Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 17:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b57f0f54d65712e116d7fdbd77a6c2bf1c6f871df16453571b8499c0312604ca.exe

  • Size

    1.8MB

  • MD5

    9d7e95b132835b099f4b00cae7863e2d

  • SHA1

    9e59088cfaa673241a49dbdfbb7f1b0462cb5da7

  • SHA256

    b57f0f54d65712e116d7fdbd77a6c2bf1c6f871df16453571b8499c0312604ca

  • SHA512

    ddfe237647bf44ef7a925de439eb55385696fdb5b15dde539f3cfe18122305149f9dc2b6a463f5948934e0d852c29706b74fac5781d125e0ccba30a3b1b490fe

  • SSDEEP

    24576:fU0Hb8WCzvwyS2LzpLQNUbz/xkTbl37a5qFXM5s4GplYx2uqYVKEsX/B/q:fVQwyS2L+NUfJUGqVM542xC/q

Score
10/10
amadeygluptebariseprozgratdiscoverydropperevasionexecutionloaderpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.93:58709

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 21 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 5 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 41 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b57f0f54d65712e116d7fdbd77a6c2bf1c6f871df16453571b8499c0312604ca.exe
    "C:\Users\Admin\AppData\Local\Temp\b57f0f54d65712e116d7fdbd77a6c2bf1c6f871df16453571b8499c0312604ca.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3156
      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
        "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2956
      • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
        "C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3536
        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
          "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3436
          • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
            "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4020
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4892
            • C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe
              "C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:4692
              • C:\Users\Admin\AppData\Local\Temp\u3mc.0.exe
                "C:\Users\Admin\AppData\Local\Temp\u3mc.0.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:5260
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 2016
                  8⤵
                  • Program crash
                  PID:4180
              • C:\Users\Admin\AppData\Local\Temp\u3mc.1.exe
                "C:\Users\Admin\AppData\Local\Temp\u3mc.1.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:5816
                • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                  "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                  8⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5476
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1236
                7⤵
                • Program crash
                PID:5948
            • C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe"
              6⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3032
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 352
                7⤵
                • Program crash
                PID:5624
            • C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe
              "C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4656
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5488
              • C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe
                "C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe"
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                PID:5312
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  8⤵
                  • Drops file in System32 directory
                  • Command and Scripting Interpreter: PowerShell
                  • Modifies data under HKEY_USERS
                  PID:5724
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  8⤵
                    PID:4108
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      9⤵
                      • Modifies Windows Firewall
                      PID:1064
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    8⤵
                    • Drops file in System32 directory
                    • Command and Scripting Interpreter: PowerShell
                    • Modifies data under HKEY_USERS
                    PID:3312
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    8⤵
                    • Drops file in System32 directory
                    • Command and Scripting Interpreter: PowerShell
                    • Modifies data under HKEY_USERS
                    PID:5812
                  • C:\Windows\rss\csrss.exe
                    C:\Windows\rss\csrss.exe
                    8⤵
                    • Executes dropped EXE
                    PID:5508
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      9⤵
                      • Drops file in System32 directory
                      • Command and Scripting Interpreter: PowerShell
                      • Modifies data under HKEY_USERS
                      PID:5992
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      9⤵
                      • Creates scheduled task(s)
                      PID:5212
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      9⤵
                        PID:5484
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        9⤵
                        • Drops file in System32 directory
                        • Command and Scripting Interpreter: PowerShell
                        • Modifies data under HKEY_USERS
                        PID:3228
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        9⤵
                        • Drops file in System32 directory
                        • Command and Scripting Interpreter: PowerShell
                        • Modifies data under HKEY_USERS
                        PID:3220
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        9⤵
                        • Executes dropped EXE
                        PID:4472
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                5⤵
                • Loads dropped DLL
                PID:4712
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                  6⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3612
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profiles
                    7⤵
                      PID:3220
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\775195409080_Desktop.zip' -CompressionLevel Optimal
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5232
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                  5⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  PID:5900
            • C:\Users\Admin\AppData\Local\Temp\1000020001\b8d2068480.exe
              "C:\Users\Admin\AppData\Local\Temp\1000020001\b8d2068480.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              PID:3564
            • C:\Users\Admin\1000021002\04daae2ed3.exe
              "C:\Users\Admin\1000021002\04daae2ed3.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1880
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
                4⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1868
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff895eccc40,0x7ff895eccc4c,0x7ff895eccc58
                  5⤵
                    PID:920
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1860,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1848 /prefetch:2
                    5⤵
                      PID:2632
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2236 /prefetch:3
                      5⤵
                        PID:4912
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2452 /prefetch:8
                        5⤵
                          PID:2604
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3176 /prefetch:1
                          5⤵
                            PID:1416
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3220 /prefetch:1
                            5⤵
                              PID:1600
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4516,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4704 /prefetch:8
                              5⤵
                                PID:2020
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4548 /prefetch:8
                                5⤵
                                  PID:4084
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3744,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3772 /prefetch:3
                                  5⤵
                                    PID:5656
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4668,i,6074276590802268951,18268907277608425798,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4896 /prefetch:8
                                    5⤵
                                    • Drops file in System32 directory
                                    PID:3292
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                            1⤵
                              PID:3940
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:2388
                              • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                PID:5276
                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5284
                              • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                1⤵
                                • Executes dropped EXE
                                PID:5556
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3032 -ip 3032
                                1⤵
                                  PID:5600
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4692 -ip 4692
                                  1⤵
                                    PID:5868
                                  • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                    C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                    1⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    PID:5412
                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                    C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                    1⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5336
                                  • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                    C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:5608
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5260 -ip 5260
                                    1⤵
                                      PID:976

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    1
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Defense Evasion

                                    Impair Defenses

                                    1
                                    T1562

                                    Disable or Modify System Firewall

                                    1
                                    T1562.004

                                    Modify Registry

                                    1
                                    T1112

                                    Virtualization/Sandbox Evasion

                                    2
                                    T1497

                                    Credential Access

                                    Unsecured Credentials

                                    5
                                    T1552

                                    Credentials In Files

                                    4
                                    T1552.001

                                    Credentials in Registry

                                    1
                                    T1552.002

                                    Discovery

                                    Peripheral Device Discovery

                                    1
                                    T1120

                                    Query Registry

                                    9
                                    T1012

                                    System Information Discovery

                                    8
                                    T1082

                                    Virtualization/Sandbox Evasion

                                    2
                                    T1497

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    5
                                    T1005

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\ProgramData\Are.docx
                                      Filesize

                                      11KB

                                      MD5

                                      a33e5b189842c5867f46566bdbf7a095

                                      SHA1

                                      e1c06359f6a76da90d19e8fd95e79c832edb3196

                                      SHA256

                                      5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                      SHA512

                                      f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                      Download Submit

                                    • C:\ProgramData\mozglue.dll
                                      Filesize

                                      593KB

                                      MD5

                                      c8fd9be83bc728cc04beffafc2907fe9

                                      SHA1

                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                      SHA256

                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                      SHA512

                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                      Download Submit

                                    • C:\ProgramData\nss3.dll
                                      Filesize

                                      2.0MB

                                      MD5

                                      1cc453cdf74f31e4d913ff9c10acdde2

                                      SHA1

                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                      SHA256

                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                      SHA512

                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                      Download Submit

                                    • C:\Users\Admin\1000021002\04daae2ed3.exe
                                      Filesize

                                      1.1MB

                                      MD5

                                      32ab440296dc6cf4c1fb3225455193b5

                                      SHA1

                                      3303070666889e955de30fdf1dd87dff635fbada

                                      SHA256

                                      f3581a978c12debc01d7afc4601e2a3c82171896c893da133eb19d75c74cba06

                                      SHA512

                                      13fd4db1269c37c0d2b5614d75ac82ecd4316123e73c6306ccca36748c010539042987cd0650bcbe0f56e5f953deb0c628514b5430cd09c05d03b4bb4859ba4b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                      Filesize

                                      649B

                                      MD5

                                      89c9a90177de6cf3c16fe68b1f51ec66

                                      SHA1

                                      02e0f7b7904ade330632db0cd51df7ca672c477b

                                      SHA256

                                      540bf18738268aa2562a274efd28c06b34f2c193b329bf5f7c856aec712f174e

                                      SHA512

                                      b1464a3b9e68979c07c094065a9e4ed995f17de1acfde6fa5476f0f9f0ff07aad538837add289e8f18b0379e84c95b1ee6c78e0bb21b7366c568971f97df5c03

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
                                      Filesize

                                      44KB

                                      MD5

                                      c1d24d8841afa38aabf38180f5e0fb12

                                      SHA1

                                      911364a4a5a87a0e3ec20b207d846de7c807d92c

                                      SHA256

                                      3ca988522f48cf863c709d141ad96694a5d8a6c45c319352b94c4eb9740028f4

                                      SHA512

                                      9f2454b1e03f84b7d543fd75a229de8a8d35564d33f9746693777f37fee7184da12b376956d4114d5bce5ccff6c0e7fb4a3971c32912caf472a13c78984dc16e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
                                      Filesize

                                      264KB

                                      MD5

                                      653ed06e0ca2c7cedc698b57e3770312

                                      SHA1

                                      1b857913f2bcdf9c6f5d07d2fed8cd348bbdce34

                                      SHA256

                                      da87fd66acc1e57bed28bf195c28fc4ea06a067a4a549a413ada254d8f7afe05

                                      SHA512

                                      d353c55550f5f6c67fd0d76d19c3d70c7b23929b29d5d3831123506898f9671588449a2057bbacf9f59a905dd7fd1e9ba7179021ea3ed64e9147ebd3cd9bb91e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
                                      Filesize

                                      1.0MB

                                      MD5

                                      d8f2703f6942e0a3dfcb990826530c47

                                      SHA1

                                      0b813635e0d697d2da004463a09a6feaccc5e7d6

                                      SHA256

                                      de2d8cb7f1f587ef76c7d18000e330f591cfe48e7e48b890b5c58ac7e1a3d579

                                      SHA512

                                      8fe51f299e33e2cb955dd25fad304e523bef8b71562c3669c56e5a4619f67b9ca0027f88b8e4e0d20912a5349b9717130fdc280655b340ced287c7f58f4e8931

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
                                      Filesize

                                      4.0MB

                                      MD5

                                      ebb62a712f670f830696563d1b9c93a5

                                      SHA1

                                      333f20f18e7d60e6f0a5cc76258e77a0f3b238d2

                                      SHA256

                                      625e369e2db168bdd5597434263da06fdc670e45edabe1df0c90ff89d434ecc6

                                      SHA512

                                      cada0ad1c4e050ab918b804759184f7777a0d4bdc820ba44d13927ba520133a2b0bd0054cbb4cb1100e250b4c356d44348610d9d787a7bbf4f2ee7cf97f80b5a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
                                      Filesize

                                      64KB

                                      MD5

                                      dce76c24cfcf00027fef60583b84bd94

                                      SHA1

                                      9ecc2c5bf2df35ba4544d6da247ca3a99561352a

                                      SHA256

                                      7f4439b335f44ac0fcff2b97596196260a6f7eda4e404d2c6f397c04737119db

                                      SHA512

                                      273b48c28ab0b6127798402cb5c568047eb9c89536ff8c9c2896f695a41e4553efa757d0229f0cfa8e3d947ea76bfd57193dcf9c12bd4a1a65fdf408ace2ecd9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
                                      Filesize

                                      32KB

                                      MD5

                                      17af549fe361b2cd9601d41055e860c0

                                      SHA1

                                      70722c8a36ef707dccbb1883556c3bcd9a0d0856

                                      SHA256

                                      a99b0281b3ac482c043b91077caaf54b92fa6a993e01843611c4c8bd2d2983a0

                                      SHA512

                                      2c9a2a6d99e6676c84e266c525dbe60d7b6c5e6c0879698883fbf71f114bdcb71e3f4be7e08d2be10a9ff776267ed51c141741e4e7f0e09ea3676ef188d8d6e3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                                      Filesize

                                      85KB

                                      MD5

                                      738012a772d2365a3bce7e26fc89d0b5

                                      SHA1

                                      b22ca0a5b9bdeab4728ce4e2f5cd0f97f8e0872e

                                      SHA256

                                      65e2e699ac2cb73aa8cc66dddd0460a38f16eed473e4ce3a487c828b1cae6d43

                                      SHA512

                                      47b7554071c4e80974ceb2b44ab9ee2e5dd520e0449bdc526f759a2f73f7c2dbc9317acb1241d6d59a81f3cd012095f818726a5cca245f2ab79802083ac1190d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                                      Filesize

                                      51KB

                                      MD5

                                      f61f0d4d0f968d5bba39a84c76277e1a

                                      SHA1

                                      aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

                                      SHA256

                                      57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

                                      SHA512

                                      6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
                                      Filesize

                                      36KB

                                      MD5

                                      cbbb5585439fb87a279a9bd5e725f089

                                      SHA1

                                      76dd9614fc2a2fee100aae142335f3fa755fc034

                                      SHA256

                                      08255d8744f3aa6f653286ba6071b83b9bcaf0f11c2386bf7a1ece7ee49195cb

                                      SHA512

                                      367c9a05e6bf82ec8045460c55572a81ceace69c075e05818691644331f3adcd114cd194c242ccbcc3ca15a85aaf6fae955162ad016a2c32fe69e3a3c4bdf0e3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                      Filesize

                                      264B

                                      MD5

                                      31cc070e26cdf867d7c2f030b4822f23

                                      SHA1

                                      507f2736baf02952a64ef684fc1e1564ca1608cb

                                      SHA256

                                      c1201aff17001a93048a50f61735eb93eb83981dfc32ec8f4bf8d39bec28914d

                                      SHA512

                                      7d351071ff56a399680b0c78a907b5e849825dbbb9522940ab87227c12e98181458919844da243969ac78265ce5be1f385a37b8f1db8ad2d40aa5bb195ec5908

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                      Filesize

                                      160KB

                                      MD5

                                      15c9d01048a711e95a6ba2861575f492

                                      SHA1

                                      d28227224fad9273c93b5dbbaf3919428c0a2676

                                      SHA256

                                      4db5b6d52d9ac0c28790f0d0c554a2f8f1b12e41ff5fd74f6d5ba524fe5224db

                                      SHA512

                                      00e72f84de8fc9fc871e73b832e1036da7852c49a48596302b9ebba8c997b7149d6e9471d2f2b138a463562dcf18854e76fcc9cba4cf5a880dca2c4be2afbf95

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                                      Filesize

                                      20KB

                                      MD5

                                      e81338a4a84a1bb051e7e262149e0a54

                                      SHA1

                                      dd198866c5cc5c7091caf60d441c6320d47f6c3a

                                      SHA256

                                      2f38692fb478854182892dfee6f414087c0eee8e8255fc0f35589390a75b655a

                                      SHA512

                                      86ec810aeed62232022a581ac868b12b2e77c0d8ab94b0dd6bbfafa5b9be7958c396c09f7458547c1fa2f02e5c95e6e7ea61d5d86fe610ce07eda1fec210ba0b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                      Filesize

                                      3KB

                                      MD5

                                      069e076a56227aff8f694e65ca69076f

                                      SHA1

                                      4e42be0ed64abfa3929af0546dc1610cfacd473d

                                      SHA256

                                      0f7f7ccb0d34edd89f08de0d85bb196a91eaa8c3b1a87b03d369ecfb9408eeb1

                                      SHA512

                                      47210b80715f6a0278fce24c41a5ba3bd7b749d8853683303f24650242ec8e0434a473011f3d3258a88bf2697efea4f10baee35ec65e6e9894b89f9c3a1f2d42

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
                                      Filesize

                                      36KB

                                      MD5

                                      ee6c1455054d0618a5146e66253a2fca

                                      SHA1

                                      6e3a9e50ff144d1cb5f29a5b293a36a21c491d9c

                                      SHA256

                                      dfc91bf49b7b492757f0af01e4838277865aa12c7c809886606f907331528259

                                      SHA512

                                      fd8e9d059bfd4e49098666de218349f4a7506455cdd964832dd2d7897c396ec1b1c659d58cf3c629bc1084a4282b31df3e98bdf591eac793c03fe2debd58b38a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                      Filesize

                                      2B

                                      MD5

                                      d751713988987e9331980363e24189ce

                                      SHA1

                                      97d170e1550eee4afc0af065b78cda302a97674c

                                      SHA256

                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                      SHA512

                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                      Filesize

                                      692B

                                      MD5

                                      3fe6ba60f529f542b3b423164e86f78f

                                      SHA1

                                      4c3c4fdc6ef6d65185f95597d28b12c4516baf5e

                                      SHA256

                                      38a7b998015e470be98c27bbfb6266fcb416cf9a4a0a2bc55e9335a36600e7a4

                                      SHA512

                                      198cf38a5526440037b7cc27d3aae505bfc4d76f83601e747b4f0344a3eb9028fbbb6bef834632d46a7e7c18c0216b5ae62f764b6bf1367cb8c54b0551049ec7

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      Filesize

                                      9KB

                                      MD5

                                      520280e3831edd6cbca130904d61ea34

                                      SHA1

                                      4b10e3ee9f6b69b9f5b5cd5e043683c692d93f36

                                      SHA256

                                      475319792d8610378135fa82daaf43c7b9710c59feed4b92fe16f730991478b2

                                      SHA512

                                      e0cc1bd1b4a12354109addd6988bef90aed46e9140cc7179b127bb12812c678759d12c5e16226d405858020872246b1d4838ef816e7787d4a2a1bce5bcb00576

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      Filesize

                                      9KB

                                      MD5

                                      406e953aaa4540bab34cc9251de73372

                                      SHA1

                                      8b955c9ecd68cbd2974e51aeded5d152c36f87dd

                                      SHA256

                                      b8e232ea001b2dbc52750b39179ecd15735e3eb5095895e87d7d1c8379937ff4

                                      SHA512

                                      442d302df9f4565202ced8b64014e6f754f66dfe545b1a6b76a115c659aea3cf6af593f19afcd5b4217145d5326b39b3b06e952ea10a2dc794152f45e7819b7a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      Filesize

                                      9KB

                                      MD5

                                      68c6c8eb0b35aae8dc52fae3c65123d9

                                      SHA1

                                      12c7712dacfb84a468c315e92361d0c0b9852232

                                      SHA256

                                      fa81fd41b910b5fe561581d4ab8eeaf57fedc9b8796268e3f1cd12ef31e425ce

                                      SHA512

                                      c6f0e4a4d897c98008bf05aa5c244bd5c67c791a47a70859a99283b1c59da7cf50df51d0e95b29b14e4241b458d1ac400c167db37ac1a11a46c8aefa7e58720e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      Filesize

                                      9KB

                                      MD5

                                      7b731422e8b2558ee5fe1c2df39b6a02

                                      SHA1

                                      2b52f0e03f8018c7f80e054f994e5d3d98eebbab

                                      SHA256

                                      3b2d57381b4defd0e1a00f5207b6769ab356ffee45fc96ebfbb87bd6c13c919d

                                      SHA512

                                      7d4d37d7e74b346c5c5176c84fe93949a521244f97a81d990262e493993533b57a280ab2023f288d88583c1b9164d6e3dced785c46f94ddb07ad8ce234db9ad2

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      Filesize

                                      9KB

                                      MD5

                                      2dc2e6dd618502ecf3b3d9b70cfbffb1

                                      SHA1

                                      aa70142407f066c2cda2d93e3c1b55f9429bb05b

                                      SHA256

                                      2795f884f927b06ce1c8b19215d361982cb7d6fef7019e3d3f73d0a63c70f78e

                                      SHA512

                                      75c43140b1992ffa22eef6687bf20dee73222c6930b9b5a7ffb403852d077fd2d1699b6e679c0f2201f9852e2b1009e4167c5fbf9973ad7956b48163adbe0456

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      Filesize

                                      9KB

                                      MD5

                                      d6a83c4baa6e83d2f4b93c28ebb853e7

                                      SHA1

                                      594bfe28de930379f3b9e8d343a26fffc5949f6c

                                      SHA256

                                      b898d9aa3e4b7733690a7bea646fea70a885368f06c4abb6a6340df55c9fba83

                                      SHA512

                                      ec3e5b884ac8b6abb146d0ccdb1484520f12ce480ed4d5f16f311bc2c666a66f8006c26ca8db5488e4ed52ac93943989b44569b9a8003015d7eff2f287887820

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      Filesize

                                      9KB

                                      MD5

                                      b8e55f0d088b8db08f777b89fe5fd9d4

                                      SHA1

                                      aa79c149681a9055b3df38c75547aba02631b9cc

                                      SHA256

                                      59431001719334b630104f0f7e0c3419ad8c8d3d44e4c6bd5e7b30a39958d1fe

                                      SHA512

                                      5ec69edbf1f71e1afd9dce6fc71ff179fa826cb7222b2f6bab9ed4f196cdc48183f6026cec46256624d356f6f23c21f2284e2a2edb038f3012264c1dcdb0a281

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                      Filesize

                                      15KB

                                      MD5

                                      5d3137a586c4f18589c6b38c8ccafd3f

                                      SHA1

                                      778bb10591a818ff53b8d6f1fb1f489b740373de

                                      SHA256

                                      64de5a8e4f0ca80b2e87920d2d4ac6572236a2ec4f370ca8bff830b3defc75e1

                                      SHA512

                                      add9fdc2b4c202d183e690bad5b3fcd8724eab2a1057d8cec19da282e4b72bc8d02491e781ac45053cb3a277c612bc94e3a3eb4bb68139444e22673b5e1e2462

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      Filesize

                                      152KB

                                      MD5

                                      b77ddaef740aba3326c45b0f984be679

                                      SHA1

                                      9297daff62f607002f1b61bc1e5ba14c0d3b6eb5

                                      SHA256

                                      03965734d3d24d2fdb16ca0f28b28f360a62eacb7277116deda1b5de84d46c2b

                                      SHA512

                                      8e5b241e4fcca5e69506cecc41189be325f71bfe087a8776d726b02b27e62c28ee68fdc483687723fc0c395b6c8995ea1ded5366ae08d0153fe1ebdd287537cb

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      Filesize

                                      152KB

                                      MD5

                                      4826e969afcc4bda2d68f3c256007f24

                                      SHA1

                                      fc52f078702709a9aecfd17964d7aef3150b13ee

                                      SHA256

                                      87e96cecd274251535da6a81457d19bab005bc8c6b8dc0d9963cf28631ec8f8f

                                      SHA512

                                      daf71dc7df98329b26db9c3b732f20475abfa7fdb86b6e8d3041797a6aee00d0e647746860cc2ee6ffdcb614818002cdfb284b3d4cae33f4a8472e60d795a3ae

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      1b4beb207b9755c5ccd02b6d90e5dc43

                                      SHA1

                                      d3d79d432e40c5863f1a3f0369ee03a76f0d5b1e

                                      SHA256

                                      db6d324db3cab13f7325d7e64de470b2b10a6932ee0e75b35fab279ea042ed08

                                      SHA512

                                      13df414d3e078562393b65e3b9dc56e533ea4067f81a12d6fcbd4321269973e84c14c2d67e6ad6a0ea38e990c765aa1c35916047658ddcecb3a1f4216b207dd1

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000020001\b8d2068480.exe
                                      Filesize

                                      2.2MB

                                      MD5

                                      a3fbdcd77e5f53ce812e36b5c180f50b

                                      SHA1

                                      6658412ff76c6ecbbf410780c778364f16245e00

                                      SHA256

                                      5374c5fed1ccff19c612321900c6b3723f5497b5ec6d62478bd4b814fe2cd0be

                                      SHA512

                                      86b873b8158e736abee42ac1edefd37419e9de71118e7514087e2993c0e899b21e70b742603fe4481279a72b10f2ff775bf099c7d72f27913bfcadb1ba856079

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                      Filesize

                                      418KB

                                      MD5

                                      0099a99f5ffb3c3ae78af0084136fab3

                                      SHA1

                                      0205a065728a9ec1133e8a372b1e3864df776e8c

                                      SHA256

                                      919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                      SHA512

                                      5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000238001\ISetup8.exe
                                      Filesize

                                      406KB

                                      MD5

                                      8c119343e6bf0180eebef7023c6dd30a

                                      SHA1

                                      edd4dbb9fe569cdf6bd427c4397005876ccca575

                                      SHA256

                                      f000cf9df04caf982a587f04d727fad5be0716146827a46e9e3cdc299952829d

                                      SHA512

                                      4e890229827cf489b0fbc917a688bba239e635e6a53f05b3c55186bd564f06d0e71bde53311be312056fb4382c7c623cc0eb0326aa66f579a68aecf46c2c6c8d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000239001\toolspub1.exe
                                      Filesize

                                      245KB

                                      MD5

                                      eab8a9b818ef4e23bd92d7420ee33b77

                                      SHA1

                                      f4751ca6ff4d24c3bfada9ad043835a27f04d2f5

                                      SHA256

                                      130ef444d7e6cd446c98932ce64ec44b56653258965cea4180baba5b570e4b75

                                      SHA512

                                      ce77e817741e460aa813d4efe1750f24f149bb4f7df23a06b7986c4ef09dc5303d0e0585928b78bf2b12dfa76a93f5bc8873fa03c8febe82b9c960ad41d1ff9f

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000240001\4767d2e713f2021e8fe856e3ea638b58.exe
                                      Filesize

                                      4.2MB

                                      MD5

                                      7ed0b5eeaf34416b080419f50f9bdf72

                                      SHA1

                                      734fe1331117f6ffa209e82b54eaa6e56f98594c

                                      SHA256

                                      f795392cec75639bd25fc5a9b536e837a056dd68ab476c664208cd2cd1b93f38

                                      SHA512

                                      ac573ebf859d70a075b91ecf863275dc18f15aeb2d75b20d6ec33ff070fe612215647cbe96c527b2a3c054a23bbde206fb57e786c64ff799a00dc6319049ac96

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                      Filesize

                                      1.8MB

                                      MD5

                                      9d7e95b132835b099f4b00cae7863e2d

                                      SHA1

                                      9e59088cfaa673241a49dbdfbb7f1b0462cb5da7

                                      SHA256

                                      b57f0f54d65712e116d7fdbd77a6c2bf1c6f871df16453571b8499c0312604ca

                                      SHA512

                                      ddfe237647bf44ef7a925de439eb55385696fdb5b15dde539f3cfe18122305149f9dc2b6a463f5948934e0d852c29706b74fac5781d125e0ccba30a3b1b490fe

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ilcjwnlm.44c.ps1
                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\u3mc.0.exe
                                      Filesize

                                      275KB

                                      MD5

                                      741f4fea03733d88a053a34f5f99f85f

                                      SHA1

                                      e7bece4b05fcd0df660ba0a043c3bd57dde078a3

                                      SHA256

                                      d1b502639e81960fb96040c544be3f66fa19f0a7ff4cfff874f7375ab851f6bc

                                      SHA512

                                      371070b856d0377c8d09eef20166376b9ac6bdd58b976882ed81e2d84609fa54f896e896b8dfe7434eba399af0a8a32d6290523e466d55eb2651517049dcc298

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\u3mc.1.exe
                                      Filesize

                                      4.6MB

                                      MD5

                                      397926927bca55be4a77839b1c44de6e

                                      SHA1

                                      e10f3434ef3021c399dbba047832f02b3c898dbd

                                      SHA256

                                      4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                      SHA512

                                      cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                      Filesize

                                      109KB

                                      MD5

                                      726cd06231883a159ec1ce28dd538699

                                      SHA1

                                      404897e6a133d255ad5a9c26ac6414d7134285a2

                                      SHA256

                                      12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                      SHA512

                                      9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                      Filesize

                                      1.2MB

                                      MD5

                                      15a42d3e4579da615a384c717ab2109b

                                      SHA1

                                      22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                      SHA256

                                      3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                      SHA512

                                      1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                      Download Submit

                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                      Filesize

                                      2KB

                                      MD5

                                      3d086a433708053f9bf9523e1d87a4e8

                                      SHA1

                                      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                      SHA256

                                      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                      SHA512

                                      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                      Download Submit

                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                      Filesize

                                      19KB

                                      MD5

                                      8bb6bef9d71d06d0fd5e60a293ca832e

                                      SHA1

                                      25a3ac37c111eea89e02a3c9af7c1eb965b7f74d

                                      SHA256

                                      c4599c1097f76b700e9f9e8082ea18b9a5971b5fec60565654f76920baedd8f0

                                      SHA512

                                      2f7aa3fa33dfd78aa81c0f1a3bbdcd5cbf109e76aa1ea625109d6b03095e9c212668cde37ec4e4d8625bea0ab8d5f89d11ebbb529b6751eab0de46d81d3bef30

                                      Download Submit

                                    • memory/2912-4-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-6-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-5-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-3-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-1-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-0-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-7-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-21-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-2-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2912-8-0x0000000000B00000-0x0000000001058000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2956-76-0x0000000077944000-0x0000000077946000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2956-42-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-33-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-36-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-37-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/2956-38-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-39-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-47-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-52-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-50-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-49-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-48-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-46-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-45-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-60-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-70-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-72-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-43-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-74-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-41-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-73-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-71-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-40-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-44-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-69-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-53-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-58-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-59-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-57-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-51-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-329-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-56-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-55-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/2956-54-0x0000000000400000-0x00000000009EE000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/3156-22-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-118-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-23-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-24-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-26-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-27-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-29-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-30-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-75-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-28-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-25-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3156-273-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/3220-830-0x000000006F480000-0x000000006F7D4000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/3220-829-0x000000006F320000-0x000000006F36C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/3228-807-0x000000006F480000-0x000000006F7D4000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/3228-806-0x000000006F320000-0x000000006F36C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/3312-719-0x000000006F480000-0x000000006F7D4000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/3312-718-0x000000006F320000-0x000000006F36C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/3312-717-0x0000000005FD0000-0x000000000601C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/3312-731-0x0000000005980000-0x0000000005994000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/3312-730-0x00000000073C0000-0x00000000073D1000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/3312-715-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/3312-729-0x0000000007210000-0x00000000072B3000-memory.dmp

                                      Filesize

                                      652KB

                                      Download

                                    • memory/3436-98-0x00000000005B0000-0x0000000000A6F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/3436-347-0x00000000005B0000-0x0000000000A6F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/3436-241-0x00000000005B0000-0x0000000000A6F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/3536-84-0x0000000000DA0000-0x000000000125F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/3536-96-0x0000000000DA0000-0x000000000125F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/3564-132-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-131-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-127-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-134-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-133-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-128-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-130-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-129-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-274-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3564-117-0x00000000000F0000-0x000000000077A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/5232-305-0x000002915A5C0000-0x000002915A5CA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/5232-304-0x0000029172B40000-0x0000029172B52000-memory.dmp

                                      Filesize

                                      72KB

                                      Download

                                    • memory/5232-300-0x000002915A550000-0x000002915A572000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/5276-303-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/5276-287-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/5276-283-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/5276-284-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/5284-312-0x00000000005B0000-0x0000000000A6F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/5284-282-0x00000000005B0000-0x0000000000A6F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/5336-544-0x00000000005B0000-0x0000000000A6F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/5336-535-0x00000000005B0000-0x0000000000A6F000-memory.dmp

                                      Filesize

                                      4.7MB

                                      Download

                                    • memory/5412-532-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/5412-546-0x0000000000E00000-0x0000000001358000-memory.dmp

                                      Filesize

                                      5.3MB

                                      Download

                                    • memory/5476-508-0x000001FEC2900000-0x000001FEC297A000-memory.dmp

                                      Filesize

                                      488KB

                                      Download

                                    • memory/5476-498-0x000001FEA4460000-0x000001FEA7D58000-memory.dmp

                                      Filesize

                                      57.0MB

                                      Download

                                    • memory/5476-509-0x000001FEC2980000-0x000001FEC29E2000-memory.dmp

                                      Filesize

                                      392KB

                                      Download

                                    • memory/5476-519-0x000001FEC6DF0000-0x000001FEC6DFE000-memory.dmp

                                      Filesize

                                      56KB

                                      Download

                                    • memory/5476-520-0x000001FEC6EA0000-0x000001FEC6EAA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/5476-521-0x000001FEC7F40000-0x000001FEC7F62000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/5476-522-0x000001FEC8490000-0x000001FEC89B8000-memory.dmp

                                      Filesize

                                      5.2MB

                                      Download

                                    • memory/5476-525-0x000001FEC7D10000-0x000001FEC7D60000-memory.dmp

                                      Filesize

                                      320KB

                                      Download

                                    • memory/5476-526-0x000001FEC7CC0000-0x000001FEC7CCC000-memory.dmp

                                      Filesize

                                      48KB

                                      Download

                                    • memory/5476-543-0x000001FEC7D90000-0x000001FEC7DAE000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/5476-518-0x000001FEC6E30000-0x000001FEC6E68000-memory.dmp

                                      Filesize

                                      224KB

                                      Download

                                    • memory/5476-517-0x000001FEC6720000-0x000001FEC6728000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/5476-510-0x000001FEC2A60000-0x000001FEC2AD6000-memory.dmp

                                      Filesize

                                      472KB

                                      Download

                                    • memory/5476-515-0x000001FEC2AE0000-0x000001FEC2DE0000-memory.dmp

                                      Filesize

                                      3.0MB

                                      Download

                                    • memory/5476-507-0x000001FEC2850000-0x000001FEC2902000-memory.dmp

                                      Filesize

                                      712KB

                                      Download

                                    • memory/5476-506-0x000001FEC2570000-0x000001FEC259A000-memory.dmp

                                      Filesize

                                      168KB

                                      Download

                                    • memory/5476-505-0x000001FEA9AF0000-0x000001FEA9AFA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/5476-504-0x000001FEC2540000-0x000001FEC2564000-memory.dmp

                                      Filesize

                                      144KB

                                      Download

                                    • memory/5476-502-0x000001FEA9AD0000-0x000001FEA9AE4000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/5476-500-0x000001FEA8140000-0x000001FEA8150000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/5476-501-0x000001FEA9AE0000-0x000001FEA9AEC000-memory.dmp

                                      Filesize

                                      48KB

                                      Download

                                    • memory/5476-499-0x000001FEC2600000-0x000001FEC2710000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/5476-511-0x000001FEC2420000-0x000001FEC242A000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/5488-441-0x000000006F280000-0x000000006F2CC000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/5488-442-0x000000006F5B0000-0x000000006F904000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/5488-459-0x0000000007B40000-0x0000000007B5A000-memory.dmp

                                      Filesize

                                      104KB

                                      Download

                                    • memory/5488-458-0x0000000007A50000-0x0000000007A64000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/5488-457-0x0000000007A40000-0x0000000007A4E000-memory.dmp

                                      Filesize

                                      56KB

                                      Download

                                    • memory/5488-456-0x0000000007A00000-0x0000000007A11000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/5488-397-0x0000000002D20000-0x0000000002D56000-memory.dmp

                                      Filesize

                                      216KB

                                      Download

                                    • memory/5488-398-0x00000000055B0000-0x0000000005BD8000-memory.dmp

                                      Filesize

                                      6.2MB

                                      Download

                                    • memory/5488-455-0x0000000007AA0000-0x0000000007B36000-memory.dmp

                                      Filesize

                                      600KB

                                      Download

                                    • memory/5488-454-0x00000000079E0000-0x00000000079EA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/5488-453-0x00000000078F0000-0x0000000007993000-memory.dmp

                                      Filesize

                                      652KB

                                      Download

                                    • memory/5488-399-0x0000000005350000-0x0000000005372000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/5488-400-0x0000000005C50000-0x0000000005CB6000-memory.dmp

                                      Filesize

                                      408KB

                                      Download

                                    • memory/5488-401-0x0000000005CC0000-0x0000000005D26000-memory.dmp

                                      Filesize

                                      408KB

                                      Download

                                    • memory/5488-411-0x0000000005D30000-0x0000000006084000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/5488-414-0x0000000006310000-0x000000000632E000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/5488-452-0x00000000078D0000-0x00000000078EE000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/5488-460-0x0000000007A90000-0x0000000007A98000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/5488-440-0x0000000007890000-0x00000000078C2000-memory.dmp

                                      Filesize

                                      200KB

                                      Download

                                    • memory/5488-435-0x00000000076D0000-0x00000000076EA000-memory.dmp

                                      Filesize

                                      104KB

                                      Download

                                    • memory/5488-434-0x0000000007D30000-0x00000000083AA000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/5488-432-0x0000000007630000-0x00000000076A6000-memory.dmp

                                      Filesize

                                      472KB

                                      Download

                                    • memory/5488-427-0x0000000007460000-0x00000000074A4000-memory.dmp

                                      Filesize

                                      272KB

                                      Download

                                    • memory/5488-415-0x0000000006360000-0x00000000063AC000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/5724-699-0x0000000007C20000-0x0000000007C34000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/5724-698-0x0000000007BD0000-0x0000000007BE1000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/5724-697-0x0000000007980000-0x0000000007A23000-memory.dmp

                                      Filesize

                                      652KB

                                      Download

                                    • memory/5724-686-0x000000006F5F0000-0x000000006F944000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/5724-685-0x000000006F2D0000-0x000000006F31C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/5724-657-0x0000000006B20000-0x0000000006B6C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/5724-653-0x0000000006080000-0x00000000063D4000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/5812-733-0x00000000059E0000-0x0000000005D34000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/5812-746-0x000000006F320000-0x000000006F36C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/5812-747-0x000000006F680000-0x000000006F9D4000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/5992-784-0x000000006F320000-0x000000006F36C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/5992-785-0x000000006F680000-0x000000006F9D4000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download