Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    290s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/05/2024, 22:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    98b8a986c223f2cb071b41bdb24d0e577e1e34a0111ce7ed8d12f1d7885ee78e.exe

  • Size

    1.6MB

  • MD5

    257b7b6010eabdb818f58f7da1c4a6e2

  • SHA1

    f50aad02b8707f39788d775da1f5ef052476f474

  • SHA256

    98b8a986c223f2cb071b41bdb24d0e577e1e34a0111ce7ed8d12f1d7885ee78e

  • SHA512

    418c649620243fa46aa172f44481e2980746764c1c9ccd570b5025923703def5d5798d024ed862dec40d24be47a786df73e7cc2700a4061f2ec4fedc8c54cd09

  • SSDEEP

    49152:lq8aMhBNUQYV/0AO95+s1YHPexNOH3yPVVzWX6:lq8JhByZV875vUexNc3yPnd

Score
10/10
amadeygluptebalummaredlineriseproxmrigzgrat@cloudytteamtest1234discoverydropperevasionexecutioninfostealerloaderminerpersistenceratrootkitspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.93:58709

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

lumma

C2

https://holicisticscrarws.shop/api

https://boredimperissvieos.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 6 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • XMRig Miner payload 2 IoCs
    miner
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    evasion
  • Blocklisted process makes network request 10 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 5 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 44 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 10 IoCs
    evasiontrojan
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\98b8a986c223f2cb071b41bdb24d0e577e1e34a0111ce7ed8d12f1d7885ee78e.exe
    "C:\Users\Admin\AppData\Local\Temp\98b8a986c223f2cb071b41bdb24d0e577e1e34a0111ce7ed8d12f1d7885ee78e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
        "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:840
      • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
        "C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
          "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:304
          • C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
            "C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3488
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              6⤵
                PID:5056
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 836
                6⤵
                • Program crash
                PID:2352
            • C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
              "C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe"
              5⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3624
            • C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
              "C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:4912
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:4220
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                    PID:4624
                • C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe"
                  5⤵
                  • UAC bypass
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • System policy modification
                  PID:4104
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe" -Force
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2832
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                    6⤵
                      PID:748
                  • C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2280
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                      • Blocklisted process makes network request
                      PID:2508
                  • C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:5328
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                        PID:5368
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                          PID:5376
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          6⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5388
                          • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                            "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                            7⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5552
                          • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                            "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                            7⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5584
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                            7⤵
                              PID:5736
                              • C:\Windows\SysWOW64\choice.exe
                                choice /C Y /N /D Y /T 3
                                8⤵
                                  PID:2820
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 520
                              6⤵
                              • Program crash
                              PID:5404
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                            5⤵
                            • Loads dropped DLL
                            PID:5960
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                              6⤵
                              • Blocklisted process makes network request
                              • Loads dropped DLL
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5980
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show profiles
                                7⤵
                                  PID:6000
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\735606991074_Desktop.zip' -CompressionLevel Optimal
                                  7⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5280
                            • C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe"
                              5⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:5124
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                                6⤵
                                  PID:5324
                                  • C:\Windows\SysWOW64\sc.exe
                                    Sc stop GameServerClient
                                    7⤵
                                    • Launches sc.exe
                                    PID:5684
                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                    GameService remove GameServerClient confirm
                                    7⤵
                                    • Executes dropped EXE
                                    PID:5744
                                  • C:\Windows\SysWOW64\sc.exe
                                    Sc delete GameSyncLink
                                    7⤵
                                    • Launches sc.exe
                                    PID:6016
                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                    GameService remove GameSyncLink confirm
                                    7⤵
                                    • Executes dropped EXE
                                    PID:6044
                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                    GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    PID:2876
                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                    GameService start GameSyncLink
                                    7⤵
                                    • Executes dropped EXE
                                    PID:6028
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                                  6⤵
                                    PID:2508
                                    • C:\Windows\SysWOW64\sc.exe
                                      Sc stop GameServerClientC
                                      7⤵
                                      • Launches sc.exe
                                      PID:828
                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                      GameService remove GameServerClientC confirm
                                      7⤵
                                      • Executes dropped EXE
                                      PID:4972
                                    • C:\Windows\SysWOW64\sc.exe
                                      Sc delete PiercingNetLink
                                      7⤵
                                      • Launches sc.exe
                                      PID:6116
                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                      GameService remove PiercingNetLink confirm
                                      7⤵
                                      • Executes dropped EXE
                                      PID:6112
                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                      GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      PID:1324
                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                      GameService start PiercingNetLink
                                      7⤵
                                      • Executes dropped EXE
                                      PID:5248
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                                    6⤵
                                      PID:5812
                                      • C:\Windows\SysWOW64\sc.exe
                                        Sc delete GameSyncLinks
                                        7⤵
                                        • Launches sc.exe
                                        PID:5348
                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                        GameService remove GameSyncLinks confirm
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5740
                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                        GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5940
                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                        GameService start GameSyncLinks
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4560
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                      6⤵
                                        PID:5592
                                    • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      PID:5128
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe" /F
                                        6⤵
                                        • Creates scheduled task(s)
                                        PID:6112
                                      • C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:5752
                                        • C:\Users\Admin\AppData\Local\Temp\u4fs.0.exe
                                          "C:\Users\Admin\AppData\Local\Temp\u4fs.0.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Checks processor information in registry
                                          PID:4344
                                        • C:\Users\Admin\AppData\Local\Temp\u4fs.1.exe
                                          "C:\Users\Admin\AppData\Local\Temp\u4fs.1.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Checks SCSI registry key(s)
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:2720
                                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                                            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                                            8⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5736
                                      • C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Checks SCSI registry key(s)
                                        PID:2892
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 492
                                          7⤵
                                          • Program crash
                                          PID:1440
                                      • C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5740
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -nologo -noprofile
                                          7⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5344
                                        • C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                          7⤵
                                          • Windows security bypass
                                          • Executes dropped EXE
                                          • Windows security modification
                                          • Adds Run key to start application
                                          • Checks for VirtualBox DLLs, possible anti-VM trick
                                          • Drops file in Windows directory
                                          • Modifies data under HKEY_USERS
                                          PID:5624
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            8⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1384
                                          • C:\Windows\System32\cmd.exe
                                            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                            8⤵
                                              PID:1304
                                              • C:\Windows\system32\netsh.exe
                                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                9⤵
                                                • Modifies Windows Firewall
                                                • Modifies data under HKEY_USERS
                                                PID:5416
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              8⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4664
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              8⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5484
                                            • C:\Windows\rss\csrss.exe
                                              C:\Windows\rss\csrss.exe
                                              8⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Manipulates WinMonFS driver.
                                              • Drops file in Windows directory
                                              PID:624
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                9⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Drops file in System32 directory
                                                • Modifies data under HKEY_USERS
                                                PID:3128
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                9⤵
                                                • Creates scheduled task(s)
                                                PID:5576
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks /delete /tn ScheduledUpdate /f
                                                9⤵
                                                  PID:5760
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -nologo -noprofile
                                                  9⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Drops file in System32 directory
                                                  • Modifies data under HKEY_USERS
                                                  PID:3608
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -nologo -noprofile
                                                  9⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Drops file in System32 directory
                                                  • Modifies data under HKEY_USERS
                                                  PID:5668
                                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                  9⤵
                                                    PID:4568
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                    9⤵
                                                    • Creates scheduled task(s)
                                                    PID:4224
                                                  • C:\Windows\windefender.exe
                                                    "C:\Windows\windefender.exe"
                                                    9⤵
                                                      PID:3988
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                        10⤵
                                                          PID:356
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:3184
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                                5⤵
                                                • Blocklisted process makes network request
                                                • Loads dropped DLL
                                                PID:5888
                                          • C:\Users\Admin\AppData\Local\Temp\1000020001\d85e0e52c8.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1000020001\d85e0e52c8.exe"
                                            3⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            PID:3416
                                          • C:\Users\Admin\1000021002\6beefcba37.exe
                                            "C:\Users\Admin\1000021002\6beefcba37.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of WriteProcessMemory
                                            PID:1440
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
                                              4⤵
                                              • Enumerates system info in registry
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of WriteProcessMemory
                                              PID:3572
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9aa8f9758,0x7ff9aa8f9768,0x7ff9aa8f9778
                                                5⤵
                                                  PID:4448
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:2
                                                  5⤵
                                                    PID:2824
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:8
                                                    5⤵
                                                      PID:656
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2032 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:8
                                                      5⤵
                                                        PID:2996
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:1
                                                        5⤵
                                                          PID:200
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:1
                                                          5⤵
                                                            PID:884
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4388 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:1
                                                            5⤵
                                                              PID:504
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:8
                                                              5⤵
                                                                PID:4904
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:8
                                                                5⤵
                                                                  PID:2344
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4728 --field-trial-handle=1724,i,10145486206899444686,8369535682901171676,131072 /prefetch:8
                                                                  5⤵
                                                                    PID:2268
                                                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                            1⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Checks whether UAC is enabled
                                                            PID:5072
                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                            1⤵
                                                              PID:3184
                                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                              "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:6020
                                                              • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:5200
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                2⤵
                                                                  PID:5280
                                                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:5148
                                                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:2944
                                                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:1460
                                                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:1292
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  2⤵
                                                                    PID:5584
                                                                  • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                    "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    PID:2088
                                                                  • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                    "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    PID:5740
                                                                  • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                    "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                    2⤵
                                                                      PID:5028
                                                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                    "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5180
                                                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:1532
                                                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:2468
                                                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:5072
                                                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:2724
                                                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:5228
                                                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:2284
                                                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:4056
                                                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                      2⤵
                                                                        PID:5616
                                                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5784
                                                                      • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                        "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:5944
                                                                      • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                        "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:5196
                                                                      • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                        "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:1576
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        2⤵
                                                                          PID:4912
                                                                        • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                          "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:3900
                                                                        • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                          "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:5796
                                                                        • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                          "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:3348
                                                                        • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                          "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                          2⤵
                                                                            PID:4144
                                                                          • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                            "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                            2⤵
                                                                              PID:1512
                                                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            PID:428
                                                                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            PID:776
                                                                          • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            PID:2160
                                                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            PID:5164
                                                                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            PID:3012
                                                                          • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            PID:2032
                                                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            PID:5900
                                                                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Checks whether UAC is enabled
                                                                            PID:4996
                                                                          • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                            1⤵
                                                                              PID:224
                                                                            • C:\Windows\windefender.exe
                                                                              C:\Windows\windefender.exe
                                                                              1⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:164
                                                                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                              1⤵
                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                              • Checks BIOS information in registry
                                                                              • Identifies Wine through registry keys
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              PID:3932
                                                                            • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                              1⤵
                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                              • Checks BIOS information in registry
                                                                              • Checks whether UAC is enabled
                                                                              PID:1556
                                                                            • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                              1⤵
                                                                                PID:804

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Reconnaissance

                                                                              Resource Development

                                                                              Initial Access

                                                                              Execution

                                                                              Command and Scripting Interpreter

                                                                              1
                                                                              T1059

                                                                              PowerShell

                                                                              1
                                                                              T1059.001

                                                                              Scheduled Task/Job

                                                                              1
                                                                              T1053

                                                                              System Services

                                                                              1
                                                                              T1569

                                                                              Service Execution

                                                                              1
                                                                              T1569.002

                                                                              Persistence

                                                                              Boot or Logon Autostart Execution

                                                                              1
                                                                              T1547

                                                                              Registry Run Keys / Startup Folder

                                                                              1
                                                                              T1547.001

                                                                              Create or Modify System Process

                                                                              2
                                                                              T1543

                                                                              Windows Service

                                                                              2
                                                                              T1543.003

                                                                              Scheduled Task/Job

                                                                              1
                                                                              T1053

                                                                              Privilege Escalation

                                                                              Abuse Elevation Control Mechanism

                                                                              1
                                                                              T1548

                                                                              Bypass User Account Control

                                                                              1
                                                                              T1548.002

                                                                              Boot or Logon Autostart Execution

                                                                              1
                                                                              T1547

                                                                              Registry Run Keys / Startup Folder

                                                                              1
                                                                              T1547.001

                                                                              Create or Modify System Process

                                                                              2
                                                                              T1543

                                                                              Windows Service

                                                                              2
                                                                              T1543.003

                                                                              Scheduled Task/Job

                                                                              1
                                                                              T1053

                                                                              Defense Evasion

                                                                              Abuse Elevation Control Mechanism

                                                                              1
                                                                              T1548

                                                                              Bypass User Account Control

                                                                              1
                                                                              T1548.002

                                                                              Impair Defenses

                                                                              5
                                                                              T1562

                                                                              Disable or Modify System Firewall

                                                                              1
                                                                              T1562.004

                                                                              Disable or Modify Tools

                                                                              3
                                                                              T1562.001

                                                                              Modify Registry

                                                                              6
                                                                              T1112

                                                                              Subvert Trust Controls

                                                                              1
                                                                              T1553

                                                                              Install Root Certificate

                                                                              1
                                                                              T1553.004

                                                                              Virtualization/Sandbox Evasion

                                                                              2
                                                                              T1497

                                                                              Credential Access

                                                                              Unsecured Credentials

                                                                              5
                                                                              T1552

                                                                              Credentials In Files

                                                                              4
                                                                              T1552.001

                                                                              Credentials in Registry

                                                                              1
                                                                              T1552.002

                                                                              Discovery

                                                                              Peripheral Device Discovery

                                                                              1
                                                                              T1120

                                                                              Query Registry

                                                                              8
                                                                              T1012

                                                                              System Information Discovery

                                                                              7
                                                                              T1082

                                                                              Virtualization/Sandbox Evasion

                                                                              2
                                                                              T1497

                                                                              Lateral Movement

                                                                              Collection

                                                                              Data from Local System

                                                                              5
                                                                              T1005

                                                                              Command and Control

                                                                              Exfiltration

                                                                              Impact

                                                                              Service Stop

                                                                              1
                                                                              T1489

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                Filesize

                                                                                288KB

                                                                                MD5

                                                                                d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                SHA1

                                                                                e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                SHA256

                                                                                472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                SHA512

                                                                                1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                                Filesize

                                                                                2.5MB

                                                                                MD5

                                                                                e6943a08bb91fc3086394c7314be367d

                                                                                SHA1

                                                                                451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                                                                SHA256

                                                                                aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                                                                SHA512

                                                                                505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                                Filesize

                                                                                6.2MB

                                                                                MD5

                                                                                1bacbebf6b237c75dbe5610d2d9e1812

                                                                                SHA1

                                                                                3ca5768a9cf04a2c8e157d91d4a1b118668f5cf1

                                                                                SHA256

                                                                                c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d

                                                                                SHA512

                                                                                f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                                Filesize

                                                                                13.2MB

                                                                                MD5

                                                                                72b396a9053dff4d804e07ee1597d5e3

                                                                                SHA1

                                                                                5ec4fefa66771613433c17c11545c6161e1552d5

                                                                                SHA256

                                                                                d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                                                                SHA512

                                                                                ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\GameSyncLink\installg.bat
                                                                                Filesize

                                                                                284B

                                                                                MD5

                                                                                5dee3cbf941c5dbe36b54690b2a3c240

                                                                                SHA1

                                                                                82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                                                                SHA256

                                                                                98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                                                                SHA512

                                                                                9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\GameSyncLink\installm.bat
                                                                                Filesize

                                                                                218B

                                                                                MD5

                                                                                94b87b86dc338b8f0c4e5869496a8a35

                                                                                SHA1

                                                                                2584e6496d048068f61ac72f5c08b54ad08627c3

                                                                                SHA256

                                                                                2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                                                                SHA512

                                                                                b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                                                                Download Submit

                                                                              • C:\ProgramData\Are.docx
                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                a33e5b189842c5867f46566bdbf7a095

                                                                                SHA1

                                                                                e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                SHA256

                                                                                5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                SHA512

                                                                                f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                Download Submit

                                                                              • C:\ProgramData\mozglue.dll
                                                                                Filesize

                                                                                593KB

                                                                                MD5

                                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                                SHA1

                                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                SHA256

                                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                SHA512

                                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                Download Submit

                                                                              • C:\Users\Admin\1000021002\6beefcba37.exe
                                                                                Filesize

                                                                                1.1MB

                                                                                MD5

                                                                                eb9d9984da999e896730c644df24b147

                                                                                SHA1

                                                                                0f10fa621aaedd8d30fd6bc9a95bc74a5bf20f68

                                                                                SHA256

                                                                                634a436f42cac1098bf608da65abe493f0b72f36d63827decc5254e9a6f44aea

                                                                                SHA512

                                                                                86dc1affbc8a0efd1b5e4597747dc5426673c12222e5e06337aec92f070200b51fd49463adc21a3209d625df6669563efa232a4bbd12f044c380b6fdf1c3a261

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                Filesize

                                                                                705B

                                                                                MD5

                                                                                99915efe984427aeb04ec29d931ce865

                                                                                SHA1

                                                                                e6cc11aceca664f46bdc5caf0120a3465979b2c8

                                                                                SHA256

                                                                                555d5346b8cd7877aa83f2ed08d9d3c862f65e8312595a59b51030d044fa9de7

                                                                                SHA512

                                                                                38918369dd872d283ca45efd946c8a7aa8a10aef8737f82ad9371c6f21249b9dd2d20fd3ad1095f7e898028dddccff280a3e1336b414a75f86932bea6dc612fa

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                d88ef195bd5d2777373cb4872dbfa375

                                                                                SHA1

                                                                                7129ee3dca9706258b813d1eb6d8ab25d5190c95

                                                                                SHA256

                                                                                f65b9c9d31e9e438148c909f079a164fe74295f540b7b78753f2a1e00dae964c

                                                                                SHA512

                                                                                08825fea45f6a0f99dec1fad57dfc328bb7e02e66ab12cc6d52b346b6637ce87fa92df7a7ab5cf1249e09a08c21d3036de6d6080d5ac5ee4827caaf4933d7a15

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                Filesize

                                                                                272KB

                                                                                MD5

                                                                                d662e1db511329e707ad7e6be3c162b6

                                                                                SHA1

                                                                                a73d63048e2acd501c9aac5077f8cea804ce4cbc

                                                                                SHA256

                                                                                855f7bea3b31e5da26eb4ff63508109c8cef646df0e7698b02abb03de1c6704a

                                                                                SHA512

                                                                                f0f6ad3b931b3f21853cb5f202f5af65e759b1aa7415f1b000363e732a430bcbd35c16b2a0690dbc98264880f5ee2516d8f5cbf354456a317737ebdc1dc5ba83

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                                                                                Filesize

                                                                                2B

                                                                                MD5

                                                                                99914b932bd37a50b983c5e7c90ae93b

                                                                                SHA1

                                                                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                SHA256

                                                                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                SHA512

                                                                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                8592ba100a78835a6b94d5949e13dfc1

                                                                                SHA1

                                                                                63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                                                                SHA256

                                                                                fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                                                                SHA512

                                                                                87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                8e41a8e6fdfaa33455ac694a5d1edd5a

                                                                                SHA1

                                                                                b57458638abad344ca97117581813174899aac67

                                                                                SHA256

                                                                                3427b10b7dc8283cad24aafe7589dcfb562fb056a54bfeddfeb5c5a5e3634704

                                                                                SHA512

                                                                                841f4741d3f9a7e7913f299c0e7501c0f1a6d880bf32203071bc7d7639f404365643ef70e9bfa25a2f99e29d4de2eec3a902afa2a2b2875b2b5e2bc7c858a096

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
                                                                                Filesize

                                                                                1.8MB

                                                                                MD5

                                                                                e30a7d55336c5da8caa04caff1ce114e

                                                                                SHA1

                                                                                e1ee65f973cb132b1609f2c39eace8e6fae85051

                                                                                SHA256

                                                                                32fa22b59bf2ce238b5f70a17ec19ecac7b03a283c628d1b684c7175394180e8

                                                                                SHA512

                                                                                10a746583f4cffa7b1008f9e40f2101bd9183dea124c2f9176e6a8a6660fe20c637b727e3bc2d138343359869b464a6e62b3f47a7213a02c80282b38b202eafc

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000020001\d85e0e52c8.exe
                                                                                Filesize

                                                                                2.1MB

                                                                                MD5

                                                                                8a11f3f7f1d24eb64175036a7c85654c

                                                                                SHA1

                                                                                40f198442835de440c378effe8f023cdf0d45e30

                                                                                SHA256

                                                                                d14edb85b599d38a15b2a266526803e5ebf80ab0ddc68e9ae80ea97ae9a85371

                                                                                SHA512

                                                                                a4a934f4f9229a4aa9dda50452af1bdb1e12f60ed310d77c991bcdcf9970b4e9dfbe39f00e2258e12021dda6f4b71712d475aba67d5ea5315fc12af5bfc91c66

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
                                                                                Filesize

                                                                                321KB

                                                                                MD5

                                                                                1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                SHA1

                                                                                33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                SHA256

                                                                                e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                SHA512

                                                                                53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
                                                                                Filesize

                                                                                304KB

                                                                                MD5

                                                                                8510bcf5bc264c70180abe78298e4d5b

                                                                                SHA1

                                                                                2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                                                SHA256

                                                                                096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                                                SHA512

                                                                                5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
                                                                                Filesize

                                                                                158KB

                                                                                MD5

                                                                                586f7fecacd49adab650fae36e2db994

                                                                                SHA1

                                                                                35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                SHA256

                                                                                cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                SHA512

                                                                                a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
                                                                                Filesize

                                                                                410KB

                                                                                MD5

                                                                                b76b8463d2167fa7f1feb1d562fe18ac

                                                                                SHA1

                                                                                9870f08014840f890ef57200a87775d5d199cb5f

                                                                                SHA256

                                                                                15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126

                                                                                SHA512

                                                                                c137dcebc7ea2da5a90898c73ddbf54370d168d7655acffa4cae62586b53e7064871d10b39af363b664529bb39fb60ae895ad61f2ed766f7390a874dbcf01361

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                                                                                Filesize

                                                                                564KB

                                                                                MD5

                                                                                f15a9cfa3726845017a7f91abe0a14f7

                                                                                SHA1

                                                                                5540ae40231fe4bf97e59540033b679dda22f134

                                                                                SHA256

                                                                                2dec75328413d4c278c119db42920fb183a88a5398d56ecc80c8cc74fba13071

                                                                                SHA512

                                                                                1c2af9608736ad6a02d093f769fe5ec5a06cb395a639e021d4ee3f6c46cebc8c101e7db1064984f801ad3bee65d81b95fe6e2e60c0ec949bb172ba9c455b9869

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                                                                                Filesize

                                                                                2.7MB

                                                                                MD5

                                                                                31841361be1f3dc6c2ce7756b490bf0f

                                                                                SHA1

                                                                                ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                SHA256

                                                                                222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                SHA512

                                                                                53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
                                                                                Filesize

                                                                                4.2MB

                                                                                MD5

                                                                                0f52e5e68fe33694d488bfe7a1a71529

                                                                                SHA1

                                                                                11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                                                                SHA256

                                                                                efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                                                                SHA512

                                                                                238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                Filesize

                                                                                418KB

                                                                                MD5

                                                                                0099a99f5ffb3c3ae78af0084136fab3

                                                                                SHA1

                                                                                0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                SHA256

                                                                                919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                SHA512

                                                                                5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe
                                                                                Filesize

                                                                                416KB

                                                                                MD5

                                                                                7b2875cb05e2096cdff530aa2b6fc6fc

                                                                                SHA1

                                                                                3db46544f57870426eaee8aa07bdd1e605c54b29

                                                                                SHA256

                                                                                b97edba2e0e81b4cc7d99a6776f80d50ce46952680c71b06428f6a3206c366f7

                                                                                SHA512

                                                                                0e0208f81195b6e5c3c01e2bed1cf38fb9221b0c86190da4e77763880da21d1b5f81c142dfcf27ee6ba8d7ff3383d1417d466a28c5bdc2f13a0dd498f4928441

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe
                                                                                Filesize

                                                                                245KB

                                                                                MD5

                                                                                eab8a9b818ef4e23bd92d7420ee33b77

                                                                                SHA1

                                                                                f4751ca6ff4d24c3bfada9ad043835a27f04d2f5

                                                                                SHA256

                                                                                130ef444d7e6cd446c98932ce64ec44b56653258965cea4180baba5b570e4b75

                                                                                SHA512

                                                                                ce77e817741e460aa813d4efe1750f24f149bb4f7df23a06b7986c4ef09dc5303d0e0585928b78bf2b12dfa76a93f5bc8873fa03c8febe82b9c960ad41d1ff9f

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                Filesize

                                                                                4.2MB

                                                                                MD5

                                                                                545627de023f52af8996a5cc7f503cac

                                                                                SHA1

                                                                                bc8e326cf8c7ccbf48f116569bb60722019caade

                                                                                SHA256

                                                                                f599fb4c2d32ce75f4ba504633e847b80fa294433adda975d1e752c3f9b6db46

                                                                                SHA512

                                                                                6e1d9223428321c7ac73e90edde1f22a355f4476a15f3dcfc9ae1c6700a19b694c3582dece44c54b0e7f60c3a1811003e9899c68ef2dabb0b54ae742b98ef87f

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                Filesize

                                                                                1.6MB

                                                                                MD5

                                                                                257b7b6010eabdb818f58f7da1c4a6e2

                                                                                SHA1

                                                                                f50aad02b8707f39788d775da1f5ef052476f474

                                                                                SHA256

                                                                                98b8a986c223f2cb071b41bdb24d0e577e1e34a0111ce7ed8d12f1d7885ee78e

                                                                                SHA512

                                                                                418c649620243fa46aa172f44481e2980746764c1c9ccd570b5025923703def5d5798d024ed862dec40d24be47a786df73e7cc2700a4061f2ec4fedc8c54cd09

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\TmpF32A.tmp
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                1420d30f964eac2c85b2ccfe968eebce

                                                                                SHA1

                                                                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                SHA256

                                                                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                SHA512

                                                                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eklpa4z5.hav.ps1
                                                                                Filesize

                                                                                1B

                                                                                MD5

                                                                                c4ca4238a0b923820dcc509a6f75849b

                                                                                SHA1

                                                                                356a192b7913b04c54574d18c28d46e6395428ab

                                                                                SHA256

                                                                                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                SHA512

                                                                                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                Filesize

                                                                                109KB

                                                                                MD5

                                                                                726cd06231883a159ec1ce28dd538699

                                                                                SHA1

                                                                                404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                SHA256

                                                                                12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                SHA512

                                                                                9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                                                Filesize

                                                                                1.2MB

                                                                                MD5

                                                                                15a42d3e4579da615a384c717ab2109b

                                                                                SHA1

                                                                                22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                                                SHA256

                                                                                3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                                                SHA512

                                                                                1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                Filesize

                                                                                304KB

                                                                                MD5

                                                                                0c582da789c91878ab2f1b12d7461496

                                                                                SHA1

                                                                                238bd2408f484dd13113889792d6e46d6b41c5ba

                                                                                SHA256

                                                                                a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                                                                SHA512

                                                                                a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                Filesize

                                                                                750KB

                                                                                MD5

                                                                                20ae0bb07ba77cb3748aa63b6eb51afb

                                                                                SHA1

                                                                                87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                                                                SHA256

                                                                                daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                                                                SHA512

                                                                                db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                                                                Download Submit

                                                                              • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                bc66475ee3b9ba37ec6828944dadd734

                                                                                SHA1

                                                                                9b82600ed9625cd85c114473a66b2160aea60b0a

                                                                                SHA256

                                                                                4c14b7589cf62d4a93c2e2e3f6b74c3b2424973df96e12dfbfb988cc6d29d409

                                                                                SHA512

                                                                                e45e908918f2c08cc2a1fe85f268c858a6bfa082c792ce893ef649aeffe7d570b791236f70f6f9e1ac2388173a6e5b76fe53a340685d0f1880bb2f28a440cbdf

                                                                                Download Submit

                                                                              • memory/304-630-0x0000000000D40000-0x00000000011E3000-memory.dmp

                                                                                Filesize

                                                                                4.6MB

                                                                                Download

                                                                              • memory/304-96-0x0000000000D40000-0x00000000011E3000-memory.dmp

                                                                                Filesize

                                                                                4.6MB

                                                                                Download

                                                                              • memory/428-648-0x0000000000D40000-0x00000000011E3000-memory.dmp

                                                                                Filesize

                                                                                4.6MB

                                                                                Download

                                                                              • memory/428-638-0x0000000000D40000-0x00000000011E3000-memory.dmp

                                                                                Filesize

                                                                                4.6MB

                                                                                Download

                                                                              • memory/776-650-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/776-639-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/840-63-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-42-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-56-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-54-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-53-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-51-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-49-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-47-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-45-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-59-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-57-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-52-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-50-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-48-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-46-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-44-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-40-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-61-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-43-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/840-55-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-68-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-69-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-60-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-62-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-64-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-67-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-66-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-65-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-70-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-58-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/840-71-0x0000000000400000-0x00000000009CB000-memory.dmp

                                                                                Filesize

                                                                                5.8MB

                                                                                Download

                                                                              • memory/1384-1120-0x0000000007D30000-0x0000000007D7B000-memory.dmp

                                                                                Filesize

                                                                                300KB

                                                                                Download

                                                                              • memory/1384-1150-0x0000000009240000-0x00000000092E5000-memory.dmp

                                                                                Filesize

                                                                                660KB

                                                                                Download

                                                                              • memory/1384-1144-0x000000006EEC0000-0x000000006EF0B000-memory.dmp

                                                                                Filesize

                                                                                300KB

                                                                                Download

                                                                              • memory/1384-1119-0x00000000076B0000-0x0000000007A00000-memory.dmp

                                                                                Filesize

                                                                                3.3MB

                                                                                Download

                                                                              • memory/1384-1145-0x000000006DE80000-0x000000006E1D0000-memory.dmp

                                                                                Filesize

                                                                                3.3MB

                                                                                Download

                                                                              • memory/1796-72-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-21-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-19-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-24-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-22-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-23-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-25-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-20-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-39-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/1796-18-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-0-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-17-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-2-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-1-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-4-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-6-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-3-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-7-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2316-5-0x00000000008C0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/2832-286-0x000002C15AF00000-0x000002C15AF76000-memory.dmp

                                                                                Filesize

                                                                                472KB

                                                                                Download

                                                                              • memory/2832-283-0x000002C15ABD0000-0x000002C15ABF2000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/3012-1050-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/3416-634-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-109-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-117-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-110-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-113-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-112-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-111-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-114-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-115-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3416-116-0x0000000000A30000-0x00000000010B0000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                                Download

                                                                              • memory/3488-130-0x0000000000730000-0x0000000000782000-memory.dmp

                                                                                Filesize

                                                                                328KB

                                                                                Download

                                                                              • memory/3624-158-0x0000000004ED0000-0x0000000004F62000-memory.dmp

                                                                                Filesize

                                                                                584KB

                                                                                Download

                                                                              • memory/3624-209-0x00000000064C0000-0x00000000064FE000-memory.dmp

                                                                                Filesize

                                                                                248KB

                                                                                Download

                                                                              • memory/3624-204-0x0000000006530000-0x000000000663A000-memory.dmp

                                                                                Filesize

                                                                                1.0MB

                                                                                Download

                                                                              • memory/3624-191-0x0000000006290000-0x00000000062AE000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                                Download

                                                                              • memory/3624-182-0x00000000059D0000-0x0000000005A46000-memory.dmp

                                                                                Filesize

                                                                                472KB

                                                                                Download

                                                                              • memory/3624-163-0x0000000004E30000-0x0000000004E3A000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                                Download

                                                                              • memory/3624-157-0x00000000053D0000-0x00000000058CE000-memory.dmp

                                                                                Filesize

                                                                                5.0MB

                                                                                Download

                                                                              • memory/3624-208-0x0000000006460000-0x0000000006472000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                                Download

                                                                              • memory/3624-372-0x0000000006960000-0x00000000069B0000-memory.dmp

                                                                                Filesize

                                                                                320KB

                                                                                Download

                                                                              • memory/3624-156-0x0000000000580000-0x00000000005D2000-memory.dmp

                                                                                Filesize

                                                                                328KB

                                                                                Download

                                                                              • memory/3624-550-0x0000000007EA0000-0x00000000083CC000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/3624-202-0x00000000069C0000-0x0000000006FC6000-memory.dmp

                                                                                Filesize

                                                                                6.0MB

                                                                                Download

                                                                              • memory/3624-344-0x0000000006760000-0x00000000067C6000-memory.dmp

                                                                                Filesize

                                                                                408KB

                                                                                Download

                                                                              • memory/3624-210-0x0000000006640000-0x000000000668B000-memory.dmp

                                                                                Filesize

                                                                                300KB

                                                                                Download

                                                                              • memory/3624-549-0x00000000077A0000-0x0000000007962000-memory.dmp

                                                                                Filesize

                                                                                1.8MB

                                                                                Download

                                                                              • memory/3940-85-0x0000000000AE0000-0x0000000000F83000-memory.dmp

                                                                                Filesize

                                                                                4.6MB

                                                                                Download

                                                                              • memory/3940-95-0x0000000000AE0000-0x0000000000F83000-memory.dmp

                                                                                Filesize

                                                                                4.6MB

                                                                                Download

                                                                              • memory/4104-243-0x00000273A01B0000-0x00000273A01C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4104-277-0x00000273A1DA0000-0x00000273A1DFE000-memory.dmp

                                                                                Filesize

                                                                                376KB

                                                                                Download

                                                                              • memory/4104-276-0x00000273A0570000-0x00000273A0580000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4664-1396-0x000000006DE80000-0x000000006E1D0000-memory.dmp

                                                                                Filesize

                                                                                3.3MB

                                                                                Download

                                                                              • memory/4664-1395-0x000000006EFE0000-0x000000006F02B000-memory.dmp

                                                                                Filesize

                                                                                300KB

                                                                                Download

                                                                              • memory/4664-1401-0x0000000009A70000-0x0000000009B15000-memory.dmp

                                                                                Filesize

                                                                                660KB

                                                                                Download

                                                                              • memory/4664-1375-0x0000000008540000-0x000000000858B000-memory.dmp

                                                                                Filesize

                                                                                300KB

                                                                                Download

                                                                              • memory/4912-212-0x0000000000480000-0x00000000004AE000-memory.dmp

                                                                                Filesize

                                                                                184KB

                                                                                Download

                                                                              • memory/5072-34-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5072-32-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5072-31-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5072-28-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5072-30-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5072-36-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5072-33-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5072-29-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5072-27-0x0000000001250000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5164-1039-0x0000000000D40000-0x00000000011E3000-memory.dmp

                                                                                Filesize

                                                                                4.6MB

                                                                                Download

                                                                              • memory/5164-1048-0x0000000000D40000-0x00000000011E3000-memory.dmp

                                                                                Filesize

                                                                                4.6MB

                                                                                Download

                                                                              • memory/5280-505-0x00000255999F0000-0x00000255999FA000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                                Download

                                                                              • memory/5280-492-0x0000025599A00000-0x0000025599A12000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                                Download

                                                                              • memory/5344-667-0x0000000006D50000-0x0000000006DB6000-memory.dmp

                                                                                Filesize

                                                                                408KB

                                                                                Download

                                                                              • memory/5344-933-0x0000000009CA0000-0x0000000009CBA000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                                Download

                                                                              • memory/5344-689-0x0000000008BD0000-0x0000000008C0C000-memory.dmp

                                                                                Filesize

                                                                                240KB

                                                                                Download

                                                                              • memory/5344-727-0x0000000009AE0000-0x0000000009B13000-memory.dmp

                                                                                Filesize

                                                                                204KB

                                                                                Download

                                                                              • memory/5344-728-0x000000006EDE0000-0x000000006EE2B000-memory.dmp

                                                                                Filesize

                                                                                300KB

                                                                                Download

                                                                              • memory/5344-729-0x000000006EE30000-0x000000006F180000-memory.dmp

                                                                                Filesize

                                                                                3.3MB

                                                                                Download

                                                                              • memory/5344-730-0x0000000009AC0000-0x0000000009ADE000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                                Download

                                                                              • memory/5344-735-0x0000000009B20000-0x0000000009BC5000-memory.dmp

                                                                                Filesize

                                                                                660KB

                                                                                Download

                                                                              • memory/5344-740-0x0000000009D40000-0x0000000009DD4000-memory.dmp

                                                                                Filesize

                                                                                592KB

                                                                                Download

                                                                              • memory/5344-670-0x0000000007BB0000-0x0000000007BFB000-memory.dmp

                                                                                Filesize

                                                                                300KB

                                                                                Download

                                                                              • memory/5344-938-0x0000000009C80000-0x0000000009C88000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/5344-669-0x00000000076F0000-0x000000000770C000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/5344-668-0x0000000007860000-0x0000000007BB0000-memory.dmp

                                                                                Filesize

                                                                                3.3MB

                                                                                Download

                                                                              • memory/5344-664-0x0000000004330000-0x0000000004366000-memory.dmp

                                                                                Filesize

                                                                                216KB

                                                                                Download

                                                                              • memory/5344-666-0x0000000006CA0000-0x0000000006CC2000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/5344-665-0x0000000006FE0000-0x0000000007608000-memory.dmp

                                                                                Filesize

                                                                                6.2MB

                                                                                Download

                                                                              • memory/5388-333-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                Filesize

                                                                                1.6MB

                                                                                Download

                                                                              • memory/5552-592-0x000000001D8F0000-0x000000001D902000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                                Download

                                                                              • memory/5552-606-0x000000001F440000-0x000000001F966000-memory.dmp

                                                                                Filesize

                                                                                5.1MB

                                                                                Download

                                                                              • memory/5552-371-0x00000000008C0000-0x0000000000980000-memory.dmp

                                                                                Filesize

                                                                                768KB

                                                                                Download

                                                                              • memory/5552-591-0x000000001DA00000-0x000000001DB0A000-memory.dmp

                                                                                Filesize

                                                                                1.0MB

                                                                                Download

                                                                              • memory/5552-593-0x000000001D950000-0x000000001D98E000-memory.dmp

                                                                                Filesize

                                                                                248KB

                                                                                Download

                                                                              • memory/5552-594-0x000000001D910000-0x000000001D92E000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                                Download

                                                                              • memory/5552-605-0x000000001E2E0000-0x000000001E4A2000-memory.dmp

                                                                                Filesize

                                                                                1.8MB

                                                                                Download

                                                                              • memory/5584-343-0x0000000000560000-0x00000000005B2000-memory.dmp

                                                                                Filesize

                                                                                328KB

                                                                                Download

                                                                              • memory/5736-1013-0x0000013ACDE50000-0x0000013ACDE5A000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                                Download

                                                                              • memory/5736-1010-0x0000013ACDE80000-0x0000013ACDE8C000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/5736-1027-0x0000013AEB8C0000-0x0000013AEB8E2000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/5736-1031-0x0000013AEB8E0000-0x0000013AEB8EC000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/5736-1030-0x0000013AEB930000-0x0000013AEB980000-memory.dmp

                                                                                Filesize

                                                                                320KB

                                                                                Download

                                                                              • memory/5736-1014-0x0000013AE6B90000-0x0000013AE6BBA000-memory.dmp

                                                                                Filesize

                                                                                168KB

                                                                                Download

                                                                              • memory/5736-1012-0x0000013ACDEF0000-0x0000013ACDF14000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                                Download

                                                                              • memory/5736-1011-0x0000013ACDE70000-0x0000013ACDE84000-memory.dmp

                                                                                Filesize

                                                                                80KB

                                                                                Download

                                                                              • memory/5736-1009-0x0000013ACDD90000-0x0000013ACDDA0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/5736-1026-0x0000013AEB8B0000-0x0000013AEB8BA000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                                Download

                                                                              • memory/5736-1008-0x0000013AE6850000-0x0000013AE6960000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/5736-1005-0x0000013AC8750000-0x0000013ACC048000-memory.dmp

                                                                                Filesize

                                                                                57.0MB

                                                                                Download

                                                                              • memory/5736-1025-0x0000013AEAFB0000-0x0000013AEAFE8000-memory.dmp

                                                                                Filesize

                                                                                224KB

                                                                                Download

                                                                              • memory/5736-1024-0x0000013AEAF30000-0x0000013AEAF38000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/5736-1022-0x0000013AE6E50000-0x0000013AE7150000-memory.dmp

                                                                                Filesize

                                                                                3.0MB

                                                                                Download

                                                                              • memory/5736-1018-0x0000013ACDE60000-0x0000013ACDE6A000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                                Download

                                                                              • memory/5736-1017-0x0000013AE6CF0000-0x0000013AE6D52000-memory.dmp

                                                                                Filesize

                                                                                392KB

                                                                                Download

                                                                              • memory/5736-1016-0x0000013AE6C70000-0x0000013AE6CEA000-memory.dmp

                                                                                Filesize

                                                                                488KB

                                                                                Download

                                                                              • memory/5736-1015-0x0000013AE6BC0000-0x0000013AE6C72000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download