Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://samples.vx-u...

windows10-2004-x64

10

Analysis

  • max time kernel
    1173s
  • max time network
    1174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-04-2024 16:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.09.7z

Score
10/10
agentteslaemotetlokibotmassloggermodiloadernjratsystembczgratepoch1epoch3bankercollectionevasionkeyloggermacromacro_on_actionpersistenceratspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.drivehq.com
  • Port:
    21
  • Username:
    donatopizza

Extracted

Family

modiloader

C2

https://cdn.discordapp.com/attachments/753549570230976536/754626602951770172/Dpgibbn

Extracted

Family

emotet

Botnet

Epoch3

C2

118.2.218.1:80

51.254.140.91:7080

5.9.227.244:8080

51.75.163.68:7080

75.127.14.170:8080

101.50.232.218:80

175.139.144.229:8080

139.59.12.63:8080

2.144.244.204:443

175.29.183.2:80

86.98.143.163:80

210.1.219.238:80

73.84.105.76:80

185.208.226.142:8080

91.75.75.46:80

188.251.213.180:443

88.249.181.198:443

77.74.78.80:443

181.137.229.1:80

190.136.179.102:80
rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch1

C2

128.92.203.42:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

190.188.245.242:80

12.163.208.58:80

213.197.182.158:8080

201.213.177.139:80

62.84.75.50:80

45.33.77.42:8080

185.183.16.47:80

78.249.119.122:80

177.129.17.170:443

51.15.7.189:80

152.169.22.67:80

119.106.216.84:80

109.169.12.78:80

51.15.7.145:80

219.92.13.25:80

190.117.79.209:80
rsa_pubkey.plain

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Sages101*

Extracted

Family

agenttesla

Credentials

Extracted

Family

systembc

C2

knock0909.monster:4035

knock0909.xyz:4035

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect ZGRat V1 2 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main payload 2 IoCs
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • AgentTesla payload 4 IoCs
  • Emotet payload 5 IoCs

    Detects Emotet payload in memory.

    trojanbanker
  • ModiLoader First Stage 1 IoCs
  • Drops file in Drivers directory 10 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 38 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs
    collection
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • NSIS installer 2 IoCs
    installer
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.09.7z
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2ae6ab58,0x7ffe2ae6ab68,0x7ffe2ae6ab78
      2⤵
        PID:4544
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:2
        2⤵
          PID:3640
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:8
          2⤵
            PID:3032
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:8
            2⤵
              PID:2824
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:1
              2⤵
                PID:3472
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:1
                2⤵
                  PID:4848
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:8
                  2⤵
                    PID:780
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:8
                    2⤵
                      PID:936
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:8
                      2⤵
                        PID:1180
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 --field-trial-handle=1928,i,3978843428491432248,1086341148563101541,131072 /prefetch:8
                        2⤵
                          PID:4276
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:4316
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:2504
                          • C:\Program Files\7-Zip\7zFM.exe
                            "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Bazaar.2020.09.7z"
                            1⤵
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:2840
                          • C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Androm.gen-01fcf0e844ec177aa8e07cbdc1cd0bd5bbd7ef38b8335b58a2eb383b83885f1c.exe
                            "C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Androm.gen-01fcf0e844ec177aa8e07cbdc1cd0bd5bbd7ef38b8335b58a2eb383b83885f1c.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:3016
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 1276
                              2⤵
                              • Program crash
                              PID:4340
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3016 -ip 3016
                            1⤵
                              PID:456
                            • C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-03be3fca4c09700d4185cffca49b666c9bc8c522ee6acb8fc625f9e5c1bbc42a.exe
                              "C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-03be3fca4c09700d4185cffca49b666c9bc8c522ee6acb8fc625f9e5c1bbc42a.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:4204
                            • C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-03bae674c28c66f112d3623d12cd6712cc03cc6f2a3e1719bc2ad433abddddc0.exe
                              "C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-03bae674c28c66f112d3623d12cd6712cc03cc6f2a3e1719bc2ad433abddddc0.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:1212
                            • C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-016a89b89b40fe5953e21affdecb93c13a479ee2fbcf5125dfa09d1b2930deb2.exe
                              "C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-016a89b89b40fe5953e21affdecb93c13a479ee2fbcf5125dfa09d1b2930deb2.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1920
                            • C:\Users\Admin\Desktop\HEUR-Trojan-GameThief.Win32.OnLineGames.gen-013c053bbbd1b145ff848a085f247191722f5409953776658732397393e9b825.exe
                              "C:\Users\Admin\Desktop\HEUR-Trojan-GameThief.Win32.OnLineGames.gen-013c053bbbd1b145ff848a085f247191722f5409953776658732397393e9b825.exe"
                              1⤵
                              • Drops file in Drivers directory
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:1964
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etcd40Vb" /S /Q
                                2⤵
                                  PID:464
                              • C:\Users\Admin\Desktop\HEUR-Trojan-GameThief.Win32.OnLineGames.gen-025c02b41a8f743e5787b57e74631316db62317c41845402f3ad5e0575b6586e.exe
                                "C:\Users\Admin\Desktop\HEUR-Trojan-GameThief.Win32.OnLineGames.gen-025c02b41a8f743e5787b57e74631316db62317c41845402f3ad5e0575b6586e.exe"
                                1⤵
                                • Drops file in Drivers directory
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Enumerates connected drives
                                • Suspicious use of SetWindowsHookEx
                                PID:3252
                                • C:\Windows\SysWOW64\drivers\8pDMKP.exe
                                  "C:\Windows\system32\drivers\8pDMKP.exe"
                                  2⤵
                                  • Drops file in Drivers directory
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5060
                              • C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe
                                "C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:2968
                                • C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe
                                  "{path}"
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Accesses Microsoft Outlook profiles
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3036
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe'
                                    3⤵
                                      PID:4320
                                • C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe
                                  "C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:2244
                                  • C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe
                                    "{path}"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:5004
                                • C:\Users\Admin\Desktop\HEUR-Trojan-Spy.MSIL.Noon.gen-0316213feaee3be7a81a92145a71590679f110345f0a0994b0f93a89da3a4b54.exe
                                  "C:\Users\Admin\Desktop\HEUR-Trojan-Spy.MSIL.Noon.gen-0316213feaee3be7a81a92145a71590679f110345f0a0994b0f93a89da3a4b54.exe"
                                  1⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:2260
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gPigSLdqxVx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB510.tmp"
                                    2⤵
                                    • Creates scheduled task(s)
                                    PID:1800
                                  • C:\Users\Admin\Desktop\HEUR-Trojan-Spy.MSIL.Noon.gen-0316213feaee3be7a81a92145a71590679f110345f0a0994b0f93a89da3a4b54.exe
                                    "C:\Users\Admin\Desktop\HEUR-Trojan-Spy.MSIL.Noon.gen-0316213feaee3be7a81a92145a71590679f110345f0a0994b0f93a89da3a4b54.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Accesses Microsoft Outlook profiles
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2104
                                • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Bsymem.gen-012ce9d03a7a1d40aff4df470e50884fc193dd3f4d483e6545f1123676828bac.exe
                                  "C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Bsymem.gen-012ce9d03a7a1d40aff4df470e50884fc193dd3f4d483e6545f1123676828bac.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: MapViewOfSection
                                  PID:8
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    2⤵
                                    • Accesses Microsoft Outlook profiles
                                    PID:2124
                                • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-01dba88e6444acb9df2aac52afd7819f95b84144e209b925c62eb78a3bdca378.exe
                                  "C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-01dba88e6444acb9df2aac52afd7819f95b84144e209b925c62eb78a3bdca378.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:3328
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                    "{path}"
                                    2⤵
                                    • Drops file in Drivers directory
                                    • Accesses Microsoft Outlook profiles
                                    • Adds Run key to start application
                                    PID:3924
                                • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Injuke.gen-0026e51b3f6f58bc2fe6dcdd7725e323b2788614451bcdb534746597c5a92f22.exe
                                  "C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Injuke.gen-0026e51b3f6f58bc2fe6dcdd7725e323b2788614451bcdb534746597c5a92f22.exe"
                                  1⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:3904
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lQVhWINGJBw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA40.tmp"
                                    2⤵
                                    • Creates scheduled task(s)
                                    PID:4548
                                  • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Injuke.gen-0026e51b3f6f58bc2fe6dcdd7725e323b2788614451bcdb534746597c5a92f22.exe
                                    "C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Injuke.gen-0026e51b3f6f58bc2fe6dcdd7725e323b2788614451bcdb534746597c5a92f22.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Accesses Microsoft Outlook profiles
                                    • Adds Run key to start application
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious behavior: SetClipboardViewer
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3264
                                • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Taskun.gen-047e9f8b825378da0ad294496cbed35ff024c2742993e6eb0d4a1bc94c6bdb02.exe
                                  "C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Taskun.gen-047e9f8b825378da0ad294496cbed35ff024c2742993e6eb0d4a1bc94c6bdb02.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:5060
                                  • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Taskun.gen-047e9f8b825378da0ad294496cbed35ff024c2742993e6eb0d4a1bc94c6bdb02.exe
                                    "{path}"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:3612
                                  • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Taskun.gen-047e9f8b825378da0ad294496cbed35ff024c2742993e6eb0d4a1bc94c6bdb02.exe
                                    "{path}"
                                    2⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Accesses Microsoft Outlook profiles
                                    • Suspicious behavior: AddClipboardFormatListener
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2580
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\HEUR-Trojan.VBS.SAgent.gen-02426893e1fb6b3cc4dba759e7d85a0da3696d4753921487b49bddc629d6ff77.vbs"
                                  1⤵
                                    PID:4960
                                  • C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Zenpak.pef-000ce16aa593d3de6ee74dc23d0ef231a77383c7545990d32c47f038314d0051.exe
                                    "C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Zenpak.pef-000ce16aa593d3de6ee74dc23d0ef231a77383c7545990d32c47f038314d0051.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    PID:2924
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 484
                                      2⤵
                                      • Program crash
                                      PID:3912
                                  • C:\ProgramData\olxp\trgth.exe
                                    C:\ProgramData\olxp\trgth.exe start
                                    1⤵
                                    • Executes dropped EXE
                                    PID:2052
                                  • C:\Users\Admin\Desktop\Trojan-Banker.Win32.Emotet.gdme-028f0491cb3ac71d4609f96686c6da6fd21ea3f4b5e802d4c3d165b31a9234bf.exe
                                    "C:\Users\Admin\Desktop\Trojan-Banker.Win32.Emotet.gdme-028f0491cb3ac71d4609f96686c6da6fd21ea3f4b5e802d4c3d165b31a9234bf.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1040
                                  • C:\Users\Admin\Desktop\Trojan-Banker.Win32.Emotet.gdrm-0018a8706a83a0d14d43fb37b2489cf590f8379021eb46cd592ddfd192ef0592.exe
                                    "C:\Users\Admin\Desktop\Trojan-Banker.Win32.Emotet.gdrm-0018a8706a83a0d14d43fb37b2489cf590f8379021eb46cd592ddfd192ef0592.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2576
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2924 -ip 2924
                                    1⤵
                                      PID:4348
                                    • C:\Users\Admin\Desktop\Trojan.MSIL.Disfa.bqd-0184b4f25bb27328803dae537c07ad8c5ea11b149a7293840b4b36701cec80a1.exe
                                      "C:\Users\Admin\Desktop\Trojan.MSIL.Disfa.bqd-0184b4f25bb27328803dae537c07ad8c5ea11b149a7293840b4b36701cec80a1.exe"
                                      1⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      PID:2284
                                      • C:\Users\Admin\AppData\Roaming\ssfax.exe
                                        "C:\Users\Admin\AppData\Roaming\ssfax.exe"
                                        2⤵
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        PID:3800
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\ssfax.exe" "ssfax.exe" ENABLE
                                          3⤵
                                          • Modifies Windows Firewall
                                          PID:2152
                                    • C:\Users\Admin\Desktop\Trojan-Spy.MSIL.Agent.kbe-024d729bb1340e093d8d114c925fc0cd3ec4b90592bee28d0ad59da8649857fa.exe
                                      "C:\Users\Admin\Desktop\Trojan-Spy.MSIL.Agent.kbe-024d729bb1340e093d8d114c925fc0cd3ec4b90592bee28d0ad59da8649857fa.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      PID:4320
                                      • C:\Users\Admin\AppData\Local\Temp\mpv.exe
                                        C:\Users\Admin\AppData\Local\Temp\mpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mpvp.txt
                                        2⤵
                                        • Executes dropped EXE
                                        • Accesses Microsoft Outlook accounts
                                        • Accesses Microsoft Outlook profiles
                                        PID:2132
                                      • C:\Users\Admin\AppData\Local\Temp\WBP.exe
                                        C:\Users\Admin\AppData\Local\Temp\WBP.exe /stext C:\Users\Admin\AppData\Local\Temp\WBVP.txt
                                        2⤵
                                        • Executes dropped EXE
                                        PID:632
                                      • C:\Users\Admin\AppData\Local\Temp\mespv.exe
                                        C:\Users\Admin\AppData\Local\Temp\mespv.exe /stext C:\Users\Admin\AppData\Local\Temp\mespvp.txt
                                        2⤵
                                        • Executes dropped EXE
                                        PID:4800
                                      • C:\Users\Admin\AppData\Local\Temp\pv.exe
                                        C:\Users\Admin\AppData\Local\Temp\pv.exe /stext C:\Users\Admin\AppData\Local\Temp\pvp.txt
                                        2⤵
                                        • Executes dropped EXE
                                        PID:2492
                                    • C:\Users\Admin\Desktop\UDS-DangerousObject.Multi.Generic-01da092bc20b08ea1bea6de68bc460606e7c34254de25501d0c4f385eb02e6bb.exe
                                      "C:\Users\Admin\Desktop\UDS-DangerousObject.Multi.Generic-01da092bc20b08ea1bea6de68bc460606e7c34254de25501d0c4f385eb02e6bb.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      PID:1496
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        rundll32.exe ClootAmp,Hurley
                                        2⤵
                                        • Loads dropped DLL
                                        • Suspicious behavior: MapViewOfSection
                                        PID:2308
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe"
                                          3⤵
                                          • Accesses Microsoft Outlook profiles
                                          PID:5608
                                    • C:\Users\Admin\Desktop\Trojan.Win32.Agent.xaeleq-0221a0e77a374582b84c6df13c131a0f04716a00951dc3f6a483d3f612da882f.exe
                                      "C:\Users\Admin\Desktop\Trojan.Win32.Agent.xaeleq-0221a0e77a374582b84c6df13c131a0f04716a00951dc3f6a483d3f612da882f.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:6036
                                    • C:\Users\Admin\Desktop\Trojan-Banker.Win32.Emotet.gequ-0147b8b2f9bb98739fe2023ffdf6718dca38bcb7386611c65a0e9dd87b7a126a.exe
                                      "C:\Users\Admin\Desktop\Trojan-Banker.Win32.Emotet.gequ-0147b8b2f9bb98739fe2023ffdf6718dca38bcb7386611c65a0e9dd87b7a126a.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:6368
                                    • C:\Users\Admin\Desktop\HEUR-Trojan.Win32.RRAT.gen-038391b2020f10bc643e322fd0f668af217f5415c1f030454080bf34fcae538f.exe
                                      "C:\Users\Admin\Desktop\HEUR-Trojan.Win32.RRAT.gen-038391b2020f10bc643e322fd0f668af217f5415c1f030454080bf34fcae538f.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      PID:6084
                                    • C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Kryptik.gen-03150c9b34f3c06083c0af32c4fc038a5c059fdd8b19c927206df5961f40c189.exe
                                      "C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Kryptik.gen-03150c9b34f3c06083c0af32c4fc038a5c059fdd8b19c927206df5961f40c189.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: MapViewOfSection
                                      PID:8144
                                      • C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Kryptik.gen-03150c9b34f3c06083c0af32c4fc038a5c059fdd8b19c927206df5961f40c189.exe
                                        "C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Kryptik.gen-03150c9b34f3c06083c0af32c4fc038a5c059fdd8b19c927206df5961f40c189.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Accesses Microsoft Outlook profiles
                                        • Suspicious behavior: SetClipboardViewer
                                        • outlook_office_path
                                        • outlook_win_path
                                        PID:5504
                                    • C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Injects.gen-0259709a424c0ce720adad9f86158bbb8d5b60c155db6a83f0797fca6feafbba.exe
                                      "C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Injects.gen-0259709a424c0ce720adad9f86158bbb8d5b60c155db6a83f0797fca6feafbba.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:7404
                                      • C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Injects.gen-0259709a424c0ce720adad9f86158bbb8d5b60c155db6a83f0797fca6feafbba.exe
                                        "C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Injects.gen-0259709a424c0ce720adad9f86158bbb8d5b60c155db6a83f0797fca6feafbba.exe"
                                        2⤵
                                          PID:3916
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7404 -s 824
                                          2⤵
                                          • Program crash
                                          PID:3084
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 7404 -ip 7404
                                        1⤵
                                          PID:2012

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Windows Service

                                        1
                                        T1543.003

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Windows Service

                                        1
                                        T1543.003

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Defense Evasion

                                        Impair Defenses

                                        1
                                        T1562

                                        Disable or Modify System Firewall

                                        1
                                        T1562.004

                                        Modify Registry

                                        1
                                        T1112

                                        Credential Access

                                        Unsecured Credentials

                                        4
                                        T1552

                                        Credentials In Files

                                        3
                                        T1552.001

                                        Credentials in Registry

                                        1
                                        T1552.002

                                        Discovery

                                        Peripheral Device Discovery

                                        1
                                        T1120

                                        Query Registry

                                        3
                                        T1012

                                        System Information Discovery

                                        4
                                        T1082

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        4
                                        T1005

                                        Email Collection

                                        2
                                        T1114

                                        Command and Control

                                        Proxy

                                        1
                                        T1090

                                        Web Service

                                        1
                                        T1102

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                          Filesize

                                          1KB

                                          MD5

                                          91c404d3a909df749a9b32eea4afa2e7

                                          SHA1

                                          f6b9d825f31dfe5d67f2b45273b0e0ca9d4473cc

                                          SHA256

                                          466395fa24a6e5d3375bc0c64c37cd6983e354118e1f24e7ac2797b291d4b0a0

                                          SHA512

                                          1e164705a0021fa128fa411392b7536ba6f267b6dd4f0347732434640dd8ffc3a6b1f02f84921e3b80a53f379683dd9d0cbc9107841f087740b4ea29abbbff97

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                          Filesize

                                          2B

                                          MD5

                                          d751713988987e9331980363e24189ce

                                          SHA1

                                          97d170e1550eee4afc0af065b78cda302a97674c

                                          SHA256

                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                          SHA512

                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                          Filesize

                                          7KB

                                          MD5

                                          423310d81f6f0b80b8387846858487fd

                                          SHA1

                                          1bc6649e129226cf741b4160ec9b39e2fdd12152

                                          SHA256

                                          16e77de430633fca2f64f49c056c74a1c541da02e14be56e5cd6d2c05129eda7

                                          SHA512

                                          f4ec7ca0f744fed80f3430c9cf94c12f91e15021e7c809d33846a7f35567dc870675c1bbf391827793dac681c794b1a78629e9eb18e0304b70ed2271084c4c78

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          Filesize

                                          127KB

                                          MD5

                                          35e1eb484c61e65f7f63dee87f93bf11

                                          SHA1

                                          df2d0a9f4d580cbb08090427deb238672a83d99d

                                          SHA256

                                          862b0fd43a4e3c4c84e43101bc30f176c26a5014da85fcebfeac762321c2bd10

                                          SHA512

                                          32736d9f4fc2e72583e57af8770cf65fcab9371c94cb2663570340a371dc6276d59372359fb7b4fd006777bdff1d11c1e3656fef6ff6bbaeb9878dff12edf4e2

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          Filesize

                                          127KB

                                          MD5

                                          a75539562d135c8185ad6e4cc190370a

                                          SHA1

                                          820b3855511571bc83761b950429587c02b231d0

                                          SHA256

                                          2d4f700ae3b7c04f898e9d3d227fdc41e4f751b01a650c48b9bae5945432197b

                                          SHA512

                                          e83270da062f816cd9c7ad288ecaa3b06f6fa41a5093411078b5064e43f1a300ee02415ba0426af7bfb9b8252dcc350dae52e475a8833a6d2c3b25ad59dc6a11

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                          Filesize

                                          98KB

                                          MD5

                                          351969163bb5b45f460244edca99c57a

                                          SHA1

                                          a2798207da2417a4acd0a63b1027b22eb9a81049

                                          SHA256

                                          e5e5ff5d6e918448e88c2e9988e9fe7f1d107fb6e684f54b2271ba76c2bc3c3a

                                          SHA512

                                          739b48f37e968ad825b42205aa1fc7fd8bd54b1f396901bed39a3ac2ec48234b7e7d1951f4bde544cc4eacfcdb03b6f688a13e95024a190611837f159f6ff322

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe578a8d.TMP
                                          Filesize

                                          94KB

                                          MD5

                                          725a6e0a15ad7f46e6e753166e0c1d8b

                                          SHA1

                                          b418c79c85a4066be436ee34f41f05505a44d358

                                          SHA256

                                          13d911d710ffd3eebc32353018f4985fc1bbfe61559931bb0ea729c8882d981a

                                          SHA512

                                          8e84e77617ddfd0fa1183b928c431c37806333d933f0c887b508a91b43d51302b9bb6344b7be17ac9e3f7aa3541ca84570acc632c87359736983fb04b65656b6

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                          Filesize

                                          264KB

                                          MD5

                                          6b016a8728e2decd5cb2729411ccb566

                                          SHA1

                                          d9da4ca05af9528b4b3500e9830e26e3acd383da

                                          SHA256

                                          5c3bb0a61d10cec1ac7a586ebe7f95b9d70575080962e237d402ce413602ca90

                                          SHA512

                                          59811af6f2f2c637d3874973c745038937a3da70c0403058bff710e95d51a4e181b4aa6014e1ed43e52bcae204e075aff4c7408c64d3de48738ad486227278ba

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\HEUR-Trojan-Spy.MSIL.Noon.gen-0316213feaee3be7a81a92145a71590679f110345f0a0994b0f93a89da3a4b54.exe.log
                                          Filesize

                                          594B

                                          MD5

                                          fdb26b3b547022b45cfaeee57eafd566

                                          SHA1

                                          11c6798b8a59233f404014c5e79b3363cd564b37

                                          SHA256

                                          2707fc7f074413881b7bafca05079327b188db6005709951e7f69d39a2af97c0

                                          SHA512

                                          44d9bb8c0f0b341690d00eda86e15a50f7f29ce9595925c1a2a7e19ad26202d10049a7a97bea278ecb7d429ad555de8edceeffff664d4b06309a9410a09bb700

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe.log
                                          Filesize

                                          1KB

                                          MD5

                                          8ec831f3e3a3f77e4a7b9cd32b48384c

                                          SHA1

                                          d83f09fd87c5bd86e045873c231c14836e76a05c

                                          SHA256

                                          7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

                                          SHA512

                                          26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HEUR-Trojan.MSIL.Injuke.gen-0026e51b3f6f58bc2fe6dcdd7725e323b2788614451bcdb534746597c5a92f22.exe.log
                                          Filesize

                                          1KB

                                          MD5

                                          17573558c4e714f606f997e5157afaac

                                          SHA1

                                          13e16e9415ceef429aaf124139671ebeca09ed23

                                          SHA256

                                          c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

                                          SHA512

                                          f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HEUR-Trojan.MSIL.Taskun.gen-047e9f8b825378da0ad294496cbed35ff024c2742993e6eb0d4a1bc94c6bdb02.exe.log
                                          Filesize

                                          1KB

                                          MD5

                                          3d4e18cfa8f4ecc52b68607cf25ab675

                                          SHA1

                                          8e5589978b0443bb9b5fa85db7340631704eca06

                                          SHA256

                                          5079df37d411459a7f96905ab1737b2fd7d9fcba340e2702a511501826445e7d

                                          SHA512

                                          a3ffac3f01175f308c612d5d8c59885c68f3b8c334578460bc4ed370ce06eb1c0bc4efa450aaa44b331cfa56f5d437fa161ab8a27ebc1592126dea94a74763cf

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sqe23jcy.xkj.ps1
                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\tmpA40.tmp
                                          Filesize

                                          1KB

                                          MD5

                                          7a1402a7c18edb432edd1f2252c5ef27

                                          SHA1

                                          337d4e3aff645a6ef228938a3e35a0e7c35b7d9e

                                          SHA256

                                          c48fb4785d4d15f08e8502e1e5b2b73933c300a74fc47289e0ca380d6132a3b1

                                          SHA512

                                          0f2f44001ed975dd1396baf7e35a5dd9b63feb82049e7c4a69d7404f09a31968301f213c39e4a0f7a47f8d40805fda3b2092c1498e010a93bc611b836e4c6449

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\tmpB510.tmp
                                          Filesize

                                          1KB

                                          MD5

                                          635ec87140ae0cfc8668b6b64a0d62fd

                                          SHA1

                                          9cfabb26f59b4034c24aabf355955d65e48c511f

                                          SHA256

                                          dc44a79186160f4afe9a67e2f9e98e6811495e4b8efeff50805e3407d10b780b

                                          SHA512

                                          54621323c7de5501a08328e16adc6feec71fa69edb8bfdf4a757282229925e897cc7ec1700524a1535a7874bb860541efd6f4ddeea52962e5942aaa1db4a85f7

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\uninst.exe
                                          Filesize

                                          50KB

                                          MD5

                                          6fee1f69b6caa54d771a434bd2719beb

                                          SHA1

                                          7c46c718a398f765ab1626e34eca68029d6fd263

                                          SHA256

                                          5ac917537b3ed7079c400633ffcad610020da509493a1f9f98c69643b45bf403

                                          SHA512

                                          1f81e42b0bdf713d7f396567850b007eda6cf391580db7d2515d23fd47d696af101b6f39617f5e9cf90eb790de7a9c57c5af27b979857e49f582bd78448a24e2

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2177723727-746291240-1644359950-1000\0f5007522459c86e95ffcc62f32308f1_83f067b2-4236-4e0d-83e4-ef79b7da67b0
                                          Filesize

                                          46B

                                          MD5

                                          d898504a722bff1524134c6ab6a5eaa5

                                          SHA1

                                          e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

                                          SHA256

                                          878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

                                          SHA512

                                          26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\ssfax.exe
                                          Filesize

                                          23KB

                                          MD5

                                          7f9b9484cfcb33be75b0d1cd17aa562b

                                          SHA1

                                          7086afa606c7e5211e5ee112695e641650502684

                                          SHA256

                                          0184b4f25bb27328803dae537c07ad8c5ea11b149a7293840b4b36701cec80a1

                                          SHA512

                                          258b90a5a3513d98876c3506daf5bcb8cf87588a7a201f804b219bb1f76e4768ce8a36793090e93b763fe121fbc2c0d886f7df9406d3799b45d6447c247d4db1

                                          Download Submit

                                        • C:\Users\Admin\Desktop\Exploit.HWP.Agent.ac-0327c1cf8c7c700d4674f045577c273fdeacd1db9cb7d52a9121e65517208757.exe
                                          Filesize

                                          46KB

                                          MD5

                                          1c669d4b2bea6b56dd6e00adabc6319f

                                          SHA1

                                          5939729a5dfe8b09cf093d47b7606b2055c8f182

                                          SHA256

                                          0327c1cf8c7c700d4674f045577c273fdeacd1db9cb7d52a9121e65517208757

                                          SHA512

                                          a4e8dac13efeda94382d41c82c00137d13c67a16748f3348561daf32b10a4a7698af2cccbda90410fc52fdd31eea38adb75373a2a3fd2811f16742e663c45291

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Androm.gen-01fcf0e844ec177aa8e07cbdc1cd0bd5bbd7ef38b8335b58a2eb383b83885f1c.exe
                                          Filesize

                                          918KB

                                          MD5

                                          b52fbac548ebe7f8f074b2db88bda94b

                                          SHA1

                                          65daa01081d1906badb004561fdb9b24278e7fbd

                                          SHA256

                                          01fcf0e844ec177aa8e07cbdc1cd0bd5bbd7ef38b8335b58a2eb383b83885f1c

                                          SHA512

                                          f27e9a59fd63acd2681173ed66aefd9b74245f92b1785541bbd03aef72146df22f65d636830e6034bda33f63b89e475477f6faf42ebd7fd03a32250308c3fdeb

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Exploit.MSOffice.Generic-018eb907ef95665f637c89299de32991f5c667e51b4126aa813bbb2fd910057a.exe
                                          Filesize

                                          734KB

                                          MD5

                                          3b29507d52957460c748df1d250b45fc

                                          SHA1

                                          5e424faf2d00c5ab4b08768553d8dd2e525bc326

                                          SHA256

                                          018eb907ef95665f637c89299de32991f5c667e51b4126aa813bbb2fd910057a

                                          SHA512

                                          dd18b77b82b1bcba36c0e24acca17cf6aad23ce2b0d33ec30e3f45a9d5967b521efcaa66a09b532ed8ccc0d956421307f9faf517b9104756d43be89e05a00a79

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-HackTool.Win32.Inject.heur-003645e2686bf863585f95532e847dfe8f3b791c5b36f1a02ea2060f97b12125.exe
                                          Filesize

                                          11KB

                                          MD5

                                          9c9e9223adf557932fd7e93bb819eb15

                                          SHA1

                                          c6a95b93490ae2fbd5349f26e3bea12b670b6a15

                                          SHA256

                                          003645e2686bf863585f95532e847dfe8f3b791c5b36f1a02ea2060f97b12125

                                          SHA512

                                          1188110eb7e11f0e4e40eb3263829f3bb812fa387eebf44e6066e8ef687d08cad6c726e078bca178a5592dd8d33ae23bdff7820c4a51abb7bafde680fa12a6eb

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-03be3fca4c09700d4185cffca49b666c9bc8c522ee6acb8fc625f9e5c1bbc42a.exe
                                          Filesize

                                          448KB

                                          MD5

                                          70a2459efcbfb0be0dd05f9329dc5dd2

                                          SHA1

                                          497a5e62ea913b2e5d302fcb45ee78c587ab63a1

                                          SHA256

                                          03be3fca4c09700d4185cffca49b666c9bc8c522ee6acb8fc625f9e5c1bbc42a

                                          SHA512

                                          5ccd6a9f7cc952109e5f77a52824d5c90dddb66af22cd253cd7835d6e0a29b25763541b42ce2db8c029ad4c7c3e6dfa3a8899fc8834a112f7facdb9fd0d7c2c9

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-016a89b89b40fe5953e21affdecb93c13a479ee2fbcf5125dfa09d1b2930deb2.exe
                                          Filesize

                                          212KB

                                          MD5

                                          3f509755c70aa28fa48d07efa3941485

                                          SHA1

                                          6acca6e5ba51b303054a5a8468be4b14d5f0a225

                                          SHA256

                                          016a89b89b40fe5953e21affdecb93c13a479ee2fbcf5125dfa09d1b2930deb2

                                          SHA512

                                          5ba4e16f44012c8850babb2d371d8a435496fc432bbafe233611958e05e66d4cb1522b03b64a4133e877c9703208ca6825781c29bdc0e3fdd080687978166aa6

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-03bae674c28c66f112d3623d12cd6712cc03cc6f2a3e1719bc2ad433abddddc0.exe
                                          Filesize

                                          72KB

                                          MD5

                                          fb149cea2465da7b81bcad3c0b039aad

                                          SHA1

                                          f9ce0965781c42d3685474c69e644d0a4e9a10b3

                                          SHA256

                                          03bae674c28c66f112d3623d12cd6712cc03cc6f2a3e1719bc2ad433abddddc0

                                          SHA512

                                          c1ff9d22d7dbf3248ab0af58b3b16a2cce7c4aa2f100a39db135e4f826e0ee44ad78cb04500cf1d01cef468e0806fef821a723671f7058d2679318581f5fd2f9

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-Downloader.Script.Generic-02dfcb241425a1573bdaa28cefb98b7ad06913ea17c20ab173ead3402c03e12f.exe
                                          Filesize

                                          242KB

                                          MD5

                                          b63152a1a206072611f93604df376461

                                          SHA1

                                          ef8070c776f3afe6783f6c23e21a4d22ab564f18

                                          SHA256

                                          02dfcb241425a1573bdaa28cefb98b7ad06913ea17c20ab173ead3402c03e12f

                                          SHA512

                                          c11a1d563ceb02fbd1ce9c92879e80165e53fa855b5feadbc7ccfaf7b7876eee35d9bde57fe60d3c1bf3ee82ec5cad72789f1ae8f59d88dc06958da3d2c681a0

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-Downloader.Script.Generic-04266111b8aa0890a65bbdcc990bd92c054ccfe06d3ecadd00df1dfab2a395b2.exe
                                          Filesize

                                          159KB

                                          MD5

                                          16bab045e84776af3d4366121773b8b6

                                          SHA1

                                          e342c801d67deb92880702885543587591fc875a

                                          SHA256

                                          04266111b8aa0890a65bbdcc990bd92c054ccfe06d3ecadd00df1dfab2a395b2

                                          SHA512

                                          37dc32e71bd0a07ce60e3fa739ac742ea44737c9763b2431958db44335f84d6d62ed30633d6500a2b45b442ca428a7c7b27cc746be328ac75bd02579bf07fc41

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-GameThief.Win32.OnLineGames.gen-013c053bbbd1b145ff848a085f247191722f5409953776658732397393e9b825.exe
                                          Filesize

                                          4.2MB

                                          MD5

                                          f75d1f78ded764d93ec696b65b8ab3ef

                                          SHA1

                                          8a8ded939cc8e6fb26946381ba9b74651e5e71c3

                                          SHA256

                                          013c053bbbd1b145ff848a085f247191722f5409953776658732397393e9b825

                                          SHA512

                                          b7ca47be17a327c33decb9a917c10993d67efe3eab7b3c3f20adab11f878298a07e66a1d24078f1eb3b39869b89e8aedf1aff1d8b8191cc97b79943574cb68b5

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-GameThief.Win32.OnLineGames.gen-025c02b41a8f743e5787b57e74631316db62317c41845402f3ad5e0575b6586e.exe
                                          Filesize

                                          3.6MB

                                          MD5

                                          a41b98ef5c125631981eb69609d5224f

                                          SHA1

                                          5f6ed8d8ca8e609a432ccabf206461abcf689f65

                                          SHA256

                                          025c02b41a8f743e5787b57e74631316db62317c41845402f3ad5e0575b6586e

                                          SHA512

                                          821b05a96467c065cbdae0a6effc78720c6b28ed49b058b9fec66d68735eb60a80fadfc49654e044ef97708d40e54b4a852ed598735f5624c62d962ac79b2a8b

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e.exe
                                          Filesize

                                          871KB

                                          MD5

                                          8d4fb7606e6270b7190b97f382993b42

                                          SHA1

                                          c4f94218183dd65573fc143e2051b776c3c0e13d

                                          SHA256

                                          01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e

                                          SHA512

                                          01e9bbe174bb282a263b0f85d478e884186f2c8aa67f3a82af2bc1c27005817d40f43d64797cf96a30c6bba7766d8a0dffd1d2851f871abc1779ff1399cd7538

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan-Spy.MSIL.Noon.gen-0316213feaee3be7a81a92145a71590679f110345f0a0994b0f93a89da3a4b54.exe
                                          Filesize

                                          1.4MB

                                          MD5

                                          c1c430620e88eb5816ecf9df8a1a35d7

                                          SHA1

                                          10828ef660ee37e3174916b81391a0a1698aea87

                                          SHA256

                                          0316213feaee3be7a81a92145a71590679f110345f0a0994b0f93a89da3a4b54

                                          SHA512

                                          bf2da05e50f40f05b0689509571a8ffc86749092065405bc63f0cf5f1e2b7eabb512b3f2082ba941bcea383672e2978bb442c7dc783afe31c9d496edb05fb820

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Bsymem.gen-012ce9d03a7a1d40aff4df470e50884fc193dd3f4d483e6545f1123676828bac.exe
                                          Filesize

                                          942KB

                                          MD5

                                          30619d87ec29a17cb5aae379b9a524ea

                                          SHA1

                                          6317b11ea4347932bc47beedcba1e8bb8b3e3220

                                          SHA256

                                          012ce9d03a7a1d40aff4df470e50884fc193dd3f4d483e6545f1123676828bac

                                          SHA512

                                          d3975f4d9b62824677d02a6cfc894bcf7c156531236db0c21db050e697bd3eaea4df711deabfd6d75c73ae7290bd2392295711880161fbd829a8dd0f9cd1014b

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-01dba88e6444acb9df2aac52afd7819f95b84144e209b925c62eb78a3bdca378.exe
                                          Filesize

                                          837KB

                                          MD5

                                          bad2536cfd162cf6982cbe8aa0d2b2c5

                                          SHA1

                                          c3eb27a2b647db24e647db3b5c2f875126eb3991

                                          SHA256

                                          01dba88e6444acb9df2aac52afd7819f95b84144e209b925c62eb78a3bdca378

                                          SHA512

                                          0ace142298ce4eebecb05d5a1b5ca5f1c5cd5f9fdeb7ef79306924579da935460d36bd91a21f12ed44532573f33fd7f6a5c39712eee72161a3f62a788db60ccd

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Injuke.gen-0026e51b3f6f58bc2fe6dcdd7725e323b2788614451bcdb534746597c5a92f22.exe
                                          Filesize

                                          538KB

                                          MD5

                                          f3897a74c013ad0633834a5ebd102dd5

                                          SHA1

                                          43fb70ca2cdd5f580b922c45c0ca1a00e3e084ae

                                          SHA256

                                          0026e51b3f6f58bc2fe6dcdd7725e323b2788614451bcdb534746597c5a92f22

                                          SHA512

                                          1b1add0b70d3ef36479736587bd8300d8944d4f0a559339e0aa6332427f25a2678f4c6fce8811a56b33c51a41754e1a7608aa6966b8a4065d0f0404e4db62c78

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Taskun.gen-047e9f8b825378da0ad294496cbed35ff024c2742993e6eb0d4a1bc94c6bdb02.exe
                                          Filesize

                                          770KB

                                          MD5

                                          9ad96d978ae35734ee4a81ff63d8b1c7

                                          SHA1

                                          8d5ef619f13d4b059cf69b21afaa686131649a4f

                                          SHA256

                                          047e9f8b825378da0ad294496cbed35ff024c2742993e6eb0d4a1bc94c6bdb02

                                          SHA512

                                          be3a03f67d8828c062f1feb333fbe681e08a510cc626c26af031d65e284f307dfdbcbf908d85dfdf2659acfb4f7aeeb1b3f158e36b6729cccfae1c828f64b60f

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan.MSOffice.SAgent.gen-00d004d041cd6d18ac2b3b26f53b642816578698bb96055a921f74a0e16aca23.exe
                                          Filesize

                                          251KB

                                          MD5

                                          b964810eed7c451662a8aa21c0629965

                                          SHA1

                                          2997e46cf5dbaba2072d53dfdd6438bde373d001

                                          SHA256

                                          00d004d041cd6d18ac2b3b26f53b642816578698bb96055a921f74a0e16aca23

                                          SHA512

                                          88dd8ef1d9059a7d99448ba31967f1903684a9a7a940f7c696744b4c0fb26f3acf2b2b9113d05ca676a8b105605661a85c0b70de021ce4998a33ac71401941ac

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan.Script.Generic-004c3419c6da0392a8cef0544eada3d615df4a91bf5888ccbe211dbe9c426b49.exe
                                          Filesize

                                          137KB

                                          MD5

                                          59952eb2d7f3e4169a661bf10aa073ec

                                          SHA1

                                          fb66b49f14e174011ef4d09e23eb30b2062ebf0f

                                          SHA256

                                          004c3419c6da0392a8cef0544eada3d615df4a91bf5888ccbe211dbe9c426b49

                                          SHA512

                                          dc403bff00572be18e5a816e0e54b3dfa79f780a9981e9ab9860f6a0e1055193885285e4f952ffdb4492e62fbee224095035b88b8eb778a077eb7d93c45f1f18

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan.VBS.SAgent.gen-02426893e1fb6b3cc4dba759e7d85a0da3696d4753921487b49bddc629d6ff77.exe
                                          Filesize

                                          2.6MB

                                          MD5

                                          63e31fd9190ac6115f7f0e86e55077ab

                                          SHA1

                                          36abaaf70244a713fd3033f64afd8823badd068e

                                          SHA256

                                          02426893e1fb6b3cc4dba759e7d85a0da3696d4753921487b49bddc629d6ff77

                                          SHA512

                                          0e5061b6162e32a71788b61f4e0d179370d3dc7c22238dd88c75049f93961772e7035dee298860e3e68e72d9f93f05381db5b1e109f66b5f34bf640203d7dc1e

                                          Download Submit

                                        • C:\Users\Admin\Desktop\HEUR-Trojan.Win32.Zenpak.pef-000ce16aa593d3de6ee74dc23d0ef231a77383c7545990d32c47f038314d0051.exe
                                          Filesize

                                          166KB

                                          MD5

                                          8692ca84b76d38ec5c260265413e4ca2

                                          SHA1

                                          04ae6c5ee39ae1f56bae5e91ecaafb7f7cbee5c7

                                          SHA256

                                          000ce16aa593d3de6ee74dc23d0ef231a77383c7545990d32c47f038314d0051

                                          SHA512

                                          d4af4f9597d7266a5b9962ceb89a10cc50b7c426fc49682ac50b4c21ae08cf78d015f1ce5cd21b9f54a5591d475ced11195b45bae69ac918a64c910e434a608d

                                          Download Submit

                                        • C:\Users\Admin\Downloads\Bazaar.2020.09.7z
                                          Filesize

                                          29.7MB

                                          MD5

                                          322e0876091a361585f2e4735a43614e

                                          SHA1

                                          48c639f95c2a7d68af535eb70c736b82c2a51bf2

                                          SHA256

                                          3396018004b864a95870d88257e206be73bf4a3135d3e94ad8f2bd8ec1646f1e

                                          SHA512

                                          62f4327d34f9c2e3211fa101045592fb5f89aaef08b04f9b22334bb7e9de55342ae07f9fe7e46e5e71775de525e970d8c94cb029caaecbe99453133db278f1df

                                          Download Submit

                                        • C:\Windows\SysWOW64\drivers\8pDMKP.exe
                                          Filesize

                                          792KB

                                          MD5

                                          aede18b42b59f0cbedc5f3e9973aae11

                                          SHA1

                                          d520d02802513a5a8c203a5e5512f2de7f57f0b3

                                          SHA256

                                          9f00408fe17fc55a11ddfa25964e825a81688b1cbb69b2965ce893703f5a5c3d

                                          SHA512

                                          12551c605a4094b5191067df9980c6693d302103018df1e66037ac9b0886a2d0145490c67d2801eba830b0db48953a2fceedd1fab7281c7fcf19c02ab8cd1cc5

                                          Download Submit

                                        • C:\Windows\SysWOW64\drivers\GmProtect-x64.sys
                                          Filesize

                                          112KB

                                          MD5

                                          99ba9e62cfa932adee5780676e1bf240

                                          SHA1

                                          32d795ca990d5fae422cd050eeb1989d8b1a2c8d

                                          SHA256

                                          87dc0976997f24e8358d6bc66572b179b3da778954d56ff6abb441bb7ae66dc3

                                          SHA512

                                          9658374e8bad95a414686228df90a592e3ce412fb8d28710710e01cc68fd56a49248632dcabd1ce5dad05a6ba10a07a7330360fbaeb459e0aac124f6cb758031

                                          Download Submit

                                        • C:\Windows\SysWOW64\drivers\ProtectApi.dll
                                          Filesize

                                          889KB

                                          MD5

                                          c13a78197d00f0fd112b4fa7da667cab

                                          SHA1

                                          e60fb9705758b84ec9fe41dbf183d76e5fe6f889

                                          SHA256

                                          8beea744227e22b52f3f8f4e627d6e20aca1eab57c38d5068dc2cd4a2a192f2e

                                          SHA512

                                          c42322e56e794c37585ba7bb73bef3a0189ee351aa23fddc6255e027c339436ceb1d93e81884662ccb62b71c15e45f68e5c54fe34488441d897f4ba2f9267abf

                                          Download Submit

                                        • memory/8-336-0x00000000055F0000-0x000000000565E000-memory.dmp

                                          Filesize

                                          440KB

                                          Download

                                        • memory/8-316-0x00000000052B0000-0x00000000052C0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/8-346-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/8-312-0x00000000007B0000-0x00000000008A2000-memory.dmp

                                          Filesize

                                          968KB

                                          Download

                                        • memory/8-340-0x0000000005160000-0x0000000005163000-memory.dmp

                                          Filesize

                                          12KB

                                          Download

                                        • memory/8-313-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/1040-506-0x0000000002310000-0x000000000231C000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/1040-500-0x0000000002200000-0x000000000220D000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/1212-192-0x0000000002240000-0x000000000224B000-memory.dmp

                                          Filesize

                                          44KB

                                          Download

                                        • memory/1212-191-0x00000000026A0000-0x00000000026AD000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/1212-196-0x00000000026B0000-0x00000000026BC000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/1920-206-0x0000000000590000-0x00000000005A2000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/1920-211-0x0000000000600000-0x0000000000610000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/1920-209-0x0000000000580000-0x000000000058F000-memory.dmp

                                          Filesize

                                          60KB

                                          Download

                                        • memory/1964-237-0x0000000000400000-0x000000000077E000-memory.dmp

                                          Filesize

                                          3.5MB

                                          Download

                                        • memory/1964-236-0x0000000002530000-0x0000000002531000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/2052-512-0x0000000000400000-0x0000000005FCC000-memory.dmp

                                          Filesize

                                          91.8MB

                                          Download

                                        • memory/2104-389-0x0000000000400000-0x000000000043C000-memory.dmp

                                          Filesize

                                          240KB

                                          Download

                                        • memory/2124-339-0x0000000000400000-0x0000000000466000-memory.dmp

                                          Filesize

                                          408KB

                                          Download

                                        • memory/2124-359-0x0000000005E20000-0x0000000005E38000-memory.dmp

                                          Filesize

                                          96KB

                                          Download

                                        • memory/2124-341-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/2244-285-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/2244-277-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/2244-289-0x0000000005920000-0x0000000005930000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2244-308-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/2244-278-0x0000000005920000-0x0000000005930000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2260-302-0x0000000001730000-0x0000000001740000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2260-301-0x000000006F1A0000-0x000000006F751000-memory.dmp

                                          Filesize

                                          5.7MB

                                          Download

                                        • memory/2260-287-0x0000000001730000-0x0000000001740000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2260-288-0x000000006F1A0000-0x000000006F751000-memory.dmp

                                          Filesize

                                          5.7MB

                                          Download

                                        • memory/2260-286-0x000000006F1A0000-0x000000006F751000-memory.dmp

                                          Filesize

                                          5.7MB

                                          Download

                                        • memory/2576-521-0x00000000023D0000-0x00000000023E2000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/2576-527-0x0000000002170000-0x0000000002180000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2580-443-0x0000000000400000-0x0000000000486000-memory.dmp

                                          Filesize

                                          536KB

                                          Download

                                        • memory/2924-496-0x0000000000400000-0x0000000005FCC000-memory.dmp

                                          Filesize

                                          91.8MB

                                          Download

                                        • memory/2968-270-0x0000000006010000-0x00000000065B4000-memory.dmp

                                          Filesize

                                          5.6MB

                                          Download

                                        • memory/2968-269-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/2968-271-0x00000000059B0000-0x0000000005A42000-memory.dmp

                                          Filesize

                                          584KB

                                          Download

                                        • memory/2968-272-0x0000000005B40000-0x0000000005B50000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2968-273-0x0000000005990000-0x000000000599A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/2968-274-0x000000000BB60000-0x000000000BBFC000-memory.dmp

                                          Filesize

                                          624KB

                                          Download

                                        • memory/2968-275-0x0000000005FB0000-0x0000000005FC2000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/2968-293-0x000000000E720000-0x000000000E7BA000-memory.dmp

                                          Filesize

                                          616KB

                                          Download

                                        • memory/2968-268-0x0000000000EC0000-0x0000000000FA0000-memory.dmp

                                          Filesize

                                          896KB

                                          Download

                                        • memory/2968-281-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/2968-282-0x0000000005B40000-0x0000000005B50000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2968-300-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/2968-292-0x000000000BD50000-0x000000000BDEC000-memory.dmp

                                          Filesize

                                          624KB

                                          Download

                                        • memory/3016-155-0x00000000022A0000-0x00000000022A1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/3016-158-0x0000000000400000-0x00000000004E8000-memory.dmp

                                          Filesize

                                          928KB

                                          Download

                                        • memory/3016-167-0x00000000022A0000-0x00000000022A1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/3016-160-0x0000000002460000-0x0000000002488000-memory.dmp

                                          Filesize

                                          160KB

                                          Download

                                        • memory/3016-166-0x0000000000400000-0x00000000004E8000-memory.dmp

                                          Filesize

                                          928KB

                                          Download

                                        • memory/3036-299-0x0000000005360000-0x0000000005370000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3036-317-0x0000000005360000-0x0000000005370000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3036-342-0x0000000005360000-0x0000000005370000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3036-315-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/3036-298-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/3036-319-0x0000000005360000-0x0000000005370000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3036-304-0x000000006F760000-0x000000006F772000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/3036-303-0x00000000063D0000-0x0000000006436000-memory.dmp

                                          Filesize

                                          408KB

                                          Download

                                        • memory/3036-314-0x0000000006DB0000-0x0000000006E00000-memory.dmp

                                          Filesize

                                          320KB

                                          Download

                                        • memory/3036-294-0x0000000000400000-0x0000000000486000-memory.dmp

                                          Filesize

                                          536KB

                                          Download

                                        • memory/3252-242-0x00000000024C0000-0x00000000024C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/3252-263-0x0000000000400000-0x000000000075C000-memory.dmp

                                          Filesize

                                          3.4MB

                                          Download

                                        • memory/3264-458-0x0000000000400000-0x000000000043C000-memory.dmp

                                          Filesize

                                          240KB

                                          Download

                                        • memory/3924-415-0x0000000000400000-0x000000000043C000-memory.dmp

                                          Filesize

                                          240KB

                                          Download

                                        • memory/4204-185-0x0000000002420000-0x000000000242B000-memory.dmp

                                          Filesize

                                          44KB

                                          Download

                                        • memory/4204-182-0x0000000002440000-0x000000000244C000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/4204-178-0x0000000002430000-0x000000000243D000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/4320-335-0x0000000005750000-0x0000000005AA4000-memory.dmp

                                          Filesize

                                          3.3MB

                                          Download

                                        • memory/4320-321-0x0000000004CF0000-0x0000000005318000-memory.dmp

                                          Filesize

                                          6.2MB

                                          Download

                                        • memory/4320-357-0x00000000046B0000-0x00000000046C0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4320-343-0x0000000006B00000-0x0000000006B32000-memory.dmp

                                          Filesize

                                          200KB

                                          Download

                                        • memory/4320-347-0x000000006CED0000-0x000000006CF1C000-memory.dmp

                                          Filesize

                                          304KB

                                          Download

                                        • memory/4320-358-0x00000000060F0000-0x000000000610E000-memory.dmp

                                          Filesize

                                          120KB

                                          Download

                                        • memory/4320-345-0x000000007F490000-0x000000007F4A0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4320-318-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/4320-338-0x0000000005B80000-0x0000000005BCC000-memory.dmp

                                          Filesize

                                          304KB

                                          Download

                                        • memory/4320-337-0x0000000005B30000-0x0000000005B4E000-memory.dmp

                                          Filesize

                                          120KB

                                          Download

                                        • memory/4320-325-0x0000000005460000-0x00000000054C6000-memory.dmp

                                          Filesize

                                          408KB

                                          Download

                                        • memory/4320-322-0x00000000053A0000-0x00000000053C2000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/4320-320-0x0000000004570000-0x00000000045A6000-memory.dmp

                                          Filesize

                                          216KB

                                          Download

                                        • memory/5004-307-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/5004-324-0x0000000072DA0000-0x0000000073550000-memory.dmp

                                          Filesize

                                          7.7MB

                                          Download

                                        • memory/5004-323-0x000000006F760000-0x000000006F772000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/5004-309-0x00000000056B0000-0x00000000056C0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download