Overview

overview

10

Static

static

3

LiteRes.dll

windows7-x64

1

LiteRes.dll

windows10-2004-x64

1

LiteRes.dll

windows11-21h2-x64

1

LiteSkinUtils.dll

windows7-x64

1

LiteSkinUtils.dll

windows10-2004-x64

1

LiteSkinUtils.dll

windows11-21h2-x64

1

setup.exe

windows7-x64

10

setup.exe

windows10-2004-x64

10

setup.exe

windows11-21h2-x64

10

Resubmissions

11/04/2024, 06:48

240411-hkr7vahb4s 10

11/04/2024, 05:54

240411-gma6nsgg3v 10

Analysis

  • max time kernel
    299s
  • max time network
    312s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/04/2024, 05:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.exe

  • Size

    786.0MB

  • MD5

    28f933002ae3e44bf6111c4664c2d7aa

  • SHA1

    010cb6284142ecb7f1ad716d88f8da32d7222e0b

  • SHA256

    39433b514b24eae9780018087ee461e411671d2945bc7c2f47a19209ee56046c

  • SHA512

    ad23f3f6aa76e4d4506fc8f31d3c9108219d22f967e450abd35f08b03afd406eafbb05039acaa69dc7d03f1cc279753a9b8ef82b69ad0d7bd17df04502d1bb83

  • SSDEEP

    98304:rDcRPtm36r1qcTNQzNrDluebmEE+ey++Z:5362tlDeuZ

Score
10/10
gluptebastealctofseevidarcollectiondiscoverydropperevasionloaderpersistencerootkitspywarestealertrojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Extracted

Family

vidar

C2

https://t.me/de17fs

https://steamcommunity.com/profiles/76561199667616374
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

  • Detect Vidar Stealer 6 IoCs
    stealer
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 7 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 8 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 23 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Modifies firewall policy service
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Users\Admin\Documents\SimpleAdobe\O0QXj43Brj7Rzvt_Ii8xYKFP.exe
      C:\Users\Admin\Documents\SimpleAdobe\O0QXj43Brj7Rzvt_Ii8xYKFP.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:676
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV202_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_5fc4ccc1a69cead8abaf9c75121d8fec HR" /sc HOURLY /rl HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:460
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV202_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_5fc4ccc1a69cead8abaf9c75121d8fec LG" /sc ONLOGON /rl HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:1204
      • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\BToI4iP_FYQYpwSSIMlo.exe
        "C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\BToI4iP_FYQYpwSSIMlo.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:1992
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:2416
      • C:\Users\Admin\Documents\SimpleAdobe\014GKYx5z4jZsuk1AVKd5paE.exe
        C:\Users\Admin\Documents\SimpleAdobe\014GKYx5z4jZsuk1AVKd5paE.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1152
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IDAEBGCAAE.exe"
          3⤵
          • Loads dropped DLL
          PID:1716
          • C:\Users\Admin\AppData\Local\Temp\IDAEBGCAAE.exe
            "C:\Users\Admin\AppData\Local\Temp\IDAEBGCAAE.exe"
            4⤵
            • Executes dropped EXE
            PID:2428
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\IDAEBGCAAE.exe
              5⤵
                PID:1548
                • C:\Windows\SysWOW64\PING.EXE
                  ping 2.2.2.2 -n 1 -w 3000
                  6⤵
                  • Runs ping.exe
                  PID:2996
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FIIECFHDBA.exe"
            3⤵
            • Suspicious behavior: GetForegroundWindowSpam
            PID:2664
        • C:\Users\Admin\Documents\SimpleAdobe\Imru71wPLteTnveMtfCLzjzY.exe
          C:\Users\Admin\Documents\SimpleAdobe\Imru71wPLteTnveMtfCLzjzY.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1156
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Modifies system certificate store
            PID:1584
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 940
              4⤵
              • Program crash
              PID:876
        • C:\Users\Admin\Documents\SimpleAdobe\9dh8uUmUIPUgWWHtbV4iZ05c.exe
          C:\Users\Admin\Documents\SimpleAdobe\9dh8uUmUIPUgWWHtbV4iZ05c.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zjmjywns\
            3⤵
              PID:2028
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iuczfsyw.exe" C:\Windows\SysWOW64\zjmjywns\
              3⤵
                PID:2628
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" create zjmjywns binPath= "C:\Windows\SysWOW64\zjmjywns\iuczfsyw.exe /d\"C:\Users\Admin\Documents\SimpleAdobe\9dh8uUmUIPUgWWHtbV4iZ05c.exe\"" type= own start= auto DisplayName= "wifi support"
                3⤵
                • Launches sc.exe
                PID:1912
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" description zjmjywns "wifi internet conection"
                3⤵
                • Launches sc.exe
                PID:780
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" start zjmjywns
                3⤵
                • Launches sc.exe
                PID:3008
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                3⤵
                • Modifies Windows Firewall
                PID:3052
            • C:\Users\Admin\Documents\SimpleAdobe\vzNhJCtF0K68k4jZfQCyayT4.exe
              C:\Users\Admin\Documents\SimpleAdobe\vzNhJCtF0K68k4jZfQCyayT4.exe
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1444
              • C:\Users\Admin\Documents\SimpleAdobe\vzNhJCtF0K68k4jZfQCyayT4.exe
                "C:\Users\Admin\Documents\SimpleAdobe\vzNhJCtF0K68k4jZfQCyayT4.exe"
                3⤵
                • Windows security bypass
                • Executes dropped EXE
                • Loads dropped DLL
                • Windows security modification
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:2592
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  4⤵
                    PID:780
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      5⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:2652
                  • C:\Windows\rss\csrss.exe
                    C:\Windows\rss\csrss.exe
                    4⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Manipulates WinMon driver.
                    • Manipulates WinMonFS driver.
                    • Drops file in Windows directory
                    • Modifies system certificate store
                    • Suspicious use of AdjustPrivilegeToken
                    PID:940
                    • C:\Windows\system32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      5⤵
                      • Creates scheduled task(s)
                      PID:2952
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      5⤵
                        PID:1168
                      • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Modifies system certificate store
                        PID:2612
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2872
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2680
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1296
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2976
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1676
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:3056
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1960
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1920
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2256
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:460
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2248
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -timeout 0
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1068
                        • C:\Windows\system32\bcdedit.exe
                          C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                          6⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2956
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        5⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2504
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\Sysnative\bcdedit.exe /v
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2148
                      • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                        5⤵
                        • Executes dropped EXE
                        PID:2616
                      • C:\Windows\system32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        5⤵
                        • Creates scheduled task(s)
                        PID:2320
                      • C:\Windows\windefender.exe
                        "C:\Windows\windefender.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:1388
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          6⤵
                            PID:2588
                            • C:\Windows\SysWOW64\sc.exe
                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              7⤵
                              • Launches sc.exe
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1676
                  • C:\Users\Admin\Documents\SimpleAdobe\EjsSc9NkGPhuI7fyu0bZj9VU.exe
                    C:\Users\Admin\Documents\SimpleAdobe\EjsSc9NkGPhuI7fyu0bZj9VU.exe
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Accesses Microsoft Outlook profiles
                    • Adds Run key to start application
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • outlook_office_path
                    • outlook_win_path
                    PID:2892
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe HR" /sc HOURLY /rl HIGHEST
                      3⤵
                      • Creates scheduled task(s)
                      PID:888
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe LG" /sc ONLOGON /rl HIGHEST
                      3⤵
                      • Creates scheduled task(s)
                      PID:2060
                    • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\BToI4iP_FYQYpwSSIMlo.exe
                      "C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\BToI4iP_FYQYpwSSIMlo.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:1980
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec HR" /sc HOURLY /rl HIGHEST
                      3⤵
                      • Creates scheduled task(s)
                      PID:2700
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec LG" /sc ONLOGON /rl HIGHEST
                      3⤵
                      • Creates scheduled task(s)
                      PID:2840
                    • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\q_gQ5TqMhxuQ4ZxXCbMV.exe
                      "C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\q_gQ5TqMhxuQ4ZxXCbMV.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3052
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        4⤵
                          PID:2044
                    • C:\Users\Admin\Documents\SimpleAdobe\9bjxeXgWZI8JRCEzoikgcEgd.exe
                      C:\Users\Admin\Documents\SimpleAdobe\9bjxeXgWZI8JRCEzoikgcEgd.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2036
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2904
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2976
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1624
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:704
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe delete "OBGPQMHF"
                        3⤵
                        • Launches sc.exe
                        PID:2052
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
                        3⤵
                        • Launches sc.exe
                        PID:2680
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe stop eventlog
                        3⤵
                        • Launches sc.exe
                        PID:2616
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe start "OBGPQMHF"
                        3⤵
                        • Launches sc.exe
                        PID:1140
                    • C:\Users\Admin\Documents\SimpleAdobe\hFhJXukyVMYTuoAsbj5ziu_B.exe
                      C:\Users\Admin\Documents\SimpleAdobe\hFhJXukyVMYTuoAsbj5ziu_B.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2632
                      • C:\Users\Admin\Documents\SimpleAdobe\hFhJXukyVMYTuoAsbj5ziu_B.exe
                        "C:\Users\Admin\Documents\SimpleAdobe\hFhJXukyVMYTuoAsbj5ziu_B.exe"
                        3⤵
                        • Executes dropped EXE
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        PID:1628
                  • C:\Windows\SysWOW64\zjmjywns\iuczfsyw.exe
                    C:\Windows\SysWOW64\zjmjywns\iuczfsyw.exe /d"C:\Users\Admin\Documents\SimpleAdobe\9dh8uUmUIPUgWWHtbV4iZ05c.exe"
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2608
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe
                      2⤵
                      • Windows security bypass
                      • Sets service image path in registry
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:1788
                  • C:\Windows\system32\makecab.exe
                    "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240411055819.log C:\Windows\Logs\CBS\CbsPersist_20240411055819.cab
                    1⤵
                    • Drops file in Windows directory
                    PID:3060
                  • C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                    C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2624
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2188
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1388
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2680
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1940
                    • C:\Windows\system32\conhost.exe
                      C:\Windows\system32\conhost.exe
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1824
                      • C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                        "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2852
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2252
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1196
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2064
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1164
                    • C:\Windows\system32\svchost.exe
                      svchost.exe
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2232
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "1611477873-20820206011102466768-15840688297856584081772532645-6150676071497493744"
                    1⤵
                      PID:1204
                    • C:\Windows\system32\conhost.exe
                      \??\C:\Windows\system32\conhost.exe "197645482413640905491705783408-1706142067-9008083359309706331455022708-936668752"
                      1⤵
                        PID:1680
                      • C:\Windows\system32\DllHost.exe
                        C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                        1⤵
                          PID:1912
                        • C:\Windows\windefender.exe
                          C:\Windows\windefender.exe
                          1⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          PID:2288

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        Scheduled Task/Job

                        1
                        T1053

                        Persistence

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        2
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        2
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        Impair Defenses

                        5
                        T1562

                        Disable or Modify System Firewall

                        1
                        T1562.004

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        6
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        1
                        T1497

                        Credential Access

                        Unsecured Credentials

                        4
                        T1552

                        Credentials In Files

                        4
                        T1552.001

                        Discovery

                        Query Registry

                        6
                        T1012

                        Remote System Discovery

                        1
                        T1018

                        System Information Discovery

                        6
                        T1082

                        Virtualization/Sandbox Evasion

                        1
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        4
                        T1005

                        Email Collection

                        1
                        T1114

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Service Stop

                        1
                        T1489

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                          Filesize

                          68KB

                          MD5

                          29f65ba8e88c063813cc50a4ea544e93

                          SHA1

                          05a7040d5c127e68c25d81cc51271ffb8bef3568

                          SHA256

                          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                          SHA512

                          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                          Filesize

                          1KB

                          MD5

                          a266bb7dcc38a562631361bbf61dd11b

                          SHA1

                          3b1efd3a66ea28b16697394703a72ca340a05bd5

                          SHA256

                          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                          SHA512

                          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          de850d9678273a23188fab3fbba05fe0

                          SHA1

                          c8d807b1431bb73cfad7c2625499b565157399e5

                          SHA256

                          049aaf50e7c8e4292bdfa6ca0389addc20356ec9d4d2c9fde4c3cba5b1ec7a9e

                          SHA512

                          804bf920ecd5679db5fe125028ca0cd9060821061db22d4991aeb77e4e093146db9bc58bdd6362d06fcbaab12d3a6ea0e303e212f840eac95702663f36a1f600

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          e22a2593e7220f1f06122fd04a0a3210

                          SHA1

                          94f67c9fb12fddeeba6fe7a93d00968d2aa4c334

                          SHA256

                          06b5ec18a784b6dae7c2cec5982c274a3ffbc988067021624edc323ac7ae131e

                          SHA512

                          c5e2ce3aa1bdc08e2a326998905aaf25d2455a728ad832cab2825049a83913e07dfee16faf82666844d1ac936dddfb7ddda0a2fa4b46ef9ddc9e22ae42ded710

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          246d38da2d757bd76d425f47be7feebd

                          SHA1

                          7b8b7b1debbb327a22fa68ba8b1ef50af03004ce

                          SHA256

                          d6cb142a3160be002414d56ec7b9f302483313be54d0eb9d5fd76cb405bb13fd

                          SHA512

                          b925cc3b864cc91ce3070148f41a10a6fab9bde5bb5d6fe60551c136a48d5ebb797d42f2d1df9f54cf01c30bcfbe8641ee1b7ac3d5e0cbf6c7eb3833ade39900

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          296637a9890e833eb1d4ef46941461c3

                          SHA1

                          3de902797abce58f9cc14e053ae7f5897b3e70a5

                          SHA256

                          9f400b9c24fda209e62bd7f13d67e439990593fbebeafee3bdd6ff3c098762b5

                          SHA512

                          9b3e2e16b4a88f77202f6a679bc26498afd95d7f6c697834b1aa7530e7ae4c019c884a00454a8c2e71c1019c665f6b5572fa81580f837bca30fb7c089789733a

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          676d711ac49b0d1084dcbf0115fe59ac

                          SHA1

                          7a2fe0585a1e6c25220bb738f459839dc9422d0b

                          SHA256

                          827b96bade07c54d42613d2ba3c6f957cfa854bd8f3115800432aa6da9f399f0

                          SHA512

                          ee1cf16b3e06e3027a9297da27bdc1c9d627a46c2425b9718e2cea204c58ebcdc51d6173596249ffed7c991ddd5cbd97971b08337bd030ce8fff9cd853c8707a

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          99301f6d13bb88c582d4364d0f1f0ac0

                          SHA1

                          8808b3a06a0360106245d686b5899c9ae6df1c83

                          SHA256

                          8825775643ceb8ae84ff617849d8d5f7835e9940fa3d355506118464166acf4b

                          SHA512

                          e9ed47fcb3cf78010c66ad745151df8b230b3302b4ca0aefa76d2b06839056bfa50cd3bfb977c6199685f082fb05866b4d47486e346f8d9bb713854ab1ff101f

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          162b16e9e20757b1f4313185cbed6d17

                          SHA1

                          7c8921ad5ffe00c8c389811ccbf4fb893175adfd

                          SHA256

                          d454c72ca3b2d56819274965d81005ec3fbdcef89ee5fbb8bd5b49eff2632af5

                          SHA512

                          9560b994c3449b822d7df29feb19772678a490d9856b5876e43d727124e7a9acc32990c453a5565d68f5d03c7f941fcbd7c96cf5d24c4da8412bf395b6af84e4

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          22296f8fb853e01480f7e636173db6f9

                          SHA1

                          43950256401631b4a0ec497736b2b0bbb71021d3

                          SHA256

                          3c752506095e4fa4075e6c22ccbcc13317e9561b827b7214bde4e428359c3717

                          SHA512

                          4192d9acaa75358230972f356a36f5c9bba3346b3f92623b0efe62ba7f4f022d19da97106b031db37a7c5c79f4f5b3b151d475560ec4b14d2b9b5f06e1772f26

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          19b8e60c6692df1cdd2f4089f5720fb4

                          SHA1

                          81d61374f03ac386e2bfe05f86a30d31e5792458

                          SHA256

                          06e195cfa77d3f49c65769b08da70c73bb1317f06cdedce4871b90213729aeea

                          SHA512

                          38d28195f1327336245fdfa575be128467e4c8a22bc5009d140169aaffacbc1f3c20598a2c47e27d149e67a26c63c3cd35612290f868b636f1fc4c9f76a82c5f

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          5d108754fd4e1bea6c1e2c98d308897b

                          SHA1

                          30b4e89de5cff9d26945f16bbe1f92af0e4a39d2

                          SHA256

                          730c7d77a38a2342674177ff015d5f5c4eb1cd204909b9f04d222094e8a82c02

                          SHA512

                          dbce5733c3c302f441b2971a55ff69c55b6546ba4f09eb5b3c7148bfa3b70021f8852d886bef1d92504defd90dc744de19547a6266a94a7155598a3f52859638

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          c135b9ebf25a2d853f37bb99c8342ca1

                          SHA1

                          5084a8fd065f6959efcd023a7880868c9beb273a

                          SHA256

                          6786371311185dc6d833c8f84bdb2680da73d36ae02c0bf1d6b90c8fdf5ee7a5

                          SHA512

                          77e0223c88aa92495c3695d6e01c4ad624c3b165ab3a9e6479e60adc64786cd2369ff5d08db00963aa7a52c083267d61fae542d5f6465551c0fde6a50c54b28f

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          37d743e7175f24a16fe3c6d4c3c8be82

                          SHA1

                          e3b03b66ede3ec6430f7acd7579f9ee0d7780930

                          SHA256

                          8844de2c07caf14e6922c1ec78d4e661b41aacee84f8abf42bf3472706898513

                          SHA512

                          7cc9f6cb83d7b14803f79d6b11ed65e98a978bca4a07cdca4f473e4071463591c71608442bfc9c3fe1b89970062b76752932a5125f910c5f9e790165136b3d48

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          9beab8169ece2f67a40b1d3af07b6dce

                          SHA1

                          ea3ef4ef8f3c7a9974504cde17474c1c26281930

                          SHA256

                          a8f07be6c8286a92d6a3422d2504e9153eb498885ce48cf9cd0445d1bc258ce3

                          SHA512

                          5b9eefe15dcb689e02a62abaa7ef12e2d31052de9ee955c27824fb141d2c2ed250a96cde90953f5855f9bdc6bfc62659f338266c644153d8013fd37ce10c9c38

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          7760cb7bf3a005a8741fe98aef6427e1

                          SHA1

                          f88aa8e6abfe02bb5549e2849637c00a4a42d086

                          SHA256

                          6f49188ebda5e0cafca71dbc07931c60ec92bdb355b39e296b6623f2240215d7

                          SHA512

                          10e3376d62cb5567bca7668c20e40b21386a8f0fe408b07e7538d7888419c702193774b1f9cb7b6189060648a813d20bf6a5b3e40db7362f008ce2a32e7c9c54

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          87f9f27415fd27f43ea618a9fbef96d7

                          SHA1

                          e879739fda3e35d5b0f00a4059bdece83ee68427

                          SHA256

                          9bc380cb5453ceebb77514b35898a0c68b2ed3f9a1177cb856874d69ef93d5a7

                          SHA512

                          857daff9c2e59cb7aa268886221c5db0ec03c2325c32367ed2f403c16f00decd45652d7fc882868add865d1d5e81cd9e37785a29d27a2f97438279a056dbad46

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          8a287cbc21836a34df184f8df8896da7

                          SHA1

                          90563b6fe612c6301b9194b9157b92cff67dcc4b

                          SHA256

                          39e470d7a67b8b32daf86b6a7836a9f453000b67dd063f52fb5fcf86a740c2cd

                          SHA512

                          b8621da419def48732dd9e4ad9b697b25df98cba3f5b1cf493e4934688664af9d1c11dcdd4de115878318b4c31a77439a80fb8afdfb33a612ac8a867fa35939d

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          6876a335a822325a5167a155760a2030

                          SHA1

                          c305ba9c1fe990d76432265d7f554c5f0b9df967

                          SHA256

                          851855e725b95c8ec56eb6d2e963f02710754ff2e898434c3e4e13d3596c8521

                          SHA512

                          28e3e14aa9a01900c6488c3e2e392237bef6cfd97074490f002ccddca418fb3d9b7b14666d61631e11002a7dcf141b597587200a140e2fda74461d61c3d660ac

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                          Filesize

                          242B

                          MD5

                          049498b3bcadf9500bef907eed651977

                          SHA1

                          2b42962389c0f7f97ab073ae24a4964add7722ad

                          SHA256

                          c42336170eb0ca556eb142954cca68b1601685170a45b2d16b8320bae09d6093

                          SHA512

                          e2cc4ac5bfcbd424a78952986f80b33b68e89a6ce3f976e0b231e46d752e75f6a9032c8556343841c436f67c96e6cc04cb8652db7cad1c06590b819ae4a917b5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\CabBA0E.tmp
                          Filesize

                          65KB

                          MD5

                          ac05d27423a85adc1622c714f2cb6184

                          SHA1

                          b0fe2b1abddb97837ea0195be70ab2ff14d43198

                          SHA256

                          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                          SHA512

                          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IDAEBGCAAE.exe
                          Filesize

                          106KB

                          MD5

                          fe380780b5c35bd6d54541791151c2be

                          SHA1

                          7fe3a583cf91474c733f85cebf3c857682e269e1

                          SHA256

                          b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                          SHA512

                          ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                          Filesize

                          8.3MB

                          MD5

                          fd2727132edd0b59fa33733daa11d9ef

                          SHA1

                          63e36198d90c4c2b9b09dd6786b82aba5f03d29a

                          SHA256

                          3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

                          SHA512

                          3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                          Filesize

                          492KB

                          MD5

                          fafbf2197151d5ce947872a4b0bcbe16

                          SHA1

                          a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                          SHA256

                          feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                          SHA512

                          acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\TarBB4D.tmp
                          Filesize

                          177KB

                          MD5

                          435a9ac180383f9fa094131b173a2f7b

                          SHA1

                          76944ea657a9db94f9a4bef38f88c46ed4166983

                          SHA256

                          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                          SHA512

                          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\adobe_1RORYwdDMpT\passwords.txt
                          Filesize

                          4KB

                          MD5

                          b3e9d0e1b8207aa74cb8812baaf52eae

                          SHA1

                          a2dce0fb6b0bbc955a1e72ef3d87cadcc6e3cc6b

                          SHA256

                          4993311fc913771acb526bb5ef73682eda69cd31ac14d25502e7bda578ffa37c

                          SHA512

                          b17adf4aa80cadc581a09c72800da22f62e5fb32953123f2c513d2e88753c430cc996e82aae7190c8cb3340fcf2d9e0d759d99d909d2461369275fbe5c68c27a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\02zdBXl47cvzcookies.sqlite
                          Filesize

                          96KB

                          MD5

                          d367ddfda80fdcf578726bc3b0bc3e3c

                          SHA1

                          23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

                          SHA256

                          0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

                          SHA512

                          40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\3b6N2Xdh3CYwplaces.sqlite
                          Filesize

                          5.0MB

                          MD5

                          3476d4395be1207da665dcda0a6a2472

                          SHA1

                          9f491995d1da8d19de2d055f1e13bdd0dea295e9

                          SHA256

                          f96ab4ba458d267608cc847d760457289317883f0a5add517be53f39a6d8cf97

                          SHA512

                          23011454397ff897211779e8a46ec0a2a99cf302842bfd6216980fd8b7d6c9200a1fc0cd3f47bcbebc2112c23877decc4a52d3d32afda97f7c1aae9db0d21949

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\BQjHhWKZ9iyPHistory
                          Filesize

                          148KB

                          MD5

                          90a1d4b55edf36fa8b4cc6974ed7d4c4

                          SHA1

                          aba1b8d0e05421e7df5982899f626211c3c4b5c1

                          SHA256

                          7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                          SHA512

                          ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\BToI4iP_FYQYpwSSIMlo.exe
                          Filesize

                          372KB

                          MD5

                          3bd3b01708099153ee8229d976691313

                          SHA1

                          c9eb1cca4efb3dfe58cbf5814b5963557cc63b86

                          SHA256

                          ea85bafa477656824a9f5b924e8a0a315d4fe7d6dde73135b706b08de4974224

                          SHA512

                          26e258d8ef7e0b58e13b53548c057efd97b25a887fc1965ef2db49f828759a6983225958b468622815e2d11422e8ffb5fec4d247d25fd29d6d9f3b616da465dd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\E3Ec6YdWxvyFLogin Data For Account
                          Filesize

                          46KB

                          MD5

                          02d2c46697e3714e49f46b680b9a6b83

                          SHA1

                          84f98b56d49f01e9b6b76a4e21accf64fd319140

                          SHA256

                          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                          SHA512

                          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\e_c7mEtp8BztWeb Data
                          Filesize

                          92KB

                          MD5

                          2157696941ae13875f8dfe8630ea4029

                          SHA1

                          b5ff62b7900cdfc630edd94d737309042de58251

                          SHA256

                          90e438a9d6706c8a1e809bfb5babe83508cac27d3c9f3f9b8bd1cd4f3aa3e033

                          SHA512

                          61b998e42f5d0121f75e04a46177c1c3a7122dc2014b7bed1d584c9ea53146e87d7a6b9e94bde066d92580c6c2b2316dd860980e5cd8f75984286dc90e43fb6a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\heidi_1RORYwdDMpT\kaWhjvhckJOzCookies
                          Filesize

                          20KB

                          MD5

                          c9ff7748d8fcef4cf84a5501e996a641

                          SHA1

                          02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                          SHA256

                          4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                          SHA512

                          d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\iuczfsyw.exe
                          Filesize

                          13.2MB

                          MD5

                          8a802cee58b549062d966323b64cd5b6

                          SHA1

                          c28d02a506de6b262cc67b218662afce648420e4

                          SHA256

                          882ac49311bb0c175de09789c676cd0a142c811732c053ec43cf93195d74646e

                          SHA512

                          824fdffd1ffdf60127888527428ef6f4aa1113da888ada4607e1420caa7ce87839d86a3bca120134721a14e7ee0fa32e99d81814aab30ffc8a24fce01404d960

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                          Filesize

                          5.3MB

                          MD5

                          1afff8d5352aecef2ecd47ffa02d7f7d

                          SHA1

                          8b115b84efdb3a1b87f750d35822b2609e665bef

                          SHA256

                          c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                          SHA512

                          e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                          Filesize

                          591KB

                          MD5

                          e2f68dc7fbd6e0bf031ca3809a739346

                          SHA1

                          9c35494898e65c8a62887f28e04c0359ab6f63f5

                          SHA256

                          b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                          SHA512

                          26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\014GKYx5z4jZsuk1AVKd5paE.exe
                          Filesize

                          288KB

                          MD5

                          5b372766cf14a2a51663671e4dfc4bad

                          SHA1

                          5d496d907035c1b9b7b67e356735c318dcdf129b

                          SHA256

                          4054075ab1af170b1b78249ced5f5ec1704a150baed3e98d4e4444f3bbc45374

                          SHA512

                          08702079081a61dcb36c0c22a93877030ce96a03d33a78508e0874353296c692edfc4ab65963b1e462760cbde52cebd6c6822390accda4a7a3fcde02b69d9116

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\9bjxeXgWZI8JRCEzoikgcEgd.exe
                          Filesize

                          10.7MB

                          MD5

                          b091c4848287be6601d720997394d453

                          SHA1

                          9180e34175e1f4644d5fa63227d665b2be15c75b

                          SHA256

                          d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe

                          SHA512

                          a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\9dh8uUmUIPUgWWHtbV4iZ05c.exe
                          Filesize

                          288KB

                          MD5

                          9e125786a86974b62a002190eb597e63

                          SHA1

                          7689e4ee11a586d89abe6f9ca712a01faeef2e07

                          SHA256

                          a2ec5b450e99f6ed3e965ba8c5c92eafb1bec8b0db255fd27340d48602488a58

                          SHA512

                          d9ef2479b59767bd7122c85588b6dedde8a2a3dd920051466163a460317c0dea4b9e22c673c8de03d52ab23477f97db5f40642b5c00ae8dddf77b549b7a197ce

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\EjsSc9NkGPhuI7fyu0bZj9VU.exe
                          Filesize

                          5.5MB

                          MD5

                          fa88d1c7d5a92118cd8c607b1330cb57

                          SHA1

                          24b3f6d3409e42baeebd7cd08cc27ce1b6c8d2e9

                          SHA256

                          538f359fbe8a044fcec6a9962a39922608bc416c4fd6b3e15a2a659a689e9f56

                          SHA512

                          54d53cfc8c1455e11b694bf3dbb972aba7f79113da8250f4c996fa11017b93f677a1aafeb9cda774608b00de2154f7ad2d27e2625844043e98418f4bdf3d62c9

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\Imru71wPLteTnveMtfCLzjzY.exe
                          Filesize

                          277KB

                          MD5

                          7b2da91a9b0cfa580ad7fbdd51870e8d

                          SHA1

                          a59d6fa91b0fc59226b62ae62b6d32116a92d79f

                          SHA256

                          b76f8a824b98280e155e4ea59adc59fcd8b87a784893614647f457bcbca89144

                          SHA512

                          c8e5769716c0d2d718cb0c1bf75c4951faa9424246dde8f3c1f72e8fad2f7fb8e1febce072b5996d3b35b36c8f2ac0887a1407802fbe473502dcd5959f76a57f

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\O0QXj43Brj7Rzvt_Ii8xYKFP.exe
                          Filesize

                          5.5MB

                          MD5

                          5efb20ecf468b1655161f6644597f817

                          SHA1

                          d8889d70b8810f78ac8f1e505e7f1cc53902caa6

                          SHA256

                          c17d9e85a57cb25faf209c3d4e3478b7c746f3ba0c9b2a7ac79c66cf8b90202a

                          SHA512

                          565f29fa5d988cb94d9b1c88806c48a88ada361064f95a32f3088fbe5e22633a0163286f75abc103e8411f8a6d43e347f04a8bf4d4bc490c0d00bbab6089e758

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\hFhJXukyVMYTuoAsbj5ziu_B.exe
                          Filesize

                          4.2MB

                          MD5

                          c6158a04a4cac37701891732331636c6

                          SHA1

                          4897f95a6418f6f447610c295282b5354cc3b630

                          SHA256

                          6a7e0c7c596aa7de50ce1c94fb33bd019891d2d6102026c07dfc03b225efed31

                          SHA512

                          090e6403c29b351ef020e91a92087db326a865f7b3b60950ada4f0de949f050438ab396125848c30be263b71610a25e531d0783f8a6d1c413dc8e08a6dacf0e0

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\pu1T7WD4Rc4lz8r9yLsm0Meu.exe
                          Filesize

                          6.5MB

                          MD5

                          78ff49021a34bb86056ccc31a8034869

                          SHA1

                          59391bc2b7fc9666d255144c89e35e5ffee73145

                          SHA256

                          b7830f1bd8c106db1553b73adc63bfcf81722fcc76391e3ac907f9520a1b8bae

                          SHA512

                          52df6aa1e0a00f262a469b3d1a79671b652343a15b620107630c0dbcb04b8c48eb796cf67fabeb3f197d93f3084671c5cc5d297822e6189ce2836607add471b1

                          Download Submit

                        • C:\Users\Admin\Documents\SimpleAdobe\vzNhJCtF0K68k4jZfQCyayT4.exe
                          Filesize

                          4.2MB

                          MD5

                          25a6bea4e9e0cc29f92c025a9d7af8cf

                          SHA1

                          a9b12e58680a9eb178e04c2631e365005f0fda8e

                          SHA256

                          14057f60f713a0cd01845eb26f78a5ec056d661e9ae821a124a6c33679439ebf

                          SHA512

                          275e194fd4e6b4d65c0f8e03d53acd086132f193cf1a6e345df6fa6895fb723621dda16c638a858f41fe78164050ed488ff0a02c686ee62fed7f6b11fd70aa42

                          Download Submit

                        • C:\Windows\System32\GroupPolicy\gpt.ini
                          Filesize

                          127B

                          MD5

                          8ef9853d1881c5fe4d681bfb31282a01

                          SHA1

                          a05609065520e4b4e553784c566430ad9736f19f

                          SHA256

                          9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                          SHA512

                          5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                          Download Submit

                        • C:\Windows\TEMP\gdaawrhfdlcr.sys
                          Filesize

                          14KB

                          MD5

                          0c0195c48b6b8582fa6f6373032118da

                          SHA1

                          d25340ae8e92a6d29f599fef426a2bc1b5217299

                          SHA256

                          11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                          SHA512

                          ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                          Download Submit

                        • \ProgramData\mozglue.dll
                          Filesize

                          593KB

                          MD5

                          c8fd9be83bc728cc04beffafc2907fe9

                          SHA1

                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                          SHA256

                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                          SHA512

                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          Download Submit

                        • \ProgramData\nss3.dll
                          Filesize

                          2.0MB

                          MD5

                          1cc453cdf74f31e4d913ff9c10acdde2

                          SHA1

                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                          SHA256

                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                          SHA512

                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                          Filesize

                          94KB

                          MD5

                          d98e78fd57db58a11f880b45bb659767

                          SHA1

                          ab70c0d3bd9103c07632eeecee9f51d198ed0e76

                          SHA256

                          414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0

                          SHA512

                          aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                          Filesize

                          281KB

                          MD5

                          d98e33b66343e7c96158444127a117f6

                          SHA1

                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                          SHA256

                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                          SHA512

                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\csrss\patch.exe
                          Filesize

                          1.7MB

                          MD5

                          13aaafe14eb60d6a718230e82c671d57

                          SHA1

                          e039dd924d12f264521b8e689426fb7ca95a0a7b

                          SHA256

                          f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                          SHA512

                          ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\dbghelp.dll
                          Filesize

                          1.5MB

                          MD5

                          f0616fa8bc54ece07e3107057f74e4db

                          SHA1

                          b33995c4f9a004b7d806c4bb36040ee844781fca

                          SHA256

                          6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

                          SHA512

                          15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\symsrv.dll
                          Filesize

                          163KB

                          MD5

                          5c399d34d8dc01741269ff1f1aca7554

                          SHA1

                          e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                          SHA256

                          e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                          SHA512

                          8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                          Download Submit

                        • memory/676-1040-0x0000000000F30000-0x0000000001934000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/676-1093-0x00000000775A0000-0x00000000775A1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/676-913-0x00000000000A0000-0x00000000000A1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/676-921-0x00000000000A0000-0x00000000000A1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/676-1308-0x0000000000F30000-0x0000000001934000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/940-1479-0x0000000000400000-0x000000000310A000-memory.dmp

                          Filesize

                          45.0MB

                          Download

                        • memory/940-1478-0x0000000003170000-0x0000000003568000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/940-1588-0x0000000000400000-0x000000000310A000-memory.dmp

                          Filesize

                          45.0MB

                          Download

                        • memory/1152-1273-0x0000000000400000-0x0000000002D27000-memory.dmp

                          Filesize

                          41.2MB

                          Download

                        • memory/1152-916-0x0000000000400000-0x0000000002D27000-memory.dmp

                          Filesize

                          41.2MB

                          Download

                        • memory/1152-863-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/1152-1257-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/1152-866-0x0000000000220000-0x0000000000247000-memory.dmp

                          Filesize

                          156KB

                          Download

                        • memory/1156-922-0x0000000000380000-0x0000000000381000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1156-954-0x0000000074150000-0x000000007483E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/1156-864-0x00000000012C0000-0x000000000130C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/1444-1021-0x0000000004DE0000-0x00000000056CB000-memory.dmp

                          Filesize

                          8.9MB

                          Download

                        • memory/1444-1035-0x0000000000400000-0x000000000310A000-memory.dmp

                          Filesize

                          45.0MB

                          Download

                        • memory/1444-965-0x0000000003450000-0x0000000003848000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/1444-1340-0x0000000000400000-0x000000000310A000-memory.dmp

                          Filesize

                          45.0MB

                          Download

                        • memory/1444-865-0x0000000003450000-0x0000000003848000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/1584-886-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-906-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-1579-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-881-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-1096-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-919-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-901-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-888-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-910-0x0000000000400000-0x0000000000648000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/1584-914-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1680-857-0x0000000000250000-0x0000000000350000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/1680-1044-0x0000000000400000-0x0000000002D27000-memory.dmp

                          Filesize

                          41.2MB

                          Download

                        • memory/1680-861-0x00000000003C0000-0x00000000003D3000-memory.dmp

                          Filesize

                          76KB

                          Download

                        • memory/1788-1578-0x0000000000080000-0x0000000000095000-memory.dmp

                          Filesize

                          84KB

                          Download

                        • memory/1788-1095-0x0000000000080000-0x0000000000095000-memory.dmp

                          Filesize

                          84KB

                          Download

                        • memory/1992-1327-0x0000000071F20000-0x000000007260E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/1992-1285-0x00000000013C0000-0x0000000001424000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/2036-1098-0x00000000773A0000-0x0000000077549000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2036-1319-0x00000000773A0000-0x0000000077549000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2036-1294-0x0000000140000000-0x0000000141A14000-memory.dmp

                          Filesize

                          26.1MB

                          Download

                        • memory/2036-1094-0x0000000077550000-0x0000000077552000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2036-1097-0x0000000140000000-0x0000000141A14000-memory.dmp

                          Filesize

                          26.1MB

                          Download

                        • memory/2172-558-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-795-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-822-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-5-0x000007FE80010000-0x000007FE80011000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2172-6-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-7-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-8-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-9-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-10-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-18-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-85-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-814-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-804-0x000007FEFD3B0000-0x000007FEFD41C000-memory.dmp

                          Filesize

                          432KB

                          Download

                        • memory/2172-3-0x00000000773A0000-0x0000000077549000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2172-2-0x000007FEFD3B0000-0x000007FEFD41C000-memory.dmp

                          Filesize

                          432KB

                          Download

                        • memory/2172-4-0x00000000001E0000-0x00000000001E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2172-805-0x00000000773A0000-0x0000000077549000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2172-0-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2172-1-0x0000000140000000-0x000000014072E000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2232-1482-0x0000000000530000-0x0000000000550000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2416-1332-0x0000000000400000-0x000000000044F000-memory.dmp

                          Filesize

                          316KB

                          Download

                        • memory/2428-1352-0x0000000071F20000-0x000000007260E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2428-1264-0x0000000000B60000-0x0000000000B80000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2592-1412-0x0000000003360000-0x0000000003758000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2592-1419-0x0000000000400000-0x000000000310A000-memory.dmp

                          Filesize

                          45.0MB

                          Download

                        • memory/2592-1437-0x0000000000400000-0x000000000310A000-memory.dmp

                          Filesize

                          45.0MB

                          Download

                        • memory/2608-1087-0x0000000002F32000-0x0000000002F48000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/2608-1101-0x0000000000400000-0x0000000002D27000-memory.dmp

                          Filesize

                          41.2MB

                          Download

                        • memory/2612-1522-0x0000000140000000-0x00000001405E8000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2624-1384-0x00000000773A0000-0x0000000077549000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2624-1383-0x0000000140000000-0x0000000141A14000-memory.dmp

                          Filesize

                          26.1MB

                          Download

                        • memory/2664-1415-0x0000000002290000-0x0000000002291000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2852-1411-0x0000000140000000-0x0000000141A14000-memory.dmp

                          Filesize

                          26.1MB

                          Download

                        • memory/2852-1416-0x0000000140000000-0x0000000141A14000-memory.dmp

                          Filesize

                          26.1MB

                          Download

                        • memory/2852-1580-0x0000000140000000-0x0000000141A14000-memory.dmp

                          Filesize

                          26.1MB

                          Download

                        • memory/2852-1417-0x00000000773A0000-0x0000000077549000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2892-944-0x0000000000840000-0x0000000000841000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-941-0x0000000000840000-0x0000000000841000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-902-0x0000000000160000-0x0000000000161000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-908-0x0000000000160000-0x0000000000161000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-1523-0x0000000001130000-0x0000000001B33000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/2892-926-0x00000000003E0000-0x00000000003E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-920-0x00000000003E0000-0x00000000003E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-880-0x00000000000D0000-0x00000000000D1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-899-0x00000000000D0000-0x00000000000D1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-884-0x00000000000D0000-0x00000000000D1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-938-0x0000000000500000-0x0000000000501000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-936-0x0000000000500000-0x0000000000501000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-933-0x00000000004F0000-0x00000000004F1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-959-0x0000000001130000-0x0000000001B33000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/2892-931-0x00000000004F0000-0x00000000004F1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-928-0x00000000003E0000-0x00000000003E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-918-0x0000000000160000-0x0000000000161000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-1036-0x00000000775A0000-0x00000000775A1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2892-1037-0x0000000001130000-0x0000000001B33000-memory.dmp

                          Filesize

                          10.0MB

                          Download