesize

                                                                                          296KB

                                                                                          Download

                                                                                        • memory/1400-186-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                          Filesize

                                                                                          296KB

                                                                                          Download

                                                                                        • memory/1400-195-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1400-194-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1400-196-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                          Filesize

                                                                                          296KB

                                                                                          Download

                                                                                        • memory/1508-191-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                          Filesize

                                                                                          32.0MB

                                                                                          Download

                                                                                        • memory/1508-183-0x0000000073030000-0x00000000737E0000-memory.dmp

                                                                                          Filesize

                                                                                          7.7MB

                                                                                          Download

                                                                                        • memory/1508-182-0x0000000000AA0000-0x0000000000AFE000-memory.dmp

                                                                                          Filesize

                                                                                          376KB

                                                                                          Download

                                                                                        • memory/1508-192-0x0000000073030000-0x00000000737E0000-memory.dmp

                                                                                          Filesize

                                                                                          7.7MB

                                                                                          Download

                                                                                        • memory/1852-451-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                          Filesize

                                                                                          5.2MB

                                                                                          Download

                                                                                        • memory/1960-31-0x00000000053E0000-0x00000000053E1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-34-0x0000000005450000-0x0000000005451000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-133-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-30-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-28-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-32-0x0000000005430000-0x0000000005431000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-449-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-33-0x0000000005460000-0x0000000005461000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-127-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-29-0x0000000005440000-0x0000000005441000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-26-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-488-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-76-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-125-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-27-0x0000000005410000-0x0000000005411000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/1960-25-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-100-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-24-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-374-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/1960-111-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2404-227-0x00000000009D0000-0x00000000009D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2404-220-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                          Filesize

                                                                                          300KB

                                                                                          Download

                                                                                        • memory/2404-229-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                          Filesize

                                                                                          300KB

                                                                                          Download

                                                                                        • memory/2404-228-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                          Filesize

                                                                                          300KB

                                                                                          Download

                                                                                        • memory/2404-223-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                          Filesize

                                                                                          300KB

                                                                                          Download

                                                                                        • memory/2748-134-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2748-150-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2748-140-0x0000000005350000-0x0000000005351000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2748-132-0x0000000000C20000-0x00000000010EA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/2748-138-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2748-137-0x0000000005360000-0x0000000005361000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2748-139-0x0000000005340000-0x0000000005341000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2748-136-0x0000000005380000-0x0000000005381000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2748-135-0x0000000005370000-0x0000000005371000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/3216-443-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-124-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-110-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-53-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-128-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-266-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-126-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-54-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-123-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-112-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3216-479-0x0000000000250000-0x0000000000602000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/3224-497-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                          Filesize

                                                                                          1.2MB

                                                                                          Download

                                                                                        • memory/3224-500-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                          Filesize

                                                                                          1.2MB

                                                                                          Download

                                                                                        • memory/3224-495-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                          Filesize

                                                                                          1.2MB

                                                                                          Download

                                                                                        • memory/3224-511-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                          Filesize

                                                                                          1.2MB

                                                                                          Download

                                                                                        • memory/3476-379-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

                                                                                          Filesize

                                                                                          88KB

                                                                                          Download

                                                                                        • memory/4044-88-0x0000022DB33F0000-0x0000022DB3412000-memory.dmp

                                                                                          Filesize

                                                                                          136KB

                                                                                          Download

                                                                                        • memory/4044-98-0x00007FF8EAB20000-0x00007FF8EB5E1000-memory.dmp

                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download

                                                                                        • memory/4044-99-0x0000022DCBA40000-0x0000022DCBA50000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                          Download

                                                                                        • memory/4044-101-0x0000022DCBA40000-0x0000022DCBA50000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                          Download

                                                                                        • memory/4044-103-0x0000022DCBA20000-0x0000022DCBA2A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                          Download

                                                                                        • memory/4044-102-0x0000022DCBED0000-0x0000022DCBEE2000-memory.dmp

                                                                                          Filesize

                                                                                          72KB

                                                                                          Download

                                                                                        • memory/4044-109-0x00007FF8EAB20000-0x00007FF8EB5E1000-memory.dmp

                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download

                                                                                        • memory/4428-162-0x00000000002D0000-0x0000000000682000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/4428-375-0x00000000002D0000-0x0000000000682000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/4428-489-0x00000000002D0000-0x0000000000682000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/4428-458-0x00000000002D0000-0x0000000000682000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/4428-161-0x00000000002D0000-0x0000000000682000-memory.dmp

                                                                                          Filesize

                                                                                          3.7MB

                                                                                          Download

                                                                                        • memory/4908-10-0x0000000004B40000-0x0000000004B41000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4908-9-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4908-1-0x0000000077A14000-0x0000000077A16000-memory.dmp

                                                                                          Filesize

                                                                                          8KB

                                                                                          Download

                                                                                        • memory/4908-2-0x0000000000100000-0x00000000005CA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/4908-4-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4908-3-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4908-5-0x0000000004B20000-0x0000000004B21000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4908-7-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4908-8-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4908-6-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4908-0-0x0000000000100000-0x00000000005CA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/4908-22-0x0000000000100000-0x00000000005CA000-memory.dmp

                                                                                          Filesize

                                                                                          4.8MB

                                                                                          Download

                                                                                        • memory/4908-11-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4936-216-0x0000000000E00000-0x0000000000E5E000-memory.dmp

                                                                                          Filesize

                                                                                          376KB

                                                                                          Download

                                                                                        • memory/4936-226-0x0000000003150000-0x0000000005150000-memory.dmp

                                                                                          Filesize

                                                                                          32.0MB

                                                                                          Download

                                                                                        • memory/4936-225-0x0000000072E60000-0x0000000073610000-memory.dmp

                                                                                          Filesize

                                                                                          7.7MB

                                                                                          Download

                                                                                        • memory/4936-218-0x0000000072E60000-0x0000000073610000-memory.dmp

                                                                                          Filesize

                                                                                          7.7MB

                                                                                          Download

                                                                                        • memory/4992-380-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                          Filesize

                                                                                          6.9MB

                                                                                          Download

                                                                                        • memory/4992-290-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/5092-325-0x0000000000400000-0x0000000000B16000-memory.dmp

                                                                                          Filesize

                                                                                          7.1MB

                                                                                          Download

                                                                                        • memory/5092-269-0x0000000000400000-0x0000000000B16000-memory.dmp

                                                                                          Filesize

                                                                                          7.1MB

                                                                                          Download

                                                                                        • memory/5092-267-0x0000000000CA0000-0x0000000000DA0000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/5092-268-0x0000000002740000-0x00000000027AE000-memory.dmp

                                                                                          Filesize

                                                                                          440KB

                                                                                          Download