Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

09-04-2024 07:01

240409-htps3scd2w 10

09-04-2024 07:01

240409-htf6yacc9x 10

09-04-2024 07:00

240409-hs6p7scc81 10

09-04-2024 07:00

240409-hss44scc7z 10

07-03-2024 22:29

240307-2eh7jagg41 10

Analysis

  • max time kernel
    1799s
  • max time network
    1801s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-04-2024 07:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
asyncratmetasploitredlineriseprosocks5systemzstealcxwormzgrat6077866846backdoorbotnetdiscoveryevasioninfostealerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

C2

91.92.247.21:8405

Extracted

Family

xworm

C2

94.156.8.213:58002

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Extracted

Family

socks5systemz

C2

http://bobzrji.com/search/?q=67e28dd8645fa72f495daa1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffd17c4e6959d3c

http://bobzrji.com/search/?q=67e28dd8645fa72f495daa1c7c27d78406abdd88be4b12eab517aa5c96bd86ee928e4b815a8bbc896c58e713bc90c91836b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee979c3fc46f9111

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 32 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 59 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      PID:3656
    • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
      "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Users\Admin\AppData\Local\Temp\zMsQmlSM.exe
        "C:\Users\Admin\AppData\Local\Temp\zMsQmlSM.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:352
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:4156
    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:784
    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3860
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2228
    • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
      "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionExtension .exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4404
    • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
      2⤵
      • Executes dropped EXE
      PID:2992
    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2808
    • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
      2⤵
      • Executes dropped EXE
      PID:5020
    • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe
        "C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe"
        3⤵
        • Executes dropped EXE
        PID:784
    • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
      2⤵
      • Executes dropped EXE
      PID:4232
    • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
      2⤵
      • Executes dropped EXE
      PID:4736
    • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Users\Admin\AppData\Local\Temp\uvk.0.exe
        "C:\Users\Admin\AppData\Local\Temp\uvk.0.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4212
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe"
          4⤵
            PID:5204
            • C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe
              "C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe"
              5⤵
              • Executes dropped EXE
              PID:1572
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe
                6⤵
                  PID:5612
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    7⤵
                      PID:4212
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 2.2.2.2 -n 1 -w 3000
                      7⤵
                      • Runs ping.exe
                      PID:4044
            • C:\Users\Admin\AppData\Local\Temp\uvk.1.exe
              "C:\Users\Admin\AppData\Local\Temp\uvk.1.exe"
              3⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2008
              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5700
          • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
            "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2240
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1364
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
              3⤵
                PID:4940
            • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
              "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4704
            • C:\Users\Admin\AppData\Local\Temp\a\555.exe
              "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
              2⤵
              • Executes dropped EXE
              PID:3372
            • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
              "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2904
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5876
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5920
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp297C.tmp"
                3⤵
                • Creates scheduled task(s)
                PID:5936
              • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
                3⤵
                • Executes dropped EXE
                PID:5816
              • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
                3⤵
                • Executes dropped EXE
                PID:5644
              • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
                3⤵
                • Executes dropped EXE
                PID:5896
              • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5928
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
                  4⤵
                    PID:4204
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'
                      5⤵
                      • Creates scheduled task(s)
                      PID:5420
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp65CA.tmp.bat""
                    4⤵
                      PID:5532
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 3
                        5⤵
                        • Delays execution with timeout.exe
                        PID:5596
                      • C:\Users\Admin\AppData\Roaming\msdtc.exe
                        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4704
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                          6⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4208
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
                          6⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4200
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF22B.tmp"
                          6⤵
                          • Creates scheduled task(s)
                          PID:5104
                        • C:\Users\Admin\AppData\Roaming\msdtc.exe
                          "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                          6⤵
                          • Executes dropped EXE
                          PID:1328
                        • C:\Users\Admin\AppData\Roaming\msdtc.exe
                          "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5572
                • C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3720
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                    "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:400
                • C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:816
                • C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:4440
                • C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3344
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    3⤵
                    • Modifies system certificate store
                    PID:3572
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 764
                    3⤵
                    • Program crash
                    PID:704
                • C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4556
                • C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"
                  2⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  PID:1120
                • C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4284
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    3⤵
                      PID:5180
                      • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                        "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5744
                      • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                        "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5768
                  • C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
                    "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:3492
                  • C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
                    "C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:4504
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
                      3⤵
                        PID:5072
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 2.2.2.2 -n 1 -w 3000
                          4⤵
                          • Runs ping.exe
                          PID:5196
                    • C:\Users\Admin\AppData\Local\Temp\a\new1.exe
                      "C:\Users\Admin\AppData\Local\Temp\a\new1.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:864
                    • C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe
                      "C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4092
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        3⤵
                          PID:5540
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          3⤵
                            PID:5564
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                            • Loads dropped DLL
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5584
                        • C:\Users\Admin\AppData\Local\Temp\a\razdva.exe
                          "C:\Users\Admin\AppData\Local\Temp\a\razdva.exe"
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:5316
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 764
                            3⤵
                            • Program crash
                            PID:6068
                        • C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe
                          "C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:5428
                          • C:\Users\Admin\AppData\Local\Temp\u46s.0.exe
                            "C:\Users\Admin\AppData\Local\Temp\u46s.0.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:5632
                          • C:\Users\Admin\AppData\Local\Temp\u46s.1.exe
                            "C:\Users\Admin\AppData\Local\Temp\u46s.1.exe"
                            3⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:4088
                        • C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe
                          "C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe"
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1216
                          • C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
                            "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6004
                        • C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe
                          "C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:5684
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                              PID:2384
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              3⤵
                                PID:5152
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 764
                                3⤵
                                • Program crash
                                PID:1216
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                3⤵
                                  PID:5368
                              • C:\Users\Admin\AppData\Local\Temp\a\june.exe
                                "C:\Users\Admin\AppData\Local\Temp\a\june.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:6132
                                • C:\Users\Admin\AppData\Local\Temp\is-PVKLK.tmp\june.tmp
                                  "C:\Users\Admin\AppData\Local\Temp\is-PVKLK.tmp\june.tmp" /SL5="$302D6,3525916,54272,C:\Users\Admin\AppData\Local\Temp\a\june.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5468
                                  • C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe
                                    "C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe" -i
                                    4⤵
                                    • Executes dropped EXE
                                    PID:5256
                                  • C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe
                                    "C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe" -s
                                    4⤵
                                    • Executes dropped EXE
                                    PID:5668
                              • C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe
                                "C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:5960
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  3⤵
                                    PID:1876
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 764
                                    3⤵
                                    • Program crash
                                    PID:2416
                              • \??\c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                1⤵
                                  PID:2304
                                • C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
                                  "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5764
                                  • C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
                                    "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Enumerates connected drives
                                    • Checks processor information in registry
                                    • Modifies data under HKEY_USERS
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6084
                                • C:\Windows\system32\DllHost.exe
                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                  1⤵
                                    PID:1572
                                  • C:\Windows\system32\DllHost.exe
                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                    1⤵
                                      PID:5596
                                    • C:\Windows\system32\vssvc.exe
                                      C:\Windows\system32\vssvc.exe
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5620
                                    • C:\Windows\svchost.exe
                                      C:\Windows\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3060

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Defense Evasion

                                    Modify Registry

                                    2
                                    T1112

                                    Subvert Trust Controls

                                    1
                                    T1553

                                    Install Root Certificate

                                    1
                                    T1553.004

                                    Virtualization/Sandbox Evasion

                                    1
                                    T1497

                                    Credential Access

                                    Unsecured Credentials

                                    3
                                    T1552

                                    Credentials In Files

                                    3
                                    T1552.001

                                    Discovery

                                    Peripheral Device Discovery

                                    2
                                    T1120

                                    Query Registry

                                    7
                                    T1012

                                    Remote System Discovery

                                    1
                                    T1018

                                    System Information Discovery

                                    6
                                    T1082

                                    Virtualization/Sandbox Evasion

                                    1
                                    T1497

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    3
                                    T1005

                                    Command and Control

                                    Web Service

                                    1
                                    T1102

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
                                      Filesize

                                      444KB

                                      MD5

                                      2d2ca48b8c09de0645b7fd0223c922f0

                                      SHA1

                                      de1f948065d612cd649564e466e362198f8ce3e6

                                      SHA256

                                      72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206

                                      SHA512

                                      452f545f1f4d834a2cd92910fe5caa8c0f2ffdbaf2b3a0370c17f953422d37c13e10212219cae04fad93d07e81f370010a1951b29f2e83f78694ed68637d27bb

                                      Download Submit

                                    • C:\ProgramData\Are.docx
                                      Filesize

                                      11KB

                                      MD5

                                      a33e5b189842c5867f46566bdbf7a095

                                      SHA1

                                      e1c06359f6a76da90d19e8fd95e79c832edb3196

                                      SHA256

                                      5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                      SHA512

                                      f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                      Download Submit

                                    • C:\ProgramData\BAECFCAA
                                      Filesize

                                      92KB

                                      MD5

                                      cae9079afcb4c379869afa5d34181d8a

                                      SHA1

                                      188e2435c533dd9633f5fcc09f245ddc1a78db2c

                                      SHA256

                                      2be0a96da90da69fbc34b8e7747e89ce57dfc4fb58ed6c79e0fc21cb7c6791b7

                                      SHA512

                                      ff7d863ebd1090219f07eaf2ac493f20b6ed11606e7f2c19536d764e730a8bb426fff26dc3890f0503c12329ea4a6c5d8812a0d1b69c19a29fbb8cb8366bd4fd

                                      Download Submit

                                    • C:\ProgramData\MediaDevicePicker 3.0.194.66\MediaDevicePicker 3.0.194.66.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      c5bfeddc9eca9cb53ed7fe60814fd1b1

                                      SHA1

                                      938470d19961f85e4cdac7541411a08b264d29ae

                                      SHA256

                                      ce38cf464433dd7c4ea1d6823d3d6561552ce07996ef8da0b295447871504767

                                      SHA512

                                      4a8001a6ba0e8874d787c8816b7a38f0c1b4a988294398e1e4e291cca1cb79168c04bf12174ce553e56d62fbe0901d982875229bef4e70b960b66d0178791192

                                      Download Submit

                                    • C:\ProgramData\mozglue.dll
                                      Filesize

                                      593KB

                                      MD5

                                      c8fd9be83bc728cc04beffafc2907fe9

                                      SHA1

                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                      SHA256

                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                      SHA512

                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
                                      Filesize

                                      6KB

                                      MD5

                                      f7930c4859ccd34bd2b80a9995f49926

                                      SHA1

                                      8b5b95fb51619e20246f90d60f2137da7654fc5e

                                      SHA256

                                      163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

                                      SHA512

                                      8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\TmpF656.tmp
                                      Filesize

                                      2KB

                                      MD5

                                      1420d30f964eac2c85b2ccfe968eebce

                                      SHA1

                                      bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                      SHA256

                                      f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                      SHA512

                                      6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xjyntqow.2p3.ps1
                                      Filesize

                                      1B

                                      MD5

                                      c4ca4238a0b923820dcc509a6f75849b

                                      SHA1

                                      356a192b7913b04c54574d18c28d46e6395428ab

                                      SHA256

                                      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                      SHA512

                                      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                                      Filesize

                                      2.8MB

                                      MD5

                                      e670bdc7c82eee75a6d3ada6a7c9134e

                                      SHA1

                                      b0f0bab6f6e92bc86e86fd7bff93c257a4235859

                                      SHA256

                                      a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

                                      SHA512

                                      7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      5e13199a94cf8664e5bfbe2f68d4738e

                                      SHA1

                                      8cfaa21f68226ae775615f033507b5756f5ccacc

                                      SHA256

                                      71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

                                      SHA512

                                      b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\555.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      7162024dc024bb3311ee1cf81f37a791

                                      SHA1

                                      be03705f33a8205f90330814f525e2e53dfb5871

                                      SHA256

                                      3e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd

                                      SHA512

                                      94652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
                                      Filesize

                                      334KB

                                      MD5

                                      cd77e00b04bc4ad0ccb96a7819c9dda8

                                      SHA1

                                      f41f6ccb7a4117f8b646940caf501c2d8904e336

                                      SHA256

                                      3a14bf440814f53b7260a37dcc2a422f6a3859cfada26a143496be81e41f0706

                                      SHA512

                                      9f06c96fa6c8cd4b7adc50b7915b4cbb4e171f1180ecf0e56d31890dade54983bf1c014badb6f26ffd708dfd2a566659a2deefa0bc05280b2914c521575281a1

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                                      Filesize

                                      492KB

                                      MD5

                                      0eec3b50636ae6d37613e6a2c7617191

                                      SHA1

                                      630d5e3b88215d88432db42d2bd295c6d4b55ee8

                                      SHA256

                                      32dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05

                                      SHA512

                                      9a2088cce7ed6da8e2f13f2486925e7565b50a6c527363f0da19ff28910314fb9723496dfe3ddf0a977d1b0c8ff1661f0ae6bc3789332534ad0bea3cbafbdc12

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
                                      Filesize

                                      413KB

                                      MD5

                                      d388d6918f1e8a6a3b34ad993d8159eb

                                      SHA1

                                      cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

                                      SHA256

                                      27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

                                      SHA512

                                      54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
                                      Filesize

                                      413KB

                                      MD5

                                      94e9960a45131af61e599acee54d21d6

                                      SHA1

                                      39b03e050337d4eb127ae5ff5f0868e986bec7ad

                                      SHA256

                                      7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

                                      SHA512

                                      179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
                                      Filesize

                                      106KB

                                      MD5

                                      fe380780b5c35bd6d54541791151c2be

                                      SHA1

                                      7fe3a583cf91474c733f85cebf3c857682e269e1

                                      SHA256

                                      b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                      SHA512

                                      ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
                                      Filesize

                                      12KB

                                      MD5

                                      282c1ebb16ad0edc41389d1e73a74607

                                      SHA1

                                      fbcdda121484ea6125827ed4e7b1b00f6a88835d

                                      SHA256

                                      7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

                                      SHA512

                                      94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
                                      Filesize

                                      611KB

                                      MD5

                                      dbdcbacbc74b139d914747690ebe0e1c

                                      SHA1

                                      a43a5232d84e4f40e2103aa43ab4a98ce2495369

                                      SHA256

                                      54fbd0b6c760f3f0892bd7fabeb6bbad9444a013a024e8a22813c0c0a77d6c18

                                      SHA512

                                      74cfc6270d88c13ba030dfd5c3312920cd1bf0f3fa61ceb27d6a9ec64c1855f72a0f9f5eb14ab781eb7a1dab31effc5c49c1ac1cab395da143ba883e6d46a2d1

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
                                      Filesize

                                      7KB

                                      MD5

                                      9c938f91a0530150a2b1c4546334570c

                                      SHA1

                                      f4ae9acba920744457739fef0205f86443dbdf65

                                      SHA256

                                      35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

                                      SHA512

                                      f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
                                      Filesize

                                      5.5MB

                                      MD5

                                      3841b1904cbd678b426fe81a60c27f92

                                      SHA1

                                      ad052c09da16ebee48a97ca57417d49856a0743a

                                      SHA256

                                      e7d0715cf26299410027ceb06f4825efc011acc32897bb59a1b8b94f3fd7645a

                                      SHA512

                                      76e34b825e0c5727a8033f4b04592dd0f21980915b23e83efdd0a8e4fdbef16d6bcbfabf99cdbd09233822e276b94dfe7a87242d3579fe89a5ce51a0985cc01f

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
                                      Filesize

                                      267KB

                                      MD5

                                      0803c1aec008e75859877844cfa81492

                                      SHA1

                                      16924d5802ddf76a2096fcfade0ce06d4c0670bd

                                      SHA256

                                      d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

                                      SHA512

                                      9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
                                      Filesize

                                      1.7MB

                                      MD5

                                      85a15f080b09acace350ab30460c8996

                                      SHA1

                                      3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                      SHA256

                                      3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                      SHA512

                                      ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
                                      Filesize

                                      524KB

                                      MD5

                                      c8edf453ed433cefb2696bb859e0f782

                                      SHA1

                                      e34cf939d6c5a34c7bedfd885249bb7fb15336e5

                                      SHA256

                                      0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

                                      SHA512

                                      61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
                                      Filesize

                                      294KB

                                      MD5

                                      10fc8b2915c43aa16b6a2e2b4529adc5

                                      SHA1

                                      0c15286457963eb86d61d83642870a3473ef38fe

                                      SHA256

                                      feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

                                      SHA512

                                      421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
                                      Filesize

                                      2.3MB

                                      MD5

                                      262a7eb58a01d1aab21b24292c181cd3

                                      SHA1

                                      535312b7048fb90be981e04ea759c5ad8aaf6eda

                                      SHA256

                                      107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

                                      SHA512

                                      358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
                                      Filesize

                                      7.7MB

                                      MD5

                                      7aca152e7040f43dae201cfe01ce37b4

                                      SHA1

                                      83eb2fa2d400f96b241e61f81e4d80317eea0200

                                      SHA256

                                      ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

                                      SHA512

                                      84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
                                      Filesize

                                      1.1MB

                                      MD5

                                      b915133065e8c357f8b37e28015088fe

                                      SHA1

                                      61286d2adea00cab97ade25d5221d7cfc36a580b

                                      SHA256

                                      3d79bf5d780b6770babf2f2cba5549a01992d4e77f797292e2f4a3ecd668379c

                                      SHA512

                                      69e6b492e3b36e55fd64608067d3b7329adb8890fd712e64b845943c5902ef1c983a388bfbfdeff646bc4ddab94c308b26de3b7c04ceea2bed52fc11acf759fc

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
                                      Filesize

                                      157KB

                                      MD5

                                      5790d1417f8f00bd7ec6fb7011c79d9c

                                      SHA1

                                      36076ed9457c45d94e664ea291eb01e5c70d084b

                                      SHA256

                                      ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

                                      SHA512

                                      b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
                                      Filesize

                                      1.1MB

                                      MD5

                                      cb4c21ab082d4acc4712089f4cd517b8

                                      SHA1

                                      7d46bc7ad10c7fba5c9fa982eb19b96f9278d5d5

                                      SHA256

                                      e72f17d6111a1a7b814f0b10a708b7e5edadb990f19b6dc95014b65a8dd2d144

                                      SHA512

                                      52fb1180b986342705f36d81901887f1f05dabd058cd37e056044e6a5334551aaa5607599fe56952f86fb30696ed2b227ba94df081b7583848dd6946660709a2

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                                      Filesize

                                      66KB

                                      MD5

                                      00135a86ab829fc2d4678179d7a6e70f

                                      SHA1

                                      ef75c259865d7685d566b6e25b7a20d134952555

                                      SHA256

                                      0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

                                      SHA512

                                      011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      5347852b24409aed42423f0118637f03

                                      SHA1

                                      6c7947428231ab857ee8c9dab7a7e62fdeed024b

                                      SHA256

                                      a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

                                      SHA512

                                      0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
                                      Filesize

                                      1.3MB

                                      MD5

                                      ddee86f4db0d3b8010110445b0545526

                                      SHA1

                                      b41380b50d17dd679f85a224771398b81966bb9e

                                      SHA256

                                      0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

                                      SHA512

                                      4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
                                      Filesize

                                      13KB

                                      MD5

                                      0c550ce9bb3efa8c3ce80a507cadfffa

                                      SHA1

                                      6559cb9db9c13147da5139cc3b8d9c60b914b667

                                      SHA256

                                      0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912

                                      SHA512

                                      c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                      Filesize

                                      3KB

                                      MD5

                                      67fa4e376e71c3995af225697e85dba3

                                      SHA1

                                      6b21f05dc9aeaf044ff120fdf787e9f832a80aef

                                      SHA256

                                      b0317a573cb8d1bae4ba7304f80bd06a5da58276358ef02124ee2232578cfff5

                                      SHA512

                                      85ed36acf69c836da70613eeb34b73992a00cd78553c84e0b303293f2f7c68a2d63fc76f7bf6fc82b8843fb845174a089d6691164d35c2f6d648c18d237fa758

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                      Filesize

                                      2KB

                                      MD5

                                      0bedc93523a80c8772f2bdbc1fc6a65b

                                      SHA1

                                      79d3498e1711884acce546c3a894c96a3f31be77

                                      SHA256

                                      b6ad22d0fe6447fe42207241516841ac26c9a8be755baac4267f4d0c4480b2ee

                                      SHA512

                                      59d52cc478016e07e603c9b99210a357b72df0af223206f06b06b32fb163d0344c6be17198ac6820f6ae0a782d5fe95601f72acda21b9e5452a0ffcf36f4f8c2

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                      Filesize

                                      2KB

                                      MD5

                                      c6d843c694e8b162efc4647ba98f5943

                                      SHA1

                                      579c3790f6047db5e978713e8ae8a7b7c03870fe

                                      SHA256

                                      580ac539163dd7b1e33ecb20ed3f686735974b2690a4ba23f3dc5224cc033021

                                      SHA512

                                      abf8ec6927aeb4be368200fa2911c2ea19e85cd0f1d53dc5cad300c38d59d425b34ea2bf0c7f7a3ac168c064cbdbed2b920666be1ff275ce023a4c480c91597b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe
                                      Filesize

                                      271KB

                                      MD5

                                      b95747cad90e982d44da8fd74f50b9a6

                                      SHA1

                                      d7f267d2042f6b67f63542395ff6a5a1b3ba1250

                                      SHA256

                                      7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

                                      SHA512

                                      615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\uvk.1.exe
                                      Filesize

                                      4.6MB

                                      MD5

                                      397926927bca55be4a77839b1c44de6e

                                      SHA1

                                      e10f3434ef3021c399dbba047832f02b3c898dbd

                                      SHA256

                                      4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                      SHA512

                                      cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\zMsQmlSM.exe
                                      Filesize

                                      5KB

                                      MD5

                                      6a2c09749219d577535d0338c6cffe06

                                      SHA1

                                      576b00c03455a518664308c976097097f691bca4

                                      SHA256

                                      75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c

                                      SHA512

                                      cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-873560699-1074803302-2326074425-1000\685ee829b687ded4bbb145a391a94ee5_9251837d-e9a5-4229-9a78-b1085d98b1bb
                                      Filesize

                                      2KB

                                      MD5

                                      0158fe9cead91d1b027b795984737614

                                      SHA1

                                      b41a11f909a7bdf1115088790a5680ac4e23031b

                                      SHA256

                                      513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a

                                      SHA512

                                      c48a55cc7a92cefcefe5fb2382ccd8ef651fc8e0885e88a256cd2f5d83b824b7d910f755180b29eccb54d9361d6af82f9cc741bd7e6752122949b657da973676

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-873560699-1074803302-2326074425-1000\76b53b3ec448f7ccdda2063b15d2bfc3_9251837d-e9a5-4229-9a78-b1085d98b1bb
                                      Filesize

                                      2KB

                                      MD5

                                      cb31d5c3dd7a8dda5731b399d09c7425

                                      SHA1

                                      8b0592aaba741040604d401125b014f383f6c709

                                      SHA256

                                      25d15f9474e99306096fce00f106e23cee54fcca93d803aead7163875b7e0ab8

                                      SHA512

                                      67cd928722e0ded099ced2f65c8b9019097083dd6a1061264dde53169809adb07ed6c537a74c2b4ab7576cf0eccc5cf5ad9a5d13b7baafdad30cbef92f66704b

                                      Download Submit

                                    • C:\Users\Public\Desktop\Google Chrome.lnk
                                      Filesize

                                      2KB

                                      MD5

                                      bc66475ee3b9ba37ec6828944dadd734

                                      SHA1

                                      9b82600ed9625cd85c114473a66b2160aea60b0a

                                      SHA256

                                      4c14b7589cf62d4a93c2e2e3f6b74c3b2424973df96e12dfbfb988cc6d29d409

                                      SHA512

                                      e45e908918f2c08cc2a1fe85f268c858a6bfa082c792ce893ef649aeffe7d570b791236f70f6f9e1ac2388173a6e5b76fe53a340685d0f1880bb2f28a440cbdf

                                      Download Submit

                                    • \ProgramData\nss3.dll
                                      Filesize

                                      2.0MB

                                      MD5

                                      1cc453cdf74f31e4d913ff9c10acdde2

                                      SHA1

                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                      SHA256

                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                      SHA512

                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                      Download Submit

                                    • memory/352-90-0x0000000006FA0000-0x00000000074CC000-memory.dmp

                                      Filesize

                                      5.2MB

                                      Download

                                    • memory/352-71-0x00000000056A0000-0x00000000057AA000-memory.dmp

                                      Filesize

                                      1.0MB

                                      Download

                                    • memory/352-265-0x0000000073B90000-0x000000007427E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/352-89-0x00000000068A0000-0x0000000006A62000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/352-50-0x0000000005000000-0x0000000005066000-memory.dmp

                                      Filesize

                                      408KB

                                      Download

                                    • memory/352-85-0x0000000005130000-0x0000000005140000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/352-48-0x0000000073B90000-0x000000007427E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/352-87-0x00000000065E0000-0x000000000662B000-memory.dmp

                                      Filesize

                                      300KB

                                      Download

                                    • memory/352-84-0x00000000065A0000-0x00000000065DE000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/352-64-0x0000000005570000-0x0000000005582000-memory.dmp

                                      Filesize

                                      72KB

                                      Download

                                    • memory/352-58-0x0000000005B50000-0x0000000006156000-memory.dmp

                                      Filesize

                                      6.0MB

                                      Download

                                    • memory/352-124-0x0000000006B60000-0x0000000006BB0000-memory.dmp

                                      Filesize

                                      320KB

                                      Download

                                    • memory/352-126-0x0000000006CD0000-0x0000000006D46000-memory.dmp

                                      Filesize

                                      472KB

                                      Download

                                    • memory/352-38-0x00000000007D0000-0x00000000007F2000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/1136-246-0x0000000002DF0000-0x0000000002EF0000-memory.dmp

                                      Filesize

                                      1024KB

                                      Download

                                    • memory/1136-257-0x0000000000400000-0x0000000002D44000-memory.dmp

                                      Filesize

                                      41.3MB

                                      Download

                                    • memory/2228-157-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-183-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-140-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-134-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-143-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-81-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/2228-146-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-148-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-130-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-70-0x000001FFA2100000-0x000001FFA2106000-memory.dmp

                                      Filesize

                                      24KB

                                      Download

                                    • memory/2228-159-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-162-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-86-0x000001FFBC5F0000-0x000001FFBC600000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/2228-243-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-132-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-172-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-166-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-97-0x000001FFBC730000-0x000001FFBC9A6000-memory.dmp

                                      Filesize

                                      2.5MB

                                      Download

                                    • memory/2228-121-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-178-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-181-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-247-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-219-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-185-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-187-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-189-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-192-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-204-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-208-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-128-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-125-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-108-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-278-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/2228-229-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2228-107-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmp

                                      Filesize

                                      2.4MB

                                      Download

                                    • memory/2240-264-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/2240-233-0x0000000000CD0000-0x0000000000D1A000-memory.dmp

                                      Filesize

                                      296KB

                                      Download

                                    • memory/2240-269-0x000000001BA80000-0x000000001BA90000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/2304-297-0x0000000000400000-0x0000000002D44000-memory.dmp

                                      Filesize

                                      41.3MB

                                      Download

                                    • memory/2304-180-0x0000000000400000-0x0000000002D44000-memory.dmp

                                      Filesize

                                      41.3MB

                                      Download

                                    • memory/2304-167-0x00000000049F0000-0x0000000004A5C000-memory.dmp

                                      Filesize

                                      432KB

                                      Download

                                    • memory/2304-165-0x0000000002F50000-0x0000000003050000-memory.dmp

                                      Filesize

                                      1024KB

                                      Download

                                    • memory/2660-106-0x0000000000970000-0x0000000000980000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/2660-1-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/2660-2-0x0000000000970000-0x0000000000980000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/2660-0-0x00000000002A0000-0x00000000002A8000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/2660-93-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/2808-122-0x0000000000AE0000-0x0000000000AE4000-memory.dmp

                                      Filesize

                                      16KB

                                      Download

                                    • memory/2904-310-0x0000000073B90000-0x000000007427E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/2904-313-0x00000000003D0000-0x000000000044C000-memory.dmp

                                      Filesize

                                      496KB

                                      Download

                                    • memory/2992-82-0x0000000140000000-0x0000000140004278-memory.dmp

                                      Filesize

                                      16KB

                                      Download

                                    • memory/3656-49-0x0000000000BC0000-0x0000000001CDC000-memory.dmp

                                      Filesize

                                      17.1MB

                                      Download

                                    • memory/3656-24-0x0000000076C10000-0x0000000076CE0000-memory.dmp

                                      Filesize

                                      832KB

                                      Download

                                    • memory/3656-13-0x0000000000BC0000-0x0000000001CDC000-memory.dmp

                                      Filesize

                                      17.1MB

                                      Download

                                    • memory/3656-161-0x0000000000BC0000-0x0000000001CDC000-memory.dmp

                                      Filesize

                                      17.1MB

                                      Download

                                    • memory/3656-18-0x0000000074AB0000-0x0000000074C72000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3656-20-0x0000000076C10000-0x0000000076CE0000-memory.dmp

                                      Filesize

                                      832KB

                                      Download

                                    • memory/3656-22-0x0000000076C10000-0x0000000076CE0000-memory.dmp

                                      Filesize

                                      832KB

                                      Download

                                    • memory/3656-230-0x0000000076C10000-0x0000000076CE0000-memory.dmp

                                      Filesize

                                      832KB

                                      Download

                                    • memory/3656-26-0x0000000074AB0000-0x0000000074C72000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3656-163-0x0000000074AB0000-0x0000000074C72000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3656-94-0x0000000006B80000-0x0000000006B90000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/3656-27-0x0000000074AB0000-0x0000000074C72000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3656-83-0x00000000068D0000-0x00000000068E4000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/3656-80-0x0000000000400000-0x000000000054E000-memory.dmp

                                      Filesize

                                      1.3MB

                                      Download

                                    • memory/3656-51-0x0000000000BC0000-0x0000000001CDC000-memory.dmp

                                      Filesize

                                      17.1MB

                                      Download

                                    • memory/3656-76-0x00000000068C0000-0x00000000068CA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/3656-53-0x00000000068E0000-0x0000000006972000-memory.dmp

                                      Filesize

                                      584KB

                                      Download

                                    • memory/3656-52-0x0000000006E90000-0x000000000738E000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/4156-228-0x00007FF7D4420000-0x00007FF7D4674000-memory.dmp

                                      Filesize

                                      2.3MB

                                      Download

                                    • memory/4212-317-0x0000000002D90000-0x0000000002DB7000-memory.dmp

                                      Filesize

                                      156KB

                                      Download

                                    • memory/4212-314-0x0000000002E60000-0x0000000002F60000-memory.dmp

                                      Filesize

                                      1024KB

                                      Download

                                    • memory/4404-144-0x00000231AF760000-0x00000231AF782000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/4404-227-0x00000231B0250000-0x00000231B02C6000-memory.dmp

                                      Filesize

                                      472KB

                                      Download

                                    • memory/4404-105-0x0000023197100000-0x0000023197110000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/4404-100-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/4404-288-0x0000023197100000-0x0000023197110000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/4404-119-0x0000023197100000-0x0000023197110000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/4704-244-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/4704-222-0x0000000000600000-0x0000000000616000-memory.dmp

                                      Filesize

                                      88KB

                                      Download