Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24-03-2024 15:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c0d54d85b76b2605a960a7ba3d91542534f2a07f20b17ac58d01e0dc910f28b0.exe

  • Size

    1.9MB

  • MD5

    3ea6ee6a82cb6f39f487ea4c1e623aa2

  • SHA1

    1a9d7924ec93e0f9131284d4872c74596168c2cd

  • SHA256

    c0d54d85b76b2605a960a7ba3d91542534f2a07f20b17ac58d01e0dc910f28b0

  • SHA512

    064e02cbf4bce446f93a808f43b4d4fe721b9e609dcc8e72ced5aa1c908b94f30f967d830524646e4fd42238b98d96199e75cd076d2fdaf02d5096f5d3e9c76b

  • SSDEEP

    49152:OZ8D0Rgea+i1LzF6IrJaJG4NtwzwGAHJgEu4U:ZD08Jwt4dAHfn

Score
10/10
amadeydcratgluptebariseprosmokeloaderstealcpub1backdoordiscoverydropperevasioninfostealerloaderpersistenceratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 61 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 63 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0d54d85b76b2605a960a7ba3d91542534f2a07f20b17ac58d01e0dc910f28b0.exe
    "C:\Users\Admin\AppData\Local\Temp\c0d54d85b76b2605a960a7ba3d91542534f2a07f20b17ac58d01e0dc910f28b0.exe"
    1⤵
    • DcRat
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Users\Admin\AppData\Local\Temp\1000022001\c5fca7a473.exe
        "C:\Users\Admin\AppData\Local\Temp\1000022001\c5fca7a473.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:2596
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:2368
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            5⤵
              PID:4572
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\637591879962_Desktop.zip' -CompressionLevel Optimal
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2312
        • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
          "C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2196
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:3108
    • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
      C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe
        "C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:3136
      • C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe
        "C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3772
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:2808
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1152
              4⤵
              • Program crash
              PID:708
        • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
          "C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN boom8.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe" /F
            3⤵
            • DcRat
            • Creates scheduled task(s)
            PID:3116
          • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
            "C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4504
            • C:\Users\Admin\AppData\Local\Temp\u3h4.0.exe
              "C:\Users\Admin\AppData\Local\Temp\u3h4.0.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:248
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HIDAKFIJJK.exe"
                5⤵
                  PID:708
                  • C:\Users\Admin\AppData\Local\Temp\HIDAKFIJJK.exe
                    "C:\Users\Admin\AppData\Local\Temp\HIDAKFIJJK.exe"
                    6⤵
                    • Executes dropped EXE
                    PID:4980
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\HIDAKFIJJK.exe
                      7⤵
                        PID:3460
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 2.2.2.2 -n 1 -w 3000
                          8⤵
                          • Runs ping.exe
                          PID:2012
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 248 -s 2416
                    5⤵
                    • Program crash
                    PID:2528
                • C:\Users\Admin\AppData\Local\Temp\u3h4.1.exe
                  "C:\Users\Admin\AppData\Local\Temp\u3h4.1.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3284
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                    5⤵
                      PID:2856
                      • C:\Windows\SysWOW64\chcp.com
                        chcp 1251
                        6⤵
                          PID:2004
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                          6⤵
                          • DcRat
                          • Creates scheduled task(s)
                          PID:4792
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 1164
                      4⤵
                      • Program crash
                      PID:3584
                  • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe"
                    3⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:976
                  • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1444
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2852
                    • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe"
                      4⤵
                      • DcRat
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      PID:432
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        5⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2704
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                        5⤵
                          PID:1648
                          • C:\Windows\system32\netsh.exe
                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                            6⤵
                            • Modifies Windows Firewall
                            PID:2224
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          5⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3048
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          5⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:784
                        • C:\Windows\rss\csrss.exe
                          C:\Windows\rss\csrss.exe
                          5⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Manipulates WinMonFS driver.
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4376
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            6⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3848
                          • C:\Windows\SYSTEM32\schtasks.exe
                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                            6⤵
                            • DcRat
                            • Creates scheduled task(s)
                            PID:2044
                          • C:\Windows\SYSTEM32\schtasks.exe
                            schtasks /delete /tn ScheduledUpdate /f
                            6⤵
                              PID:2708
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              6⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2608
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              6⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1664
                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                              6⤵
                              • Executes dropped EXE
                              PID:2164
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                              6⤵
                              • DcRat
                              • Creates scheduled task(s)
                              PID:3280
                            • C:\Windows\windefender.exe
                              "C:\Windows\windefender.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:2344
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                7⤵
                                  PID:4992
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                    8⤵
                                    • Launches sc.exe
                                    PID:2356
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                        2⤵
                        • Loads dropped DLL
                        PID:4604
                        • C:\Windows\system32\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                          3⤵
                          • Blocklisted process makes network request
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          PID:708
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profiles
                            4⤵
                              PID:2372
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\637591879962_Desktop.zip' -CompressionLevel Optimal
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5080
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                          2⤵
                          • Blocklisted process makes network request
                          • Loads dropped DLL
                          PID:2288
                      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                        C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3100
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
                        1⤵
                          PID:2312
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4504 -ip 4504
                          1⤵
                            PID:2316
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 248 -ip 248
                            1⤵
                              PID:4548
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BF2.bat" "
                              1⤵
                                PID:2728
                                • C:\Windows\system32\reg.exe
                                  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                  2⤵
                                    PID:3096
                                • C:\Users\Admin\AppData\Local\Temp\221A.exe
                                  C:\Users\Admin\AppData\Local\Temp\221A.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:5028
                                  • C:\Users\Admin\AppData\Local\Temp\221A.exe
                                    C:\Users\Admin\AppData\Local\Temp\221A.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:4596
                                    • C:\Windows\SysWOW64\icacls.exe
                                      icacls "C:\Users\Admin\AppData\Local\595efc4b-97b5-42bd-9110-c7e2da47924d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                      3⤵
                                      • Modifies file permissions
                                      PID:2176
                                    • C:\Users\Admin\AppData\Local\Temp\221A.exe
                                      "C:\Users\Admin\AppData\Local\Temp\221A.exe" --Admin IsNotAutoStart IsNotTask
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2332
                                      • C:\Users\Admin\AppData\Local\Temp\221A.exe
                                        "C:\Users\Admin\AppData\Local\Temp\221A.exe" --Admin IsNotAutoStart IsNotTask
                                        4⤵
                                        • Executes dropped EXE
                                        PID:3780
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 616
                                          5⤵
                                          • Program crash
                                          PID:236
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3780 -ip 3780
                                  1⤵
                                    PID:4416
                                  • C:\Users\Admin\AppData\Local\Temp\2DD3.exe
                                    C:\Users\Admin\AppData\Local\Temp\2DD3.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:3492
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      2⤵
                                      • Modifies system certificate store
                                      PID:1156
                                  • C:\Windows\windefender.exe
                                    C:\Windows\windefender.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Modifies data under HKEY_USERS
                                    PID:4572
                                  • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                    C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:236
                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                    C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                    1⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    PID:3584
                                  • C:\Users\Admin\AppData\Local\Temp\8E54.exe
                                    C:\Users\Admin\AppData\Local\Temp\8E54.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:2652
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 1276
                                      2⤵
                                      • Program crash
                                      PID:2028
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9569.bat" "
                                    1⤵
                                      PID:1328
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                        2⤵
                                          PID:2224
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2652 -ip 2652
                                        1⤵
                                          PID:2152
                                        • C:\Users\Admin\AppData\Local\Temp\A950.exe
                                          C:\Users\Admin\AppData\Local\Temp\A950.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:2788
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            2⤵
                                              PID:4088
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 1124
                                                3⤵
                                                • Program crash
                                                PID:576
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 1112
                                                3⤵
                                                • Program crash
                                                PID:916
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4088 -ip 4088
                                            1⤵
                                              PID:4444
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4088 -ip 4088
                                              1⤵
                                                PID:1008
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                • Modifies Installed Components in the registry
                                                • Enumerates connected drives
                                                • Checks SCSI registry key(s)
                                                • Modifies registry class
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2732
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2400
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3724
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4804
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2296
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4904
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:228
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3132
                                              • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                1⤵
                                                • Executes dropped EXE
                                                PID:4804
                                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:4880

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              2
                                              T1547.001

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Windows Service

                                              1
                                              T1543.003

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              2
                                              T1547.001

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Windows Service

                                              1
                                              T1543.003

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Defense Evasion

                                              File and Directory Permissions Modification

                                              1
                                              T1222

                                              Impair Defenses

                                              1
                                              T1562

                                              Disable or Modify System Firewall

                                              1
                                              T1562.004

                                              Modify Registry

                                              4
                                              T1112

                                              Subvert Trust Controls

                                              1
                                              T1553

                                              Install Root Certificate

                                              1
                                              T1553.004

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Credential Access

                                              Unsecured Credentials

                                              5
                                              T1552

                                              Credentials In Files

                                              4
                                              T1552.001

                                              Credentials in Registry

                                              1
                                              T1552.002

                                              Discovery

                                              Peripheral Device Discovery

                                              2
                                              T1120

                                              Query Registry

                                              9
                                              T1012

                                              Remote System Discovery

                                              1
                                              T1018

                                              System Information Discovery

                                              7
                                              T1082

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              5
                                              T1005

                                              Command and Control

                                              Web Service

                                              1
                                              T1102

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\ProgramData\Are.docx
                                                Filesize

                                                11KB

                                                MD5

                                                a33e5b189842c5867f46566bdbf7a095

                                                SHA1

                                                e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                SHA256

                                                5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                SHA512

                                                f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                Download Submit

                                              • C:\ProgramData\mozglue.dll
                                                Filesize

                                                593KB

                                                MD5

                                                c8fd9be83bc728cc04beffafc2907fe9

                                                SHA1

                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                SHA256

                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                SHA512

                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                Download Submit

                                              • C:\ProgramData\nss3.dll
                                                Filesize

                                                2.0MB

                                                MD5

                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                SHA1

                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                SHA256

                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                SHA512

                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                Download Submit

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                Filesize

                                                1KB

                                                MD5

                                                68759899356942a8f2de235b5df5d2ca

                                                SHA1

                                                6c3d89162b386777e33b492501052db7870212c9

                                                SHA256

                                                fda9fa71efecd76a2cc5d20e6832ab850f86cab1cfaf39815ef50eaa867f10e4

                                                SHA512

                                                7b34262776106f136adba1d83a0e0186e32d46d7105790976d2085f11ba9e837fefaac94649465b1d852df311df3e1c11d005bd52103cf1315c2d4779d665dde

                                                Download Submit

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                Filesize

                                                724B

                                                MD5

                                                8202a1cd02e7d69597995cabbe881a12

                                                SHA1

                                                8858d9d934b7aa9330ee73de6c476acf19929ff6

                                                SHA256

                                                58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                                SHA512

                                                97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                                Download Submit

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                Filesize

                                                410B

                                                MD5

                                                e0dc436c2438470ab7e34d643e94a2ad

                                                SHA1

                                                19b1a0124dbf48e525736ad9b7655ffab2bd0580

                                                SHA256

                                                dd9b1ed4fc1e638dcc79a076bdb18b41a97fb2869c513edbf32ee55b3c8e8da2

                                                SHA512

                                                c9e7f1a7eac61a9233c95a2abee629363722eef8268aad77468343c62048f40a26e6d0b4bd6924282ca66206814cd9ed21bdb8639edc8ef1a2cebc06f45c6c71

                                                Download Submit

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                Filesize

                                                392B

                                                MD5

                                                d8ab3f90b2b9a55c446606e29e019db3

                                                SHA1

                                                ff39280584de412ab1acc129c367539630df54a8

                                                SHA256

                                                6e5d504fc5964e27940aecf33574c240da27dd11dcb57db42d7f83e419498ba0

                                                SHA512

                                                e0f33cfecb7198571c9dde328db9fc64422897cbd193f01f1506e348c324fdacef3771cf4224fe06d8b505b27bceb5d362dbb089eba7149dbaa460a1e714977a

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                Filesize

                                                3KB

                                                MD5

                                                a87844d5b61c42fc602f01070f37ec45

                                                SHA1

                                                415b87ba63f0d908bb804ba10d91a74e536ad9f3

                                                SHA256

                                                6a58c5abebd242398876f15234c7794b10fac5e79ac7ba1074b240a2acc30a81

                                                SHA512

                                                63541fd2ed677c03c11af0c2433ada1e97dd1da818a33fe4ed7b9b897679a01acc1c8385f34051cae3516f249cd4c85978d52450280f9a355a61bdcbf33e5eb9

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                1KB

                                                MD5

                                                6f3c4d0654a595cb447d9c680258467c

                                                SHA1

                                                6a1889cf6d1dd37b45e83f18a8c4ef592e800338

                                                SHA256

                                                6a430bfb0293fd8bd83efa3c6d260c71ab06eb346d63335de8f1f7d0e41eedf6

                                                SHA512

                                                de7da4c7ea2e317e069c581ed6b32ecd92b68fa47072ad7f47e8627b198ec9e5423de87acdd97502a680327d8a465199adbbbbcba3fc38ba11b5ce965d3fb57e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                Filesize

                                                1.9MB

                                                MD5

                                                3ea6ee6a82cb6f39f487ea4c1e623aa2

                                                SHA1

                                                1a9d7924ec93e0f9131284d4872c74596168c2cd

                                                SHA256

                                                c0d54d85b76b2605a960a7ba3d91542534f2a07f20b17ac58d01e0dc910f28b0

                                                SHA512

                                                064e02cbf4bce446f93a808f43b4d4fe721b9e609dcc8e72ced5aa1c908b94f30f967d830524646e4fd42238b98d96199e75cd076d2fdaf02d5096f5d3e9c76b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000022001\c5fca7a473.exe
                                                Filesize

                                                3.0MB

                                                MD5

                                                11901aa29f74ae89bb0810adf7d2808f

                                                SHA1

                                                fc044f40ab31c9430a29315c6911334fe9de5959

                                                SHA256

                                                22e5293a211722517cdafd32c27fe87b868459053f8215f1f2e6a58a1b259d42

                                                SHA512

                                                cc447a6a5ee34eb5366e0fac64a3ca1b57477f7732a2a467acbda7077fd5d7bc0a762f313efb623edf56c78918eac5a7cf760b86bdf9bb99f4a515369d19fe71

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
                                                Filesize

                                                413KB

                                                MD5

                                                d467222c3bd563cb72fa49302f80b079

                                                SHA1

                                                9335e2a36abb8309d8a2075faf78d66b968b2a91

                                                SHA256

                                                fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

                                                SHA512

                                                484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe
                                                Filesize

                                                350KB

                                                MD5

                                                04df085b57814d1a1accead4e153909e

                                                SHA1

                                                6d277da314ef185ba9072a9b677b599b1f46c35b

                                                SHA256

                                                91a36d137ebfa812b055728807e11338d15d3a5d869cb4babdf779266688e4dd

                                                SHA512

                                                f37678424e46e4f28e1047161db60ad737515558c8c8905ed598ca96b198304da7356e49e7bb9d1e77fe75372f0b5a7f670a353d093749c37bb85c40ec7fdafa

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                Filesize

                                                418KB

                                                MD5

                                                0099a99f5ffb3c3ae78af0084136fab3

                                                SHA1

                                                0205a065728a9ec1133e8a372b1e3864df776e8c

                                                SHA256

                                                919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                SHA512

                                                5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
                                                Filesize

                                                438KB

                                                MD5

                                                df5ffcb6bebfc2d41aa3d0b2147365ab

                                                SHA1

                                                4a62abaa991c279ccfd575eed2ae51891845105b

                                                SHA256

                                                147379ef2cb532720d43fa4df10894dbe8e487b418d91ae67a4255c824944f63

                                                SHA512

                                                ccf328f71ce4fd7ad18f87edafa2b2803738ceade007805d9160d02066b16c5d6e555cc0918919c2cc0192eb2aa0a4d116816fe9f0f10fcba5e1b5f50a412e5a

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                                                Filesize

                                                294KB

                                                MD5

                                                5700c54d51e14d0ce00bbbb6015baed2

                                                SHA1

                                                71eb9361a9d6b35317fc8a385b748a8a6ce3bee7

                                                SHA256

                                                583d73f0111e0aeed0a34fa4fc4ba85875a11f88ac93f9bacb59359aaf5b94e2

                                                SHA512

                                                9dddd66cf82aead6400a19e81ccd0ebc0f5e312bc5772937e1929820a1db0fb74cf1480ef3bb9e9c70aefa25ce02c8c7d9f1a17bff6eb2137d76247a61eb2b9d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                Filesize

                                                3.1MB

                                                MD5

                                                6c4dc842108f5b9aa27942ab0f61281d

                                                SHA1

                                                90f00f9722415dff5aeba74d4084eeccf9236d0c

                                                SHA256

                                                227eacc3d3ff800f8b779503ef42af0a956cd7d195681db3081ef2f5171cbd90

                                                SHA512

                                                91023f7488c6c9f4e941ee3530d833e37eb8a0ca2c9fc17c4789828c34fe39b821e4be7abe33d06f75f54cd80a7d4c97cda2f016e19b96df97a421ac561962a0

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                Filesize

                                                2.2MB

                                                MD5

                                                f6934c829d56a7d2dbb0150d2e99bbe7

                                                SHA1

                                                ab355eadfa7c813ae1940d4ccf1fe5ac10d5ff5f

                                                SHA256

                                                df57fce137ab66df817ce40d511695ceec446640c20db61cff25d87f22c46db5

                                                SHA512

                                                8584bab71718856c341d90126bfa80643e03b1216bf240b66d2c10650ea1c8cb93ad7fe8eb04a64dc1090e7564f352642e9f2bd9eae103431c324b05ce2c0f8d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                Filesize

                                                2.1MB

                                                MD5

                                                d98b1f0e205476ef7f1810050732ab83

                                                SHA1

                                                a756a48b85843ed4e5bf11cf211af2d8409bfb58

                                                SHA256

                                                1f9cb834ee5095f37eae7bda7bdd521772d4f7415030f2ebf1e88775fdf02b0e

                                                SHA512

                                                61d692492f139e325e78ff054e2a0a8faba552d73b79cb1af1b3b541575ef3118026a0302b0c9363d0f0f97da11ddbfb832b85e505949cae1c1f2a14b3411298

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000174001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                Filesize

                                                4.2MB

                                                MD5

                                                e926ae91ecbd102730b5d3a9967cb3e5

                                                SHA1

                                                42704a90ebb5cac4eb340ad7f1a153788ecca2aa

                                                SHA256

                                                e60ede5c74d07d9c334311256c5da96f69a4d943b994e7e8f8baed9510d8f9ab

                                                SHA512

                                                83a2587329aff50b894d0198efd1ba2bd64cc2f394b7c62162e0ed4ce8fc6bbb0dde99d32f3bac4e451b386754b6f3483d84b5db4b765ed19e5a0ccf6d8611b0

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\221A.exe
                                                Filesize

                                                792KB

                                                MD5

                                                fcf80695c75aa728b64f619c8cf35563

                                                SHA1

                                                d44e6cbd6a81e1c314b1ba20f1dae0cc0dabcc09

                                                SHA256

                                                3731bd47fa966e86a102a5a31981489c5cc933cad99d7a9889ea242be34c9ef2

                                                SHA512

                                                0a3fd6e988a24a63b8afa49ec69d7e3f7b5e1667e1458774564aa0d3e1396a68b3d79414e3ebd16120788ccf76a2560cd881b00317a2a0bc243015429444a113

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\2DD3.exe
                                                Filesize

                                                338KB

                                                MD5

                                                380fd37db71449a4a1855a0475c05edb

                                                SHA1

                                                f7e10aae523a86fb6c23a8fed9d042f9e82dc557

                                                SHA256

                                                8964c329759b76bef968db9126bf2052f334baaf6e4cbcde52371ffc66b45187

                                                SHA512

                                                7a6ebc422c616f989093663f06bca79da046cc8b4872074507e55e7385852ecb0b788d6372bb16fa2d2879da659f84cf1f4124f4e0af6d0245c7c20bb333c11b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\BF2.bat
                                                Filesize

                                                77B

                                                MD5

                                                55cc761bf3429324e5a0095cab002113

                                                SHA1

                                                2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                SHA256

                                                d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                SHA512

                                                33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\HIDAKFIJJK.exe
                                                Filesize

                                                106KB

                                                MD5

                                                fe380780b5c35bd6d54541791151c2be

                                                SHA1

                                                7fe3a583cf91474c733f85cebf3c857682e269e1

                                                SHA256

                                                b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                SHA512

                                                ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\Tmp3004.tmp
                                                Filesize

                                                2KB

                                                MD5

                                                1420d30f964eac2c85b2ccfe968eebce

                                                SHA1

                                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                SHA256

                                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                SHA512

                                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ai2vqqz2.tug.ps1
                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                Filesize

                                                281KB

                                                MD5

                                                d98e33b66343e7c96158444127a117f6

                                                SHA1

                                                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                SHA256

                                                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                SHA512

                                                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\u3h4.0.exe
                                                Filesize

                                                293KB

                                                MD5

                                                c5fbb7afce818b6a475e5edab0747d40

                                                SHA1

                                                8efda8e4a13ee16ba217800cb29494cf1d69b69f

                                                SHA256

                                                bacb5466ff61287c30d4a58221c8e4e41d455f3449829f8ad1dc5964ad6bd843

                                                SHA512

                                                392776537bee1e5941440d5de40b6d3d093cb48f7a41092379d7d6921ad11a5f54745975cf45c55905b5fbe469f21c624003f70517d21025f5d64b078d45555f

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\u3h4.1.exe
                                                Filesize

                                                1.7MB

                                                MD5

                                                eee5ddcffbed16222cac0a1b4e2e466e

                                                SHA1

                                                28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                                                SHA256

                                                2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                                                SHA512

                                                8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                Filesize

                                                128B

                                                MD5

                                                11bb3db51f701d4e42d3287f71a6a43e

                                                SHA1

                                                63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                SHA256

                                                6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                SHA512

                                                907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                Filesize

                                                109KB

                                                MD5

                                                726cd06231883a159ec1ce28dd538699

                                                SHA1

                                                404897e6a133d255ad5a9c26ac6414d7134285a2

                                                SHA256

                                                12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                SHA512

                                                9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                Filesize

                                                1.2MB

                                                MD5

                                                15a42d3e4579da615a384c717ab2109b

                                                SHA1

                                                22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                SHA256

                                                3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                SHA512

                                                1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                                Filesize

                                                109KB

                                                MD5

                                                154c3f1334dd435f562672f2664fea6b

                                                SHA1

                                                51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                SHA256

                                                5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                SHA512

                                                1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                Filesize

                                                1024KB

                                                MD5

                                                db38f39e4d792b9817c08f85e4546fb6

                                                SHA1

                                                b60d570c89c84b4bf953fb872b9cff04b0fbbe97

                                                SHA256

                                                ad364a68f7b238e1984ee2c48994be7736ea18b76908f3bfbbcbfed58e5ca8a1

                                                SHA512

                                                06109c337e373edf38483f60ae20b9dbc99361e91231f1b7e77ae400ddec62d7f09b25e85d4d19f7a8b5e987780f9e4d57fa3c08fb38f55920e8514874cfb132

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                Filesize

                                                350KB

                                                MD5

                                                d8006e6ec8c5b4ca80369f1f26ecb9fa

                                                SHA1

                                                7be1c58ce1af29f2d465682c1e1fd5dd1cb5d1f3

                                                SHA256

                                                29ecde71ce981df775b5b3b3231912eb469537edc8ce13fca756d580ca50583f

                                                SHA512

                                                a80303791cf73b6fd1fbacac30ef9e3830015d433506de8e74a8eb6f98e0020dc405ac9356fdaa124435ed056f578350bc404b9ef72fa8f03263d872fe35b188

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                Filesize

                                                384KB

                                                MD5

                                                9cce7b0ac41077ae7fc054e113819946

                                                SHA1

                                                60d66cbd123d3c0bdfeb034c9a0a7ddcd146185d

                                                SHA256

                                                105ddff039ec6ae0537bf3808f0ed3b4a1c12feec8e3ce189ab9fe741466ff6a

                                                SHA512

                                                22b3331a7ce34e79df02999f760ad968d9042013509a52a68ba70891a7649ef3737c2d863f5a28fa993b4ff4d5b79e8aa9ce7658e768befdc9af5df686313f23

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                Filesize

                                                317KB

                                                MD5

                                                3d4af48cbdfcdb2e26dd19d2b40281fd

                                                SHA1

                                                c55d1413aa5edc6eb282dca7c1e44d08a7d0e864

                                                SHA256

                                                30f32b9e39c9b0f2e85b1a42cdba1ced8c9b5cc52d4e70b7f4e1deb23665651c

                                                SHA512

                                                1c3e4373299c6376873b929a57eaceb56f6d21442ddf96e205f1583e9b337ec940cfeb8cbfced56595ae3e4c3f791f2a50fb1a42a08661d9974aa83640b69e1f

                                                Download Submit

                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                Filesize

                                                2KB

                                                MD5

                                                ac4917a885cf6050b1a483e4bc4d2ea5

                                                SHA1

                                                b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

                                                SHA256

                                                e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

                                                SHA512

                                                092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

                                                Download Submit

                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                c12d4591578b5589b59bc82040a0186a

                                                SHA1

                                                897a5258fc622b1733d9d7e10d742de91938f318

                                                SHA256

                                                49d9a439920ce27488f4c40a9a52c5764f02a0e5f8a80f1dc47954633518ad32

                                                SHA512

                                                8013c014571a3bafee30dcfa7c3afdb5ae659eb517048209a85080b22ca4500ab7cd6a1b771439bb61d7363a2ca45736da9db8dc80132ae3282ad2178d7e505a

                                                Download Submit

                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                6ec4bd8194ab9ba0eff57ba69b2bed60

                                                SHA1

                                                fbcfe7d11b3e509e9d9ad936d7d695a3d126706e

                                                SHA256

                                                3ebd437eb50a4c6cd661e3c0efe5b1ea8c07ae92ffa60b9a7d832bbafbd4e990

                                                SHA512

                                                6ab3eae6df4dd8e40652b7b852fe36b1a141b53e05f850b2c1c62330bfd79d7541a53538194e372aeb67e762c2deb88934205aeabafa74f33cfbbb8ef29ed45a

                                                Download Submit

                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                a01ddadc6f02e52aa4b311674b147408

                                                SHA1

                                                7e357d54d9946b88e5ee80d35b1276431ac2f0ea

                                                SHA256

                                                36c572839066c2471ae354991f9c8eca5b5c1c2323b2a7ed484fe3a9abfb8714

                                                SHA512

                                                bcf398ef31bf8b6ce774e5870d9883bed4ca5810a3f3cd4d072b13a94d4671f53baa65345a9394f68ce3caef7e48607203d03db4f2cec770dd1a5fa8d53cf2f8

                                                Download Submit

                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                72dee0eb6e4fafac497039d7668d70ca

                                                SHA1

                                                3a291750238caa9cb7faa2dbb8ce6ffb204a3270

                                                SHA256

                                                f4a5ac1599a6a472307770a4cd58f5a45469f1b815a55ae317b5856b1b7c929a

                                                SHA512

                                                9fd626c4efba6cd16b9345b745954bbf76832c9a6954db53b981daf390452fa0d851bc9bfb81d275a275ed9b04579670ba050d7fb621b7000038c1df3e092697

                                                Download Submit

                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                5077fd817e93d7c08086aa964a08702a

                                                SHA1

                                                7cc1f1877bc2b3832e07879f18f023f5e46c4378

                                                SHA256

                                                7815afb8831351b65f25131d1147eb4f7f39ad1a9e361dd07d36bcfd093b10d2

                                                SHA512

                                                c87db70e99e2d2db2759d59998856f27025d782c73be0e27cf2f556281d406b479980ad6a5ea189cad963b31b23ac9b5a178c5d60bfc5e1907108f6f861259aa

                                                Download Submit

                                              • C:\Windows\rss\csrss.exe
                                                Filesize

                                                896KB

                                                MD5

                                                2168dae2b36256c9c023186ae51c1bd8

                                                SHA1

                                                73b05fa03ab731e830767e922d99db466f88139c

                                                SHA256

                                                fcbd3ff7012bd150209dc62bd63a0b5fcb8e9a478d44b008940c7ad3b92cdfca

                                                SHA512

                                                c8fc5e21d241fef85c790e2da5cc9ed141dbf7320945aca17a39d4142edb2a1f1086eafa63e5b53fafdc6b401944df85919e4e64f6174552bae5888c4692aa4c

                                                Download Submit

                                              • memory/248-297-0x0000000000B80000-0x0000000000C80000-memory.dmp

                                                Filesize

                                                1024KB

                                                Download

                                              • memory/248-298-0x0000000002800000-0x0000000002827000-memory.dmp

                                                Filesize

                                                156KB

                                                Download

                                              • memory/248-299-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                Filesize

                                                6.9MB

                                                Download

                                              • memory/248-375-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                Filesize

                                                972KB

                                                Download

                                              • memory/976-356-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                Filesize

                                                6.9MB

                                                Download

                                              • memory/976-277-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

                                                Filesize

                                                44KB

                                                Download

                                              • memory/976-276-0x0000000000D00000-0x0000000000E00000-memory.dmp

                                                Filesize

                                                1024KB

                                                Download

                                              • memory/976-278-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                Filesize

                                                6.9MB

                                                Download

                                              • memory/1444-317-0x0000000002C60000-0x000000000305B000-memory.dmp

                                                Filesize

                                                4.0MB

                                                Download

                                              • memory/2088-8-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2088-5-0x0000000005380000-0x0000000005381000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2088-1-0x0000000077E66000-0x0000000077E68000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/2088-9-0x0000000005390000-0x0000000005391000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2088-2-0x00000000008A0000-0x0000000000D7D000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/2088-7-0x0000000005330000-0x0000000005331000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2088-4-0x0000000005340000-0x0000000005341000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2088-3-0x0000000005350000-0x0000000005351000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2088-0-0x00000000008A0000-0x0000000000D7D000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/2088-21-0x00000000008A0000-0x0000000000D7D000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/2088-6-0x0000000005320000-0x0000000005321000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2312-76-0x000001B42C2B0000-0x000001B42C2D2000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/2312-77-0x00007FFF99BA0000-0x00007FFF9A662000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/2312-78-0x000001B413FB0000-0x000001B413FC0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2312-88-0x00007FFF99BA0000-0x00007FFF9A662000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/2312-82-0x000001B42C540000-0x000001B42C54A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/2312-79-0x000001B413FB0000-0x000001B413FC0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2312-81-0x000001B42C560000-0x000001B42C572000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2368-90-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-95-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-94-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-93-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/2368-96-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-97-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-98-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-99-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-100-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-101-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-103-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-102-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-104-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-105-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-138-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-137-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-106-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-107-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-108-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-109-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-110-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-111-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-112-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-114-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-129-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-128-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-113-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-115-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-125-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-116-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-257-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-126-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2368-127-0x0000000000400000-0x000000000091D000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/2596-253-0x0000000000340000-0x00000000006F6000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/2596-51-0x0000000000340000-0x00000000006F6000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/2596-52-0x0000000000340000-0x00000000006F6000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/2596-89-0x0000000000340000-0x00000000006F6000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/2596-148-0x0000000000340000-0x00000000006F6000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/2808-211-0x0000000000400000-0x000000000044A000-memory.dmp

                                                Filesize

                                                296KB

                                                Download

                                              • memory/2808-214-0x0000000000400000-0x000000000044A000-memory.dmp

                                                Filesize

                                                296KB

                                                Download

                                              • memory/2808-218-0x00000000010D0000-0x00000000010D1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2808-279-0x0000000000400000-0x000000000044A000-memory.dmp

                                                Filesize

                                                296KB

                                                Download

                                              • memory/2808-219-0x0000000000400000-0x000000000044A000-memory.dmp

                                                Filesize

                                                296KB

                                                Download

                                              • memory/3040-26-0x0000000005310000-0x0000000005311000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-27-0x0000000005360000-0x0000000005361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-275-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3040-32-0x0000000005370000-0x0000000005371000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-25-0x0000000005330000-0x0000000005331000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-28-0x00000000052F0000-0x00000000052F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-22-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3040-31-0x0000000005380000-0x0000000005381000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-53-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3040-67-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3040-80-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3040-24-0x0000000005320000-0x0000000005321000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-30-0x0000000005350000-0x0000000005351000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-29-0x0000000005300000-0x0000000005301000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3040-146-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3040-23-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3100-149-0x00000000053E0000-0x00000000053E1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3100-176-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3100-151-0x0000000005410000-0x0000000005411000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3100-155-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3100-147-0x0000000000ED0000-0x00000000013AD000-memory.dmp

                                                Filesize

                                                4.9MB

                                                Download

                                              • memory/3100-150-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3100-154-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3100-153-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3100-152-0x00000000053B0000-0x00000000053B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3136-177-0x00000000004C0000-0x0000000000876000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/3136-362-0x00000000004C0000-0x0000000000876000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/3136-318-0x00000000004C0000-0x0000000000876000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/3136-175-0x00000000004C0000-0x0000000000876000-memory.dmp

                                                Filesize

                                                3.7MB

                                                Download

                                              • memory/3184-354-0x0000000000C90000-0x0000000000CA6000-memory.dmp

                                                Filesize

                                                88KB

                                                Download

                                              • memory/3772-217-0x0000000002A90000-0x0000000004A90000-memory.dmp

                                                Filesize

                                                32.0MB

                                                Download

                                              • memory/3772-207-0x00000000005B0000-0x000000000060E000-memory.dmp

                                                Filesize

                                                376KB

                                                Download

                                              • memory/3772-208-0x00000000732B0000-0x0000000073A61000-memory.dmp

                                                Filesize

                                                7.7MB

                                                Download

                                              • memory/3772-216-0x00000000732B0000-0x0000000073A61000-memory.dmp

                                                Filesize

                                                7.7MB

                                                Download

                                              • memory/4504-256-0x0000000000400000-0x0000000000B16000-memory.dmp

                                                Filesize

                                                7.1MB

                                                Download

                                              • memory/4504-255-0x0000000002840000-0x00000000028AE000-memory.dmp

                                                Filesize

                                                440KB

                                                Download

                                              • memory/4504-254-0x0000000000D60000-0x0000000000E60000-memory.dmp

                                                Filesize

                                                1024KB

                                                Download

                                              • memory/4504-352-0x0000000000400000-0x0000000000B16000-memory.dmp

                                                Filesize

                                                7.1MB

                                                Download