agenttesla | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
120s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloaders.zip
Size

12KB
MD5

94fe78dc42e3403d06477f995770733c
SHA1

ea6ba4a14bab2a976d62ea7ddd4940ec90560586
SHA256

16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
SHA512

add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
SSDEEP

384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

84.247.154.81:6606

84.247.154.81:7707

84.247.154.81:8808

Mutex

9jVlpOtjMhSg

Attributes

delay
3
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mvmconstructores.com
Port:
587
Username:
[email protected]
Password:
5Uc[^}pJj*Nl
Email To:
[email protected]

Extracted

Family

remcos

Botnet

RemoteHost

trutru.duckdns.org:1199

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
fdvfdge
mouse_option
false
mutex
Rmc-T7BYND
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

redline

Botnet

5008606069_99

https://pastebin.com/raw/8baCJyMF

Extracted

Family

redline

Botnet

client

195.10.205.91:1707

Extracted

Family

amadey

Version

4.20

http://193.233.132.139

Attributes

install_dir
5454e6f062
install_file
explorta.exe
strings_key
c7a869c5ba1d72480093ec207994e2bf
url_paths
/sev56rkm/index.php

rc4.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

185.196.10.233:4782

Mutex

b0fcdfbd-bdd4-4a5d-8ab1-7217539d4db6

Attributes

encryption_key
0EC03133971030F6D05E6D59F71626F6543BBE65
install_name
gfdgfdg.exe
log_directory
Logs
reconnect_delay
3000
startup_key
fgfdhdgg
subdirectory
gfgfgf

Extracted

Family

lumma

https://boredimperissvieos.shop/api

https://acceptabledcooeprs.shop/api

https://obsceneclassyjuwks.shop/api

https://zippyfinickysofwps.shop/api

https://miniaturefinerninewjs.shop/api

https://plaintediousidowsko.shop/api

https://sweetsquarediaslw.shop/api

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x0003000000022514-278.dat	family_zgrat_v1
behavioral1/memory/5052-287-0x0000000000B70000-0x0000000001074000-memory.dmp	family_zgrat_v1
behavioral1/memory/6048-1044-0x0000000005940000-0x0000000005DF0000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023311-1823.dat	family_quasar
behavioral1/memory/6612-1916-0x0000000000FB0000-0x00000000012D4000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/3120-152-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/files/0x000200000002250e-190.dat	family_redline
behavioral1/memory/5248-199-0x00000000000E0000-0x00000000000FE000-memory.dmp	family_redline

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000200000002250e-190.dat	family_sectoprat
behavioral1/memory/5248-199-0x00000000000E0000-0x00000000000FE000-memory.dmp	family_sectoprat

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000200000001eb21-80.dat	family_asyncrat

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1900-184-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2100-178-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral1/memory/2100-178-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2400-182-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1900-184-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1880	powershell.exe
6840	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	New Text Document mod.exe

Executes dropped EXE 9 IoCs

pid	Process
5064	New Text Document mod.exe
1256	4363463463464363463463463.exe
4044	hjv.exe
4788	wfopkrgoplq.exe
64	htm.exe
2368	AsyncClient.exe
4008	up2date.exe
2800	setup_1715277229.6072824.exe
4964	pojgysef.exe

Loads dropped DLL 1 IoCs

pid	Process
2800	setup_1715277229.6072824.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000800000001e3d2-739.dat	themida
behavioral1/memory/6516-1043-0x0000000000BA0000-0x00000000010F5000-memory.dmp	themida
behavioral1/memory/6516-1321-0x0000000000BA0000-0x00000000010F5000-memory.dmp	themida
behavioral1/memory/6348-1935-0x0000000000700000-0x0000000000C55000-memory.dmp	themida
behavioral1/memory/6776-2093-0x0000000000700000-0x0000000000C55000-memory.dmp	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0003000000022cf3-322.dat	vmprotect

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
74	raw.githubusercontent.com
75	raw.githubusercontent.com
215	raw.githubusercontent.com
223	bitbucket.org
224	bitbucket.org

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
181	ipinfo.io
182	ipinfo.io
188	api.ipify.org
189	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000200000001eab3-54.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4788 set thread context of 3548	4788	wfopkrgoplq.exe	126
PID 4008 set thread context of 1428	4008	up2date.exe	131
PID 64 set thread context of 2696	64	htm.exe	133
PID 2800 set thread context of 3120	2800	setup_1715277229.6072824.exe	138

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000021318-755.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5816	5312	WerFault.exe	170
6716	220	WerFault.exe	204
6080	6452	WerFault.exe	206
4548	5644	WerFault.exe	151

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000a000000023319-1954.dat	nsis_installer_1
behavioral1/files/0x000a000000023319-1954.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6420	schtasks.exe
4548	schtasks.exe
5868	schtasks.exe
5992	schtasks.exe
1892	schtasks.exe
5148	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5572	timeout.exe
5952	timeout.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
4112	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
64	htm.exe
64	htm.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
3548	RegSvcs.exe
3548	RegSvcs.exe
3548	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4788	wfopkrgoplq.exe
4788	wfopkrgoplq.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeRestorePrivilege	2952	7zG.exe
Token: 35	2952	7zG.exe
Token: SeSecurityPrivilege	2952	7zG.exe
Token: SeSecurityPrivilege	2952	7zG.exe
Token: SeRestorePrivilege	1732	7zG.exe
Token: 35	1732	7zG.exe
Token: SeSecurityPrivilege	1732	7zG.exe
Token: SeSecurityPrivilege	1732	7zG.exe
Token: SeRestorePrivilege	4292	7zG.exe
Token: 35	4292	7zG.exe
Token: SeSecurityPrivilege	4292	7zG.exe
Token: SeSecurityPrivilege	4292	7zG.exe
Token: SeDebugPrivilege	4112	taskmgr.exe
Token: SeSystemProfilePrivilege	4112	taskmgr.exe
Token: SeCreateGlobalPrivilege	4112	taskmgr.exe
Token: SeDebugPrivilege	4780	taskmgr.exe
Token: SeSystemProfilePrivilege	4780	taskmgr.exe
Token: SeCreateGlobalPrivilege	4780	taskmgr.exe
Token: 33	4112	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4112	taskmgr.exe
Token: SeDebugPrivilege	5064	New Text Document mod.exe
Token: SeDebugPrivilege	64	htm.exe
Token: SeDebugPrivilege	3548	RegSvcs.exe
Token: SeDebugPrivilege	1256	4363463463464363463463463.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2952	7zG.exe
1732	7zG.exe
4292	7zG.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4112	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe
4780	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2696	RegAsm.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4780	4112	taskmgr.exe	113
PID 4112 wrote to memory of 4780	4112	taskmgr.exe	113
PID 5064 wrote to memory of 4044	5064	New Text Document mod.exe	122
PID 5064 wrote to memory of 4044	5064	New Text Document mod.exe	122
PID 5064 wrote to memory of 4044	5064	New Text Document mod.exe	122
PID 5064 wrote to memory of 4788	5064	New Text Document mod.exe	123
PID 5064 wrote to memory of 4788	5064	New Text Document mod.exe	123
PID 5064 wrote to memory of 4788	5064	New Text Document mod.exe	123
PID 5064 wrote to memory of 64	5064	New Text Document mod.exe	124
PID 5064 wrote to memory of 64	5064	New Text Document mod.exe	124
PID 5064 wrote to memory of 2368	5064	New Text Document mod.exe	125
PID 5064 wrote to memory of 2368	5064	New Text Document mod.exe	125
PID 5064 wrote to memory of 2368	5064	New Text Document mod.exe	125
PID 4788 wrote to memory of 3548	4788	wfopkrgoplq.exe	126
PID 4788 wrote to memory of 3548	4788	wfopkrgoplq.exe	126
PID 4788 wrote to memory of 3548	4788	wfopkrgoplq.exe	126
PID 5064 wrote to memory of 4008	5064	New Text Document mod.exe	127
PID 5064 wrote to memory of 4008	5064	New Text Document mod.exe	127
PID 5064 wrote to memory of 4008	5064	New Text Document mod.exe	127
PID 4788 wrote to memory of 3548	4788	wfopkrgoplq.exe	126
PID 5064 wrote to memory of 2800	5064	New Text Document mod.exe	129
PID 5064 wrote to memory of 2800	5064	New Text Document mod.exe	129
PID 5064 wrote to memory of 2800	5064	New Text Document mod.exe	129
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 4008 wrote to memory of 1428	4008	up2date.exe	131
PID 64 wrote to memory of 2088	64	htm.exe	132
PID 64 wrote to memory of 2088	64	htm.exe	132
PID 64 wrote to memory of 2088	64	htm.exe	132
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 64 wrote to memory of 2696	64	htm.exe	133
PID 2800 wrote to memory of 3120	2800	setup_1715277229.6072824.exe	138
PID 2800 wrote to memory of 3120	2800	setup_1715277229.6072824.exe	138
PID 2800 wrote to memory of 3120	2800	setup_1715277229.6072824.exe	138
PID 2800 wrote to memory of 3120	2800	setup_1715277229.6072824.exe	138
PID 2800 wrote to memory of 3120	2800	setup_1715277229.6072824.exe	138
PID 2800 wrote to memory of 3120	2800	setup_1715277229.6072824.exe	138
PID 2800 wrote to memory of 3120	2800	setup_1715277229.6072824.exe	138
PID 2800 wrote to memory of 3120	2800	setup_1715277229.6072824.exe	138
PID 5064 wrote to memory of 4964	5064	New Text Document mod.exe	139
PID 5064 wrote to memory of 4964	5064	New Text Document mod.exe	139
PID 5064 wrote to memory of 4964	5064	New Text Document mod.exe	139

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloaders.zip
1⤵
PID:3696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1148

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap30685:80:7zEvent26205
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:904

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap26840:108:7zEvent11054
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1732

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap5756:110:7zEvent31988
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4292

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4780

C:\Users\Admin\Desktop\New Text Document mod.exe
"C:\Users\Admin\Desktop\New Text Document mod.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\Desktop\a\hjv.exe
  "C:\Users\Admin\Desktop\a\hjv.exe"
  2⤵
  - Executes dropped EXE
  PID:4044
- - C:\Users\Admin\Desktop\a\hjv.exe
    "C:\Users\Admin\Desktop\a\hjv.exe"
    3⤵
    PID:5964
- C:\Users\Admin\Desktop\a\wfopkrgoplq.exe
  "C:\Users\Admin\Desktop\a\wfopkrgoplq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\Desktop\a\wfopkrgoplq.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- C:\Users\Admin\Desktop\a\htm.exe
  "C:\Users\Admin\Desktop\a\htm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\zzvavvvexzhthzdjgdozdoqfdhpbkyslff"
      4⤵
      PID:2100
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\cbbswn"
      4⤵
      PID:1900
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\mvolpgqzhp"
      4⤵
      PID:2400
- C:\Users\Admin\Desktop\a\AsyncClient.exe
  "C:\Users\Admin\Desktop\a\AsyncClient.exe"
  2⤵
  - Executes dropped EXE
  PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
    3⤵
    PID:5888
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
      4⤵
      Creates scheduled task(s)
      PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp551.tmp.bat""
    3⤵
    PID:5980
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5572
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      PID:5548
- C:\Users\Admin\Desktop\a\up2date.exe
  "C:\Users\Admin\Desktop\a\up2date.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1428
- C:\Users\Admin\Desktop\a\setup_1715277229.6072824.exe
  "C:\Users\Admin\Desktop\a\setup_1715277229.6072824.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3120
- C:\Users\Admin\Desktop\a\pojgysef.exe
  "C:\Users\Admin\Desktop\a\pojgysef.exe"
  2⤵
  - Executes dropped EXE
  PID:4964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
    3⤵
    PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
      work.exe -priverdD
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\pgsthse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\pgsthse.exe"
        5⤵
        
        PID:5528
- C:\Users\Admin\Desktop\a\udated.exe
  "C:\Users\Admin\Desktop\a\udated.exe"
  2⤵
  PID:4736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5272
- C:\Users\Admin\Desktop\a\build.exe
  "C:\Users\Admin\Desktop\a\build.exe"
  2⤵
  PID:5248
- C:\Users\Admin\Desktop\a\1.exe
  "C:\Users\Admin\Desktop\a\1.exe"
  2⤵
  PID:5564
- - C:\Users\Admin\AppData\Roaming\Custom_update\Update_b2fa2eb7.exe
    "C:\Users\Admin\AppData\Roaming\Custom_update\Update_b2fa2eb7.exe"
    3⤵
    PID:5620
- C:\Users\Admin\Desktop\a\current.exe
  "C:\Users\Admin\Desktop\a\current.exe"
  2⤵
  PID:5644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 388
    3⤵
    - Program crash
    PID:4548
- C:\Users\Admin\Desktop\a\lomik.exe
  "C:\Users\Admin\Desktop\a\lomik.exe"
  2⤵
  PID:5784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_ab414e7959b5772c8d538ffeee266027\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_ab414e7959b5772c8d538ffeee266027 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_ab414e7959b5772c8d538ffeee266027\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_ab414e7959b5772c8d538ffeee266027 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5148
- - C:\Users\Admin\AppData\Local\Temp\spanFBRdhu9yEPWT\d2cioUoTjMgk4Gaq9hpQ.exe
    "C:\Users\Admin\AppData\Local\Temp\spanFBRdhu9yEPWT\d2cioUoTjMgk4Gaq9hpQ.exe"
    3⤵
    PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      4⤵
      PID:6348
- C:\Users\Admin\Desktop\a\eee01.exe
  "C:\Users\Admin\Desktop\a\eee01.exe"
  2⤵
  PID:5856
- C:\Users\Admin\Desktop\a\AnyDesk.exe
  "C:\Users\Admin\Desktop\a\AnyDesk.exe"
  2⤵
  PID:2372
- - C:\Users\Admin\Desktop\a\AnyDesk.exe
    "C:\Users\Admin\Desktop\a\AnyDesk.exe" --local-service
    3⤵
    PID:5460
- - C:\Users\Admin\Desktop\a\AnyDesk.exe
    "C:\Users\Admin\Desktop\a\AnyDesk.exe" --local-control
    3⤵
    PID:5504
- C:\Users\Admin\Desktop\a\060.exe
  "C:\Users\Admin\Desktop\a\060.exe"
  2⤵
  PID:5972
- - C:\Users\Admin\AppData\Local\Temp\is-J10MM.tmp\060.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-J10MM.tmp\060.tmp" /SL5="$805AC,4279297,54272,C:\Users\Admin\Desktop\a\060.exe"
    3⤵
    PID:5888
  - - C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe
      "C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe" -i
      4⤵
      PID:1212
  - - C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe
      "C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe" -s
      4⤵
      PID:5424
- C:\Users\Admin\Desktop\a\cryptography_module_windows.exe
  "C:\Users\Admin\Desktop\a\cryptography_module_windows.exe"
  2⤵
  PID:756
- - C:\Users\Admin\Desktop\a\cryptography_module_windows.exe
    "C:\Users\Admin\Desktop\a\cryptography_module_windows.exe"
    3⤵
    PID:6508

C:\Users\Admin\Desktop\4363463463464363463463463.exe
"C:\Users\Admin\Desktop\4363463463464363463463463.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1256
- C:\Users\Admin\Desktop\Files\ma.exe
  "C:\Users\Admin\Desktop\Files\ma.exe"
  2⤵
  PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1E76.tmp.bat""
    3⤵
    PID:5496
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5952
  - - C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
      "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
      4⤵
      PID:5688
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        5⤵
        
        PID:5388
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:6420
- C:\Users\Admin\Desktop\Files\288c47bbc1871b439df19ff4df68f000766.exe
  "C:\Users\Admin\Desktop\Files\288c47bbc1871b439df19ff4df68f000766.exe"
  2⤵
  PID:5232
- - C:\Users\Admin\AppData\Local\Temp\ISetup4.exe
    "C:\Users\Admin\AppData\Local\Temp\ISetup4.exe"
    3⤵
    PID:5312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 664
      4⤵
      Program crash
      PID:5816
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    PID:5872
- C:\Users\Admin\Desktop\Files\svcyr.exe
  "C:\Users\Admin\Desktop\Files\svcyr.exe"
  2⤵
  PID:5656
- C:\Users\Admin\Desktop\Files\qauasariscrypted.exe
  "C:\Users\Admin\Desktop\Files\qauasariscrypted.exe"
  2⤵
  PID:4900
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:6836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:448
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:5496
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:6356
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:6912
- C:\Users\Admin\Desktop\Files\svcyr.exe
  "C:\Users\Admin\Desktop\Files\svcyr.exe"
  2⤵
  PID:5652
- C:\Users\Admin\Desktop\Files\ghjkl.exe
  "C:\Users\Admin\Desktop\Files\ghjkl.exe"
  2⤵
  PID:6048
- C:\Users\Admin\Desktop\Files\ISetup10.exe
  "C:\Users\Admin\Desktop\Files\ISetup10.exe"
  2⤵
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 724
    3⤵
    - Program crash
    PID:6716
- C:\Users\Admin\Desktop\Files\htm.exe
  "C:\Users\Admin\Desktop\Files\htm.exe"
  2⤵
  PID:6452
- - C:\Windows\SysWOW64\extrac32.exe
    C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\Desktop\Files\htm.exe C:\\Users\\Public\\Libraries\\Gtltrkrz.PIF
    3⤵
    PID:6516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6452 -s 1728
    3⤵
    - Program crash
    PID:6080
- C:\Users\Admin\Desktop\Files\keepvid-pro_full2578.exe
  "C:\Users\Admin\Desktop\Files\keepvid-pro_full2578.exe"
  2⤵
  PID:6860
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    PID:5660
- C:\Users\Admin\Desktop\Files\krummy-lavacrypt-gfhd.exe
  "C:\Users\Admin\Desktop\Files\krummy-lavacrypt-gfhd.exe"
  2⤵
  PID:4540
- C:\Users\Admin\Desktop\Files\inte.exe
  "C:\Users\Admin\Desktop\Files\inte.exe"
  2⤵
  PID:6396
- C:\Users\Admin\Desktop\Files\current.exe
  "C:\Users\Admin\Desktop\Files\current.exe"
  2⤵
  PID:6588
- C:\Users\Admin\Desktop\Files\TJeAjWEEeH.exe
  "C:\Users\Admin\Desktop\Files\TJeAjWEEeH.exe"
  2⤵
  PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1880
- C:\Users\Admin\Desktop\Files\AnyDesk.exe
  "C:\Users\Admin\Desktop\Files\AnyDesk.exe"
  2⤵
  PID:3116
- C:\Users\Admin\Desktop\Files\qausarneedscrypted.exe
  "C:\Users\Admin\Desktop\Files\qausarneedscrypted.exe"
  2⤵
  PID:6612
- C:\Users\Admin\Desktop\Files\cluton.exe
  "C:\Users\Admin\Desktop\Files\cluton.exe"
  2⤵
  PID:6688
- - C:\Users\Admin\Desktop\Files\cluton.exe
    "C:\Users\Admin\Desktop\Files\cluton.exe"
    3⤵
    PID:6444
- C:\Users\Admin\Desktop\Files\ce0b953269c74bc.exe
  "C:\Users\Admin\Desktop\Files\ce0b953269c74bc.exe"
  2⤵
  PID:1188
- C:\Users\Admin\Desktop\Files\nxmr.exe
  "C:\Users\Admin\Desktop\Files\nxmr.exe"
  2⤵
  PID:6160
- C:\Users\Admin\Desktop\Files\Build.exe
  "C:\Users\Admin\Desktop\Files\Build.exe"
  2⤵
  PID:640
- C:\Users\Admin\Desktop\Files\BroomSetup.exe
  "C:\Users\Admin\Desktop\Files\BroomSetup.exe"
  2⤵
  PID:5556
- C:\Users\Admin\Desktop\Files\softcore-shd-lavacrypt.exe
  "C:\Users\Admin\Desktop\Files\softcore-shd-lavacrypt.exe"
  2⤵
  PID:5288

C:\Windows\wooaom.exe
C:\Windows\wooaom.exe
1⤵
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5312 -ip 5312
1⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3764 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:3
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 220 -ip 220
1⤵
PID:6660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:6228
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:6236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6236.0.66202640\1245515141" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1724 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e0ebf64-0b21-4bf1-8a67-8a686c3a5ba8} 6236 "\\.\pipe\gecko-crash-server-pipe.6236" 1864 1c1c67e9158 gpu
    3⤵
    PID:6428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6236.1.1851220327\1342388113" -parentBuildID 20221007134813 -prefsHandle 2248 -prefMapHandle 2240 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19ffaf67-1405-491a-999e-64178463dba9} 6236 "\\.\pipe\gecko-crash-server-pipe.6236" 2280 1c1c62e4d58 socket
    3⤵
    PID:6192

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
PID:6776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6452 -ip 6452
1⤵
PID:2464

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\053d09f4e09e41bf9b65d8be5f7339f0 /t 6324 /p 6236
1⤵
PID:4332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:7072
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:6780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
1⤵
PID:6372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5644 -ip 5644
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\fdvfdge\logs.dat

Filesize
1KB

MD5
46ee53f89b6d15bd986790602cacbf0b

SHA1
8d4fb13f82cf2904cd326bdbea3291178a6e82a9

SHA256
43fc9d14422bdd1ac3f7709cda962da5ca8c6ea88d5ba35120d56db4b8a32a24

SHA512
2dbe2d1342de2ff88b63bdc5b896c7acb99c6d6241bbe196dc463eb93a36f62058b339ef39fad502e2343c2d53040a864779ef2ccd734f9548ed997b06659777

Download Submit
C:\ProgramData\fdvfdge\logs.dat

Filesize
746B

MD5
91059467d6498873f2e6f17c93883529

SHA1
e3885ccfdefb39d09c70e5a7346d55a1b085f94e

SHA256
30929973e26c2728109f6ded4da3c1f2564c3f21d307abdf74c5485ce24909fd

SHA512
b8b663e81e2896ee65190f4143af401f6dd6568ec1e6b9201cff76207312a051cccacf0d3f4589b4b78f137b2d99ecf0799e9d0e5e3139109553fde98e61a210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
4.2MB

MD5
43b4b9050e5b237de2d1412de8781f36

SHA1
125cd51af3ca81d4c3e517b8405b9afae92b86f2

SHA256
97bb5c78c753aa5e39ffc3d4c1058f584d0241e9b19aff20a248f1f159fdca6d

SHA512
24e90d5a5d4a06e0d62ff2b5bc91e686f5cdb2e77fb4c31ef3b6a59f62afae9fc6642bb57576c334e46e234d10300a2814cca747cc315b52ea63b0226a6695d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
35B

MD5
ff59d999beb970447667695ce3273f75

SHA1
316fa09f467ba90ac34a054daf2e92e6e2854ff8

SHA256
065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

SHA512
d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

Filesize
5.8MB

MD5
cfb293de9746b2e41887b20155c1ee61

SHA1
282f4eb7c72e0403b6176d9925c914878539458f

SHA256
aa3fd950bcaa5a3bcf630976d6f5b25577468c4dba51a6421673435583bf309d

SHA512
e57536d985e50f8ec649ea64c6faf4b2eb2c887d48a26eba8eadd3512a235a9cdaeed8aabea10f5cfed4a7bf597ca92b89c93ceb2ef552ad56a9813d79164b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\pgsthse.exe

Filesize
5.5MB

MD5
d09d8539c62597cd658a22b167acc4f9

SHA1
67309103226da380034dba8e6fe5a0a4e8183464

SHA256
15b67d1c9943ded17553939213a1c2d90541d05f59deee44e4ed2903d828ff16

SHA512
15a7afdb8567d4db79dbc6e4df187cc7cf447f1467970f0c6c3de617791f66d820aa9b8bb46a95775723abe4d1dcc8bd1ff67b3b3fa1822e9ca0f07578d67336

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h40bucwn.vlc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanFBRdhu9yEPWT\d2cioUoTjMgk4Gaq9hpQ.exe

Filesize
1.7MB

MD5
7bc3ca90ce9e0262f2feeb3ec0db93a7

SHA1
6032e4e1a49d26cab45b932f8a6e9ef8f0c2a7db

SHA256
6eba69890a2d2fb55e01d858de40e47920bb2fb9c36832e41e321b39a9ac4f05

SHA512
2f1813943a2ca91416930b903c5f23bde2a0c78d6c3b6f49d53bf96733c76edf1baf196237a5b311f0ec48660f1df823457f7544da7bf7e27ee6495510206b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1E76.tmp.bat

Filesize
168B

MD5
3acfd7457ba9f03d6db8a5096ef3f301

SHA1
14ffc2d8cd5fc3fd59edb5548e8beab373244d32

SHA256
e5910c06eb333f34dba54707bebcc14b31e0e360b4a73359f2d2e1c9e0b9ebcd

SHA512
3c271657af9a37f6ca478fca3e6a6a450212818e78511913f925df0e5d899e0e92cab22c4e6151a8a021dae2b1e5a8e0d1cdcaedeaf5fb3cdd99680dc70523eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4DF9.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4ECA.tmp

Filesize
92KB

MD5
4c2e2189b87f507edc2e72d7d55583a0

SHA1
1f06e340f76d41ea0d1e8560acd380a901b2a5bd

SHA256
99a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca

SHA512
8b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp53C8.tmp

Filesize
56KB

MD5
d444c807029c83b8a892ac0c4971f955

SHA1
fa58ce7588513519dc8fed939b26b05dc25e53b5

SHA256
8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259

SHA512
b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp53DE.tmp

Filesize
220KB

MD5
4635c12205938cc2cb20a2b26ce92545

SHA1
65db38b6c54dd334b29fc27801b49393e1dcf1c6

SHA256
f743c5d474d5bf24b30855b9586d7ddb82b8146a5f29f9b2617358dab8fcbe67

SHA512
9771956f2a4da2fe95e003fbf61dcd84ae27141e4da073ce7accdd5c5cada2bca5ed2221be47ae30b78f8075e460dc81a4a3069be56268bf1e25495e7e4073b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5486.tmp

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp551.tmp.bat

Filesize
150B

MD5
9f289e0139227abccb7d4b8a4f35765b

SHA1
c679cafc07b79d850e9ef5d8801a0dc614a49449

SHA256
4ed273aaeb82e7062b3e9f47f53b077e75f080f2d515529e33430c17c689da24

SHA512
9de7852e854b344e154bdde8016a2a9c43bdc5d972bff4328b3dc574a1c558463208231eb0d78753c0fb5b21081b8e061d636a1b4742a97236f64aafdbb8fdfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\zzvavvvexzhthzdjgdozdoqfdhpbkyslff

Filesize
4KB

MD5
10fa8ec140c204486092fb161e567ec7

SHA1
4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473

SHA256
7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04

SHA512
9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
424B

MD5
c0a0c18c9cc8616cf5e93a5392bfeaea

SHA1
3ff145456bbc4be7993a334003d84d0b95c3d2f3

SHA256
3eb3d768836836d6f55c346790853b6d565e85d59044760954e09b99670e518b

SHA512
bd3f4d296ab39fcb4d38ab2a57e5d1d1e43cfd7300eb20db087763fe7eef834873736fb9d0b65808ec5bc6192643331d5bee4eedf0b33b1e585f9496c99c6969

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
732B

MD5
2b31befebbdc7f943c26388eb5fe5cd3

SHA1
e32ffd75925637349dd5bd4188ce7f6845bffc84

SHA256
d33dcfd6983292c959e056022942631c396074added402ad8bb557ac31021699

SHA512
1f7a0e22bbc4eb6a29c2a88c15746fef45f32e0355479067a208b770b79d26bac17ab3af153e03e0f014b5d90f06681eed474da51500966bc6f292de66a8763f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
cf6f5c5616f68283a5e54d68c6e792eb

SHA1
a245b1858ca8aeb7c9cc02c6f388f4992702c6cc

SHA256
8340d61fba7597e04e6cfa93d7e874c73f64095a6b160b4e2fc499a34c06c7ac

SHA512
9155feebc5efacc83e8b977e345f8c096ba3eaaca8708cfb3cdf1e388f642463ca63032d5c80eb10e5eac59214e19bdebcf6369f1ec3056c974d63e2d70b1cde

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
9cd2ef0261db4c41eb66c38bc573e605

SHA1
0aa0c2a7d0459f76fa85bc2c52d34691ef51f1e8

SHA256
55f24a8902453e2676503c95f361e2574cb903462f5490bcd730c58faa51220b

SHA512
75bee3bfa72a7f2cd3d80d611a6f3f819e60493202b0128f33fbc4d734baa46fe55510aa4c956b86649ec37f320277581369ed4bbdef21f3dc92f372e3b15578

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
1KB

MD5
5886cd0802312246f6649a3aa1d2785e

SHA1
3f9ace8ea99b2fac5f7e9fce6c19e9924aeb79fc

SHA256
be6909745b75c8fa75890592249d4e20b74fe84a12c5aab47096f5b57a1769df

SHA512
e67d93bdd012023491441bc85111153a0a11b5c1477111a0ccf5445f62da52d46bee4b2d89ec3039b003a03f4d52a82e170eda64495301ff2c8e785b65737601

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
d52cff214a8d82733293151d86440116

SHA1
e4a13d16b7afddf80d79c55a4c735039cb8762d8

SHA256
50e9e1afb09257a3ce15f5c7e335a48e5d6011ca3e7a1601da98278ab81658a0

SHA512
8af7c655c54cd22897be4b420d5dee07de6c5dc88af2ecb1f1937415c69ca382bb82f9b32bd97ba1d98d0cf35f682e7731453205bd93cce9f01ec6c246cf895c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
2KB

MD5
240e5896a6aef2be212d7b923038da6c

SHA1
ca50cfa093f9460ae6dde365c5eb9daf3ff10b03

SHA256
2bfb6c9c03098304c6022282d79e51851d5079f6bf22c93aba31c872947762e7

SHA512
dcc31ad627501451208c298adfe134f32fdd77776cc7af5b501424a57c6a557fa4df3d0e99662f86ef82d5ded8574e753c48a29a8a8f94348c0b68e3f6eddec9

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
6KB

MD5
944c81e35503a4ea2e813c6fc7a8cfbf

SHA1
9d3dfeb72509c93855108aa8c22139d7f3622586

SHA256
d80e5a24b5d88e88caa6e059427c6c867dbce15dbcfaacb37b5210e09e772a16

SHA512
3e95055369723e49bbabf1a86f8aad7f6568f6fbb95d655afdf66417e5aea352beb90403cf66f38fb50664350c9aec4451c2f8c7e2fc1daa5d2591235513a90e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\0f5007522459c86e95ffcc62f32308f1_2397ee06-28fe-4eaa-8777-f7014368c353

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
3KB

MD5
19812b0a138f176972ba9dbf737232b0

SHA1
27a78222de1fccf5421ffdbaf29f724a7f3c6dd5

SHA256
7ad4c20a46106dbbc017dac660faad6f1632ee3df0de7419fa01eb98c11d671a

SHA512
b293415b3e93064f83f3094b58f49a2d4109bc81384b28b539985d0004638bbe25fb048fbac87e5ce5f2e9566b5828a5fd1e2f5c035499f81bd460cbb86535f5

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
209KB

MD5
f25b1a8ace40a649040d76553f98773c

SHA1
dcd77fccefa3664ac352718a66a27fb711623408

SHA256
4e0e061abcae1a25d06b7ae8ee0fbebb5ae143bc9da212b20f35b77f12b4d1e8

SHA512
d6b6ced2f6714e1f566fb230684f3d5b53e18f38ff91b77f7ca869b9b8895aa560bb5f6d1a42f2926226a74d8c8eb1134186992ac48aa2a3930036067d21624d

Download Submit
C:\Users\Admin\Desktop\4363463463464363463463463.exe

Filesize
10KB

MD5
2a94f3960c58c6e70826495f76d00b85

SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

Download Submit
C:\Users\Admin\Desktop\4363463463464363463463463.zip

Filesize
4KB

MD5
202786d1d9b71c375e6f940e6dd4828a

SHA1
7cad95faa33e92aceee3bcc809cd687bda650d74

SHA256
45930e1ff487557dd242214c1e7d07294dbedfa7bc2cf712fae46d8d6b61de76

SHA512
de81012a38c1933a82cb39f1ac5261e7af8df80c8478ed540111fe84a6f150f0595889b0e087889894187559f61e1142d7e4971d05bceb737ed06f13726e7eae

Download Submit
C:\Users\Admin\Desktop\Files\288c47bbc1871b439df19ff4df68f000766.exe

Filesize
4.7MB

MD5
4645adc87acf83b55edff3c5ce2fc28e

SHA1
4953795cc90315cf7004b8f71718f117887b8c91

SHA256
5a03eb8534caf92f4c3d7896d1af7fe61292b5f0995567be8c783ab28c3b74f8

SHA512
3d8853dd1f28062f7554628565bc62e42296b0ab69da28665bf29771d78c50fdcdb2432aea09dbeb69d935e0dcf6d3b703af8ba1b7a0aed70b5be93b7959c602

Download Submit
C:\Users\Admin\Desktop\Files\BroomSetup.exe

Filesize
2.9MB

MD5
b5c26db74bf6948759bb5e95ca08acc9

SHA1
22b1a2152a8735b4af2e051d525fa5117bc113fc

SHA256
2eb4f6b7b4a438aad1e62b3025cbb5f21ddb9078fffa7de302d369740d80d54e

SHA512
663115269184a1c459ab5cad0de139b2fde1178d9bca500f4ed5901046262e6ad0909e4aed1429f31e133d28b8336313ba14525c499201fecf66b8e13e2bcd65

Download Submit
C:\Users\Admin\Desktop\Files\Build.exe

Filesize
3.6MB

MD5
14b20b3bde5ed05596fb31ae53de10f2

SHA1
46654114b59107bb0de6952ab09b3212402e781f

SHA256
d6d9145b6d4930655bd37eec6315de358d04961476152da449828eca0009fd20

SHA512
6e9a6a5f19dbca024791abdd10e5c5d1952fb484597aa3e2cb5ca9a7499b34a1301eb8dda94979e37012d3234ed30d752af14d616ac4241dde9bd9476df98633

Download Submit
C:\Users\Admin\Desktop\Files\ISetup10.exe

Filesize
404KB

MD5
b8d922472d6da5b157598c94b8677fa5

SHA1
470c464307f86b53b7ed9d4785e68d1b12599448

SHA256
458e3d9f3f51d58101a3b4d8496bceed86391b80c68aeba4aa1411c930094d8a

SHA512
e24381bb55e8ba4216f72dcb520854265c0da7e1a87b18438999a217de50abebd9a6a5f9532ebea90a35599ee3217a1ec6780ef61f584a0d7604acc17e7fbf10

Download Submit
C:\Users\Admin\Desktop\Files\TJeAjWEEeH.exe

Filesize
892KB

MD5
d65f5542509366672c1224cc31adfbf0

SHA1
b23844901a5cec793cece737f3357f8c8793d542

SHA256
85c5a9b53be051fef06d1082abb950a731ffb452e68cc9aafa907251e2d6bd72

SHA512
c4c333f4d084a3625162ff356b70f092cdbafff806af7d2b3c0ce596769b85ee546e341bf7e917609083f7785976dcce63b7bedd2cea63200fa4807721f19f5a

Download Submit
C:\Users\Admin\Desktop\Files\ce0b953269c74bc.exe

Filesize
368KB

MD5
5ec82862a67012277f2b24f1780e968b

SHA1
3864ae8c39913a910129cd5da3cdc35682ba4ce5

SHA256
f4be8d0218a0e78619344ff5e2b21c702985e2baed31cbbfc5ec30aa5facb17a

SHA512
cc8d0a441eeffd4bdb39268b78d741fb6536a102a27a59a6c0ebbce05700aa042659b2dce810dbf37f9522969883645c12c0fc43dd6730e9d81f3e1f393fbb8a

Download Submit
C:\Users\Admin\Desktop\Files\cluton.exe

Filesize
282KB

MD5
173cc49904c607c514e2f4a2054aaca0

SHA1
0b185b7649c50d06a5d115a210aa3496abf445c2

SHA256
985d2a5f97ed03ae735c7f30f950846339d5fce5c18491326edec9a8be5cc509

SHA512
f2a83903311969c96aa44df504e9c8118fb2be0a46058502da744ab4790c476e36474ec856afc8a70d599e11df319597d0998f7f9d9e0751899eac92fe567624

Download Submit
C:\Users\Admin\Desktop\Files\ghjkl.exe

Filesize
5.3MB

MD5
de08b70c1b36bce2c90a34b9e5e61f09

SHA1
1628635f073c61ad744d406a16d46dfac871c9c2

SHA256
432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67

SHA512
18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5

Download Submit
C:\Users\Admin\Desktop\Files\htm.exe

Filesize
819KB

MD5
983f094cf97faca11916d717b22b64ca

SHA1
01a2a60c6ef3ed356172acd97a050600d38ecf74

SHA256
230fb3ddc18793a3a520810ad7d76eb3629558c327c3c1f0418c5d930bca035b

SHA512
c9b4bb50897e6bd7e14d27a0af50dc20fe71cbcfe038e4547336206f7f66294ab49ba7400ea39cd3214045b9e5ab7887cbd25cbcfe57a3a6146439e2e802dc9a

Download Submit
C:\Users\Admin\Desktop\Files\inte.exe

Filesize
256KB

MD5
dd49b01b20c449788ebd53a85934696b

SHA1
e29747c6db83e26bb11b23e53f847ecb163c5b2f

SHA256
ff8f82b43811e61b65d707f35cac31af19e0fa5d7a15e920e665524a18ca1fdf

SHA512
169a7e4783ff808ecf1fff29466fc227520e396d89f57b2a0b114d6d6f8748069f4a513b3052b96c886ee4524e06dbdda8003f19456ee2758dc0e6ec10b0a396

Download Submit
C:\Users\Admin\Desktop\Files\keepvid-pro_full2578.exe

Filesize
9.9MB

MD5
2627387eb5495186ee3850fdc0b2ebde

SHA1
8c062c24ad34332f8033a8cac193e4519d3d7534

SHA256
9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e

SHA512
0c86e0b5de1b149913b7039fcc3fb8dcc17112617a5af731c3c90d6c822dbb7f2f5660e5790d0c134437383d5b6a71176839c0125c6c391f4ea26ffce0480b25

Download Submit
C:\Users\Admin\Desktop\Files\krummy-lavacrypt-gfhd.exe

Filesize
3.5MB

MD5
af1082c667a09a0f1f6adb041ca37d34

SHA1
ccb770b00596a1d2fa0d9d7d3dbe9451734a30f9

SHA256
28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6

SHA512
4d1c50b42077ec0a8f0060410e75201e920b951f299e8d9a247fb4ba3c920ef5d16f7b30e2decef5323d88e28e3daeee60ae3fcd1e00de36e0185336b1582404

Download Submit
C:\Users\Admin\Desktop\Files\ma.exe

Filesize
5.0MB

MD5
a3fb2b623f4490ae1979fea68cfe36d6

SHA1
34bec167e0f95ecc36761f77c93c1229c2c5d1f4

SHA256
3bc9c1d7f87f71c9e98fac63c2f10d2651f51848082a85d6b3550649e4289d56

SHA512
370b23364bcf8f07aa951c1c6a9d6b03b516db8fd7444d25087ad8071c54bb06fd50ce311a205e0770211167728d86516e934a39a606f0bf0c9fbdd13dca7912

Download Submit
C:\Users\Admin\Desktop\Files\nxmr.exe

Filesize
5.4MB

MD5
41ab08c1955fce44bfd0c76a64d1945a

SHA1
2b9cb05f4de5d98c541d15175d7f0199cbdd0eea

SHA256
dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493

SHA512
38834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116

Download Submit
C:\Users\Admin\Desktop\Files\qauasariscrypted.exe

Filesize
6.4MB

MD5
eb0beafcb365cd20eb00ff9e19b73232

SHA1
1a4470109418e1110588d52851e320ecefcba7de

SHA256
31b494be325fc9c97031135886454b1370e5e3608c757f74784c6b6fb2fb5c99

SHA512
8dff151e81b5ce3c4f51b1f24a6e7654c3008d81b6652e6d2f7fabc42d341e9db703b12f83ccf9471514498af3c1763ef97f132ad36302de8ccd984fbf52d52f

Download Submit
C:\Users\Admin\Desktop\Files\qausarneedscrypted.exe

Filesize
3.1MB

MD5
4d8cb64db6b9ae4663bb23229a6e9d16

SHA1
f53197017572e0f288183e7cb4a3d4a0d9a86066

SHA256
7c5b92ed56a0a571be9ebe0e12e887b1a0b545ed615268e9b783558fd06dc098

SHA512
82be6c6e9f98f083d841ed64b2c5cc6110f5eceff913300ed4b4e1aafad65eb57961e3a82f4d6b16668febf03ba0d44c555ab000a0f5ea43ea818886761e78ff

Download Submit
C:\Users\Admin\Desktop\Files\softcore-shd-lavacrypt.exe

Filesize
408KB

MD5
f1de359b4cb3e98d01e03f7f4aff75d7

SHA1
ff190e4a989695c64f95495c0347498ec11eabd7

SHA256
095a10fc0b992d28fd110516164eb608316a7d2bded28a2e0bd7aa66e895197c

SHA512
21fe1331649696cf61fcae8054b7660803e73881302d975a0767422d7af3426bd559de17add4a00eaeaa43500c9a5b87a0012afeee8a80b273e23e1ad7315400

Download Submit
C:\Users\Admin\Desktop\Files\svcyr.exe

Filesize
104KB

MD5
7edc4b4b6593bd68c65cd155b8755f26

SHA1
2e189c82b6b082f2853c7293af0fa1b6b94bd44b

SHA256
dcd92ec043cb491b3de3e4f73fbe35041274a9b81d48b4377c8c9a8157c95590

SHA512
509b4630cf02fd7ef02893367a281bb2a361e527ea6279bf19477b2fcde5f477f5a3f8c4f1fb692406df472a52fb000aa55875469ddf5ea8ee9c411b37c1f979

Download Submit
C:\Users\Admin\Desktop\New Text Document mod.exe

Filesize
8KB

MD5
69994ff2f00eeca9335ccd502198e05b

SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead

SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

Download Submit
C:\Users\Admin\Desktop\New Text Document mod.exse.zip

Filesize
7KB

MD5
a7b1b22096cf2b8b9a0156216871768a

SHA1
48acafe87df586a0434459b068d9323d20f904cb

SHA256
82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9

SHA512
35b3c89b18135e3aca482b376f5013557db636a332a18c4b43d34d3983e5d070a926c95e40966fafea1d54569b9e3c4ab483eaca81b015724d42db24b5f3805f

Download Submit
C:\Users\Admin\Desktop\a\060.exe

Filesize
4.3MB

MD5
8eb33bd8b6ceb94d8222fd7e0f07d7aa

SHA1
5cdf3960e02365da36f9c28598215afe7986ba5e

SHA256
7056a9396285e82d0ba434e5e8dfd6144cc140b8f500314ea80723f497a9e9a4

SHA512
63fc911f62cd32093fea36ade9b543877c95c3c99a395182a136c28c344b5c9a1930b3ba272b6f62b9e45628ef79251ff0f94db3d288a6e62d1619159fa44aed

Download Submit
C:\Users\Admin\Desktop\a\1.exe

Filesize
378KB

MD5
3be9e476da2e99adbc49591cbc94b4d9

SHA1
2155590f685d4e28c278123a1cca633e8746db78

SHA256
240677752d6ba09cc9f98275d694c500ed75808080fd6f8d750c16a526dc4ba7

SHA512
604fe5635f17fb7294436f56436a43314c9c3d29c335acbf4c9af21bfe86c958bf88e2e1863d329136b49ad612a70bca656bac9f351ca8b1332ad9283c4dcc88

Download Submit
C:\Users\Admin\Desktop\a\AnyDesk.exe

Filesize
5.3MB

MD5
75eecc3a8b215c465f541643e9c4f484

SHA1
3ad1f800b63640128bfdcc8dbee909554465ee11

SHA256
ec33d8ee9c3881b8fcea18f9f862d5926d994553aec1b65081d925afd3e8b028

SHA512
b3a48230fc6f20038c938e5295b68a3f020b94e220ca2fab6a894d126dc41f6f1021c239613bf9d6de84370ad7df9d9a91baf716a87d43eb101ee3e48578e5ff

Download Submit
C:\Users\Admin\Desktop\a\AsyncClient.exe

Filesize
45KB

MD5
503d8173c0d8d38e05dead2de759a1d4

SHA1
f7fb4b05e98fff19289f6ba090fcb5384f0dbc89

SHA256
51f3f7d8ac847527e0652b7841b3f37844b24f1e5b206af23debd479b8aa6a86

SHA512
73aac0e09d974396424d0526fb5d88f6713b756f04e02318e0c7d049830a5131f4594c8cac7945530c2fe9fa0cd83929cfcf91f6381b2693f51ccefdae6bf855

Download Submit
C:\Users\Admin\Desktop\a\build.exe

Filesize
95KB

MD5
7b207a5aba4025733f54ea5185f1f1cb

SHA1
82bfe2f116cd70f658c78bd331f5b9254ee77a56

SHA256
ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844

SHA512
c75cd54b6a51bfd4ea0dbf6135363f510f71acaa2d47ee6e265d9b385c047b0b1ccec02c10900161c9bf763ae0f07a4f4449e8f3b26cd526396082025955c944

Download Submit
C:\Users\Admin\Desktop\a\cryptography_module_windows.exe

Filesize
7.8MB

MD5
ec69806113c382160f37a6ace203e280

SHA1
4b6610e4003d5199bfe07647c0f01bea0a2b917a

SHA256
779a5fe11a1db6a3b4a064a57106c126b306a027b89200c72744eeac0db0bfe2

SHA512
694d1a907abe03bef1d0f39679b920fdb8e14ebf3443d56defedbf31f8fa7458a89d547c9e9c315cdd226f614d1e436afd52622c119cb9d83d9751ff7854c946

Download Submit
C:\Users\Admin\Desktop\a\current.exe

Filesize
324KB

MD5
ae341276bbe0cd98118b6f89296eb3ac

SHA1
9d77f24ecaa3816ba4d9067f58475e031aaf7f67

SHA256
1ecae243d397196b9ad05c5e146f8ad3126ea9f8e09197a36747757bf61843be

SHA512
15456e9788143f2a37698dd1ad76670b687113780aea2172df23e0944482a16869788fd922b8ee626bdbe94a769cc45f8abc65315b4dc643e7af9213c1a73ad2

Download Submit
C:\Users\Admin\Desktop\a\eee01.exe

Filesize
1.4MB

MD5
f135971ed3e575d6baa94967a6c4bc07

SHA1
7f9ff3118815af4c642580cbfca29c9825822cd9

SHA256
cc37ddd33fd1c726b291754bd74c74fb4d38520b78d836b6c0c05d0d1a7f933a

SHA512
00f9fbe7468d7cccc6b100c47727cc8d4d49e90e3ac99afc8164bb88e55715d7784980ead588023cb61b1d565afac3bcc95ded713773e85bcd17c818d41baaff

Download Submit
C:\Users\Admin\Desktop\a\gcapi.dll

Filesize
385KB

MD5
1ce7d5a1566c8c449d0f6772a8c27900

SHA1
60854185f6338e1bfc7497fd41aa44c5c00d8f85

SHA256
73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

SHA512
7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

Download Submit
C:\Users\Admin\Desktop\a\hjv.exe

Filesize
729KB

MD5
df03e58ec9fd13a1615b42200de627ff

SHA1
cb48f528bb0c672b1a7bacac0c573b7f26f6632e

SHA256
72bfb041b92ee316fdcc89683c945db30ecbc1c6ea51fda2cfe5d7dd17d4b188

SHA512
b700d9bfe99edaee9bcaae6793ca1bc84e10ae70e3527f5feed8b6ec37a813cffef2d9ccc125a5cfdbf3507182b3004bef2db628249849cb116162dbe8a291d1

Download Submit
C:\Users\Admin\Desktop\a\htm.exe

Filesize
252KB

MD5
de5fb4cb77c429a6169efedcb8900930

SHA1
6c94d7323a69f3dcd85d0f83894376f892def6ac

SHA256
402fb31162f2581de23d4f3cec47dcfd9f4cb56b116050158254ba3d65dca873

SHA512
a504ea86eea4f51b061e5b4db508290d40a3d4d333e2626821614ea1543f627035d25aaf77cbf667856bfb47ef92b4aaba21728323545e6f5745a6f8335dbc6b

Download Submit
C:\Users\Admin\Desktop\a\lomik.exe

Filesize
3.0MB

MD5
ee24b23801c6ec32cb36c046b942b8c0

SHA1
489cbfbc5c5d1a3ddcbe1a8960c573d054f613ae

SHA256
33f1c46ea9e51e87265380463ae2d21978c4979a8e475597e868808d5d5e8ba4

SHA512
e4a8bc512d40dcf093221e5cfd3278dac8fe723495eb7f93c47c649e46d673a26eaf18779fb21f57b222c658d76dd9070e1204610715f6e6c45b5a006adbb349

Download Submit
C:\Users\Admin\Desktop\a\pojgysef.exe

Filesize
6.1MB

MD5
d4f738f4e3787ef0b31891e446919aa8

SHA1
fa22c2fe4da02adbb51c35402c8dc21ab4157c43

SHA256
11fe45cccad95a86b7e7d29c9d92547dae0706d549485d37d482d3df5fe58ebb

SHA512
19d3a88cc2367669d6df8d5e7f4f310e482699c365a72cc7d2ee384972e6a2441a4adfc2c348780658c2e88a3e6f8ad82ecae1b4637d8f7cabb447266e16d3c7

Download Submit
C:\Users\Admin\Desktop\a\setup_1715277229.6072824.exe

Filesize
778KB

MD5
e3e2300616cc1112ffe8fae1901eff5c

SHA1
76692a0335806051e11dbffd2f46100a2df523a2

SHA256
aed6503a004a4b55c2e8be34624a376a3c1f8286f9e45780b5df6e11ecdd9123

SHA512
cbcfb29cf46345a7971d6b03e6f02f8aaca2853799890c50e2b4052c88e94697cf676fc6d7074bfd9de76f153aa1fad3b13e411ba0ce0b340d7dcc2abed36f13

Download Submit
C:\Users\Admin\Desktop\a\udated.exe

Filesize
509KB

MD5
fecabb1640f8768ff0b10ea4186724b7

SHA1
241068adc02455dd0085276821758ab654eb8857

SHA256
69258764f8267fd244e4e0bb4e9ac8e9b456935c1655fa93956095a90631fd7e

SHA512
3cd0731d3a7b8554c8ef6b4e039fd4b460e0b7e731bd8cbc7fea3ca4d3822ed6e92f6483d1412e38b5f3d22c49caab6df22a4ef62d06bcb1c0d833379afc5ce2

Download Submit
C:\Users\Admin\Desktop\a\up2date.exe

Filesize
527KB

MD5
cda96eb769b520de195cae37c842c8f3

SHA1
a1c8d0bbee8c109fabf1cf26ac3e9af0fc110341

SHA256
9a7761a218bd7bd89d897848e3eafea1a05f151c3ab44668124ffa35c4d3a743

SHA512
11fe27e375077ad59f0adee3de6ccc32783244d68911b82d76e5a49001dcd3f1e0311abcb1f7e6f51a11dc057cd17b32ae4af36cd25d227ce8f0710ca5cc2e44

Download Submit
C:\Users\Admin\Desktop\a\wfopkrgoplq.exe

Filesize
1023KB

MD5
6a267a91de66ab6c8fbdf4cbaa1e27e9

SHA1
7b3a4881c3d0d7ebf116b068d37fb32a576f501f

SHA256
37b0c76c917d61efbb477e6773c59cb7e473f6034dbe59c29d9baa2d156282a8

SHA512
53a9c1a92138e3d5a09666b76d8752d8e6b0d8d2db1b07a53e8df970141aea20a19ee32db6db061db5c2b999b7cd8193cb6ee7efcd73c60070c0938e436b5442

Download Submit
\??\c:\users\admin\appdata\local\temp\isetup4.exe

Filesize
464KB

MD5
44f814be76122897ef325f8938f8e4cf

SHA1
5f338e940d1ee1fa89523d13a0b289912e396d23

SHA256
2899d533753918409ab910b70ba92f8740f76c8e8ac74f4c890e53b258e3bff6

SHA512
daeb1a81dd4fe1578502d0c681c7e723273d06297c2fad7aeb74b1a06cd05f72a418af9571c82188525af329b3fef9785d588f1416d6ccf45ab58b589d8f0d79

Download Submit
memory/64-73-0x0000000000990000-0x00000000009D6000-memory.dmp

Filesize
280KB

Download
memory/64-121-0x000000001B5A0000-0x000000001B5AA000-memory.dmp

Filesize
40KB

Download
memory/640-2593-0x0000000000920000-0x0000000000E9C000-memory.dmp

Filesize
5.5MB

Download
memory/1188-2459-0x0000000000240000-0x00000000002A2000-memory.dmp

Filesize
392KB

Download
memory/1212-725-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/1256-125-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download
memory/1256-74-0x00000000008F0000-0x00000000008F8000-memory.dmp

Filesize
32KB

Download
memory/1428-126-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1428-119-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1880-2198-0x00000144665A0000-0x00000144665C2000-memory.dmp

Filesize
136KB

Download
memory/1900-183-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1900-184-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1900-179-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2100-178-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2100-172-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2100-177-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2100-175-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2368-97-0x0000000000900000-0x0000000000912000-memory.dmp

Filesize
72KB

Download
memory/2400-181-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2400-180-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2400-182-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2696-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-142-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-271-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-123-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-270-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-128-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-130-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-132-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-133-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-140-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-141-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-144-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-145-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-147-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-167-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2696-219-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2696-218-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2696-215-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2696-227-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2800-127-0x00000000002E0000-0x00000000003AC000-memory.dmp

Filesize
816KB

Download
memory/2800-131-0x00000000025D0000-0x00000000025D6000-memory.dmp

Filesize
24KB

Download
memory/3120-152-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3548-161-0x0000000004A70000-0x0000000004AD6000-memory.dmp

Filesize
408KB

Download
memory/3548-106-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/3548-256-0x0000000005930000-0x0000000005980000-memory.dmp

Filesize
320KB

Download
memory/4008-118-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4008-120-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4044-122-0x0000000005260000-0x00000000052F2000-memory.dmp

Filesize
584KB

Download
memory/4044-75-0x00000000007C0000-0x000000000087C000-memory.dmp

Filesize
752KB

Download
memory/4044-174-0x0000000005400000-0x000000000540A000-memory.dmp

Filesize
40KB

Download
memory/4044-101-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/4044-299-0x00000000066C0000-0x00000000066D0000-memory.dmp

Filesize
64KB

Download
memory/4044-302-0x0000000006800000-0x0000000006816000-memory.dmp

Filesize
88KB

Download
memory/4044-237-0x0000000006680000-0x000000000669E000-memory.dmp

Filesize
120KB

Download
memory/4044-326-0x00000000082D0000-0x0000000008352000-memory.dmp

Filesize
520KB

Download
memory/4112-14-0x000001EE45B30000-0x000001EE45B31000-memory.dmp

Filesize
4KB

Download
memory/4112-13-0x000001EE45B30000-0x000001EE45B31000-memory.dmp

Filesize
4KB

Download
memory/4112-12-0x000001EE45B30000-0x000001EE45B31000-memory.dmp

Filesize
4KB

Download
memory/4540-2096-0x0000022FEC400000-0x0000022FEC778000-memory.dmp

Filesize
3.5MB

Download
memory/4540-1338-0x0000022FD1CB0000-0x0000022FD1CB8000-memory.dmp

Filesize
32KB

Download
memory/4780-23-0x000001A00E8B0000-0x000001A00E8B1000-memory.dmp

Filesize
4KB

Download
memory/4780-20-0x000001A00E8B0000-0x000001A00E8B1000-memory.dmp

Filesize
4KB

Download
memory/4780-19-0x000001A00E8B0000-0x000001A00E8B1000-memory.dmp

Filesize
4KB

Download
memory/4780-18-0x000001A00E8B0000-0x000001A00E8B1000-memory.dmp

Filesize
4KB

Download
memory/4780-24-0x000001A00E8B0000-0x000001A00E8B1000-memory.dmp

Filesize
4KB

Download
memory/4780-21-0x000001A00E8B0000-0x000001A00E8B1000-memory.dmp

Filesize
4KB

Download
memory/4780-22-0x000001A00E8B0000-0x000001A00E8B1000-memory.dmp

Filesize
4KB

Download
memory/5044-1494-0x0000000000D50000-0x0000000000E34000-memory.dmp

Filesize
912KB

Download
memory/5052-287-0x0000000000B70000-0x0000000001074000-memory.dmp

Filesize
5.0MB

Download
memory/5064-37-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/5232-313-0x00000000006D0000-0x0000000000B80000-memory.dmp

Filesize
4.7MB

Download
memory/5248-653-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

Filesize
120KB

Download
memory/5248-590-0x0000000006B80000-0x0000000006BF6000-memory.dmp

Filesize
472KB

Download
memory/5248-380-0x0000000005F50000-0x0000000006112000-memory.dmp

Filesize
1.8MB

Download
memory/5248-200-0x0000000005050000-0x0000000005668000-memory.dmp

Filesize
6.1MB

Download
memory/5248-203-0x0000000004960000-0x0000000004972000-memory.dmp

Filesize
72KB

Download
memory/5248-228-0x00000000049C0000-0x00000000049FC000-memory.dmp

Filesize
240KB

Download
memory/5248-389-0x0000000006650000-0x0000000006B7C000-memory.dmp

Filesize
5.2MB

Download
memory/5248-199-0x00000000000E0000-0x00000000000FE000-memory.dmp

Filesize
120KB

Download
memory/5248-264-0x0000000004C70000-0x0000000004D7A000-memory.dmp

Filesize
1.0MB

Download
memory/5248-238-0x0000000004A30000-0x0000000004A7C000-memory.dmp

Filesize
304KB

Download
memory/5272-197-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5272-196-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5288-2909-0x000001EC10A20000-0x000001EC10A28000-memory.dmp

Filesize
32KB

Download
memory/5424-743-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/5784-253-0x0000000000180000-0x0000000000CD6000-memory.dmp

Filesize
11.3MB

Download
memory/5964-368-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/6048-1044-0x0000000005940000-0x0000000005DF0000-memory.dmp

Filesize
4.7MB

Download
memory/6048-964-0x00000000009E0000-0x0000000000F3A000-memory.dmp

Filesize
5.4MB

Download
memory/6348-1935-0x0000000000700000-0x0000000000C55000-memory.dmp

Filesize
5.3MB

Download
memory/6516-1321-0x0000000000BA0000-0x00000000010F5000-memory.dmp

Filesize
5.3MB

Download
memory/6516-1043-0x0000000000BA0000-0x00000000010F5000-memory.dmp

Filesize
5.3MB

Download
memory/6612-1916-0x0000000000FB0000-0x00000000012D4000-memory.dmp

Filesize
3.1MB

Download
memory/6688-2324-0x000000006ED40000-0x000000006ED45000-memory.dmp

Filesize
20KB

Download
memory/6776-2093-0x0000000000700000-0x0000000000C55000-memory.dmp

Filesize
5.3MB

Download