Overview

overview

10

Static

static

3

4363463463...63.exe

windows11-21h2-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

28-11-2024 02:19

241128-cr9sks1kht 10

27-11-2024 21:08

241127-zyzyaawqgn 10

27-11-2024 20:16

241127-y145caymbs 10

27-11-2024 20:13

241127-yzlxdavlen 10

27-11-2024 19:53

241127-yl61dsxpcs 10

27-11-2024 19:38

241127-ycrjcaxkfx 10

27-11-2024 19:03

241127-xqsswsslej 10

27-11-2024 19:03

241127-xqf44aslcr 3

27-11-2024 19:02

241127-xpxqfsslan 3

27-11-2024 18:32

241127-w6pkqs1mek 10

Analysis

  • max time kernel
    299s
  • max time network
    300s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13-08-2024 22:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4363463463464363463463463.exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score
10/10
phorphiexquasarredlinesnakekeylogger25072023livetrafficnewofficecollectioncredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerkeyloggerloaderpersistencespywarestealerthemidatrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/
Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
Attributes
  • mutex

    x88767657x

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Extracted

Family

quasar

Version

1.4.1

Botnet

newoffice

C2

117.18.7.76:3782

Mutex

d908c8ed-ea88-484e-a3d2-dcbe66ac7cfc

Attributes
  • encryption_key

    FD2DE574AF7E363A5304DF85B3475F93A948C103

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Client Startup

  • subdirectory

    SubDir

Extracted

Family

redline

Botnet

25072023

C2

185.215.113.67:40960

Extracted

Family

snakekeylogger

Credentials

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.52.165.210:39030

Signatures

  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • Phorphiex payload 3 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Windows security bypass 2 TTPs 18 IoCs
    evasiontrojan
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Sets service image path in registry 2 TTPs 6 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 52 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 8 IoCs
    defense_evasion
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 21 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: LoadsDriver 32 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3244
      • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
        "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Users\Admin\AppData\Local\Temp\Files\dccrypt.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\dccrypt.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\serverperf\Rf9n8rAaQutOZQd6TFDgcQ0Y3BLG9XLXz1nDso2.vbe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5060
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\serverperf\gc411KmXHpEBvwsmBcLMcGXH8jhoDdLsi9TAz2QKUXLoYkYDWV2rtqOl.bat" "
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2396
              • C:\serverperf\Portwebwin.exe
                "C:\serverperf/Portwebwin.exe"
                6⤵
                • Executes dropped EXE
                PID:3324
        • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1532
        • C:\Users\Admin\AppData\Local\Temp\Files\r.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Windows\sysmablsvr.exe
            C:\Windows\sysmablsvr.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3184
            • C:\Users\Admin\AppData\Local\Temp\2961321255.exe
              C:\Users\Admin\AppData\Local\Temp\2961321255.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3372
            • C:\Users\Admin\AppData\Local\Temp\1966312418.exe
              C:\Users\Admin\AppData\Local\Temp\1966312418.exe
              5⤵
              • Executes dropped EXE
              PID:3052
        • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1292
          • C:\Users\Admin\AppData\Local\Temp\2032529430.exe
            C:\Users\Admin\AppData\Local\Temp\2032529430.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3652
            • C:\Windows\sysmysldrv.exe
              C:\Windows\sysmysldrv.exe
              5⤵
              • Modifies security service
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: SetClipboardViewer
              • Suspicious use of WriteProcessMemory
              PID:4676
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:240
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2104
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2888
                • C:\Windows\SysWOW64\sc.exe
                  sc stop UsoSvc
                  7⤵
                  • Launches sc.exe
                  PID:1048
                • C:\Windows\SysWOW64\sc.exe
                  sc stop WaaSMedicSvc
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:940
                • C:\Windows\SysWOW64\sc.exe
                  sc stop wuauserv
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:1304
                • C:\Windows\SysWOW64\sc.exe
                  sc stop DoSvc
                  7⤵
                  • Launches sc.exe
                  PID:4400
                • C:\Windows\SysWOW64\sc.exe
                  sc stop BITS
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:996
              • C:\Users\Admin\AppData\Local\Temp\3130932277.exe
                C:\Users\Admin\AppData\Local\Temp\3130932277.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2808
              • C:\Users\Admin\AppData\Local\Temp\1590123746.exe
                C:\Users\Admin\AppData\Local\Temp\1590123746.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3008
        • C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_pps.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_pps.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Sets service image path in registry
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Impair Defenses: Safe Mode Boot
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: LoadsDriver
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3116
        • C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4860
        • C:\Users\Admin\AppData\Local\Temp\Files\66ae9b60d9863_otr.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\66ae9b60d9863_otr.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3820
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4708
        • C:\Users\Admin\AppData\Local\Temp\Files\m.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1652
        • C:\Users\Admin\AppData\Local\Temp\Files\a.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:980
        • C:\Users\Admin\AppData\Local\Temp\Files\66ae97ac4c30d_crypted.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\66ae97ac4c30d_crypted.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2772
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:4364
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:2784
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:324
            • C:\Users\Admin\AppData\Local\Temp\Files\11.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1324
              • C:\Windows\sysarddrvs.exe
                C:\Windows\sysarddrvs.exe
                4⤵
                • Modifies security service
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: SetClipboardViewer
                PID:4280
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1636
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1844
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2560
                  • C:\Windows\SysWOW64\sc.exe
                    sc stop UsoSvc
                    6⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:3400
                  • C:\Windows\SysWOW64\sc.exe
                    sc stop WaaSMedicSvc
                    6⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:1420
                  • C:\Windows\SysWOW64\sc.exe
                    sc stop wuauserv
                    6⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:2604
                  • C:\Windows\SysWOW64\sc.exe
                    sc stop DoSvc
                    6⤵
                    • Launches sc.exe
                    PID:2452
                  • C:\Windows\SysWOW64\sc.exe
                    sc stop BITS
                    6⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:4800
                • C:\Users\Admin\AppData\Local\Temp\226327991.exe
                  C:\Users\Admin\AppData\Local\Temp\226327991.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4212
                • C:\Users\Admin\AppData\Local\Temp\3185832176.exe
                  C:\Users\Admin\AppData\Local\Temp\3185832176.exe
                  5⤵
                  • Executes dropped EXE
                  PID:1568
            • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2716
              • C:\Users\Admin\AppData\Local\Temp\1129519889.exe
                C:\Users\Admin\AppData\Local\Temp\1129519889.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3164
            • C:\Users\Admin\AppData\Local\Temp\Files\qNVQKFyM.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\qNVQKFyM.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4340
            • C:\Users\Admin\AppData\Local\Temp\Files\Identifications.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\Identifications.exe"
              3⤵
              • Executes dropped EXE
              PID:2200
            • C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:460
            • C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2064
            • C:\Users\Admin\AppData\Local\Temp\Files\verus-solver.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\verus-solver.exe"
              3⤵
              • Executes dropped EXE
              PID:2256
            • C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:4804
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3456
            • C:\Users\Admin\AppData\Local\Temp\Files\25072023.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\25072023.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:3196
            • C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"
              3⤵
              • Executes dropped EXE
              PID:3948
            • C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4544
            • C:\Users\Admin\AppData\Local\Temp\Files\1.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:240
            • C:\Users\Admin\AppData\Local\Temp\Files\66b1f63c9578f_doz.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\66b1f63c9578f_doz.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2440
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:3320
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\FIDHIEBAAKJD" & exit
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3544
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 10
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:2236
            • C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\pp.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1668
            • C:\Users\Admin\AppData\Local\Temp\Files\wahost.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\wahost.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1584
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qdevaGeIZsRT.exe"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1088
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qdevaGeIZsRT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCA46.tmp"
                4⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:4628
              • C:\Users\Admin\AppData\Local\Temp\Files\wahost.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\wahost.exe"
                4⤵
                • Executes dropped EXE
                • Accesses Microsoft Outlook profiles
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2748
            • C:\Users\Admin\AppData\Local\Temp\Files\o.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\o.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2056
            • C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4672
            • C:\Users\Admin\AppData\Local\Temp\Files\GOLD.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\GOLD.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2792
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2872
            • C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1964
              • C:\Users\Admin\AppData\Local\Temp\2818411319.exe
                C:\Users\Admin\AppData\Local\Temp\2818411319.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2300
            • C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3432
            • C:\Users\Admin\AppData\Local\Temp\Files\jp.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\jp.exe"
              3⤵
              • Executes dropped EXE
              PID:1800
            • C:\Users\Admin\AppData\Local\Temp\Files\regasm.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\regasm.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3784
              • C:\Users\Admin\AppData\Local\Temp\Files\regasm.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\regasm.exe"
                4⤵
                • Executes dropped EXE
                • Accesses Microsoft Outlook profiles
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • outlook_office_path
                • outlook_win_path
                PID:4892
            • C:\Users\Admin\AppData\Local\Temp\Files\t.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:700
            • C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_new.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_new.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetWindowsHookEx
              PID:1528
            • C:\Users\Admin\AppData\Local\Temp\Files\x64.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\x64.exe"
              3⤵
              • Executes dropped EXE
              PID:3420
            • C:\Users\Admin\AppData\Local\Temp\Files\s.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1360
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1132
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
            2⤵
              PID:1852
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3056
          • C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
            "C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3556

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Impair Defenses

          4
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Safe Mode Boot

          1
          T1562.009

          Modify Registry

          6
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Virtualization/Sandbox Evasion

          1
          T1497

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          4
          T1552

          Credentials In Files

          4
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          5
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Virtualization/Sandbox Evasion

          1
          T1497

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Email Collection

          1
          T1114

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            d0c46cad6c0778401e21910bd6b56b70

            SHA1

            7be418951ea96326aca445b8dfe449b2bfa0dca6

            SHA256

            9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

            SHA512

            057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZQ9FC15F\2[1]
            Filesize

            92KB

            MD5

            e57f9e2fc24a1ace0267a7962c9e465e

            SHA1

            840f5f4aed29f241642dab534e14f86c7cd5dfc6

            SHA256

            aa66df748ef74df48c7d1c2954c49702b15e95787b1d3b562dba50894abc0910

            SHA512

            d62dde392715a6c6869d621d87f3df2713293190676b24fdbac5b40dea07530edd8770f3b7ba69f6f2fda4c5275a8a05b5f4e91b90a4feb9537ec051193040c0

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            87cbe5c0dae5ab2b66cea4f8f089396e

            SHA1

            1803bfe833b2481765d8ae73412fb917344f7173

            SHA256

            ff5dfe910b4d5bb5c00fcf5ea1d59df98ac8441347732a7d09451ae14612925c

            SHA512

            8998bb316cdd70482674986075e2a3b23ef1fd8e83c766a2d6fb9e582d673532bd48a9651662b8e9ba5f05adeded04889a0b8d6c38badd0f5359ae2886cabf53

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\2032529430.exe
            Filesize

            92KB

            MD5

            be9388b42333b3d4e163b0ace699897b

            SHA1

            4e1109772eb9cb59c557380822166fe1664403bd

            SHA256

            d281e0a0f1e1073f2d290a7eb1f77bed4c210dbf83a0f4f4e22073f50faa843f

            SHA512

            5f887f1060b898c9a88745cde7cf509fdf42947ab8e5948b46c2df659468dc245b24d089bdbec0b314c40b83934698bf4b6feb8954e32810ff8f522aab0af19a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\2961321255.exe
            Filesize

            7KB

            MD5

            cf14448f02d12e7bb6a449658848b16f

            SHA1

            6b626e9a288dd5844788bff075806f05bf653a18

            SHA256

            32cac3b9230d88f0fdcae005ea8f92236a5dd2488df7ca9c97ef66f145ca4e37

            SHA512

            3fb30aebe173d881c432550d7d4085536afbb7961be4c6ceef91e3386d3b81c5312eb5c4b97bbb6d6323842ada8a562d0da262b2bf6e053a1ba569028b65e22f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\11.exe
            Filesize

            79KB

            MD5

            e2e3268f813a0c5128ff8347cbaa58c8

            SHA1

            4952cbfbdec300c048808d79ee431972b8a7ba84

            SHA256

            d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

            SHA512

            cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\25072023.exe
            Filesize

            304KB

            MD5

            a9a37926c6d3ab63e00b12760fae1e73

            SHA1

            944d6044e111bbad742d06852c3ed2945dc9e051

            SHA256

            27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b

            SHA512

            575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\66ae97ac4c30d_crypted.exe
            Filesize

            1007KB

            MD5

            dbfb97dfac2ebd1c0c891897dee558a3

            SHA1

            201ef46bae62cf281cdd957e3e8a6f0267f48726

            SHA256

            af7560ea85884942b24ba8f222da1c2cf0a06d715efd932d8c55e87d6ae6b381

            SHA512

            31c34dfac762645200b54e27ab46f9de61499dca4b8d4ebdf8b17dcf91b4c794cfad6ab443dc412038dedf20bcbd2099bc63f4d3f1821c7b1f307b38cd673c8d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\66ae9b60d9863_otr.exe
            Filesize

            3.8MB

            MD5

            3d3191283ae8325423342c1e29e4472b

            SHA1

            6514198e8f0f62e1db527831a629af1362919448

            SHA256

            c24d6c52c061973f5b76cf2fbf569004ad7d511550d1104d26f6a4dac9ce613a

            SHA512

            5343b8b1ccbfb14ca2620ae2e8fa6c2463bd630cec96444be1c22426aff5007f29f6d742c49458fe16228db12bfcdd9ea0cf4b7bbee1023cfac7d540004d4cc5

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\66b1f63c9578f_doz.exe
            Filesize

            6.3MB

            MD5

            07d615115d848b9b21d425e72116537e

            SHA1

            09ab47a2200b722c874f720dce71311592e17f60

            SHA256

            59778733797d1033f33e5803810777b199bab7a53710c385c9f8b1cea648d4ec

            SHA512

            3472b97076d33a2f2a6e677cc1ab30768f39e07f697acda478626897d809b63f521b4016101e3a0d2cc5785ccd764b6e0e68d9b84b5b86c7157b31ac63fddbd7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe
            Filesize

            1.9MB

            MD5

            c1853d1c36dc461668c9af843d07cc58

            SHA1

            3c59af9da25113235365a6c08b44a3d6bfd3a1e8

            SHA256

            83cd3dcf4a855593ff0f594158ec9d27a8eb94172a92c4092138db7abfbc8793

            SHA512

            fd110a42927d580586081647d4d03f4cac6dd5934855e55e07794eec91b9d9d2e61a3d6cee2da5399966beae6cd1652b4d5583c492646dde87c824907e231463

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\GOLD.exe
            Filesize

            954KB

            MD5

            e71c0c5d72455dde6510ba23552d7d2f

            SHA1

            4dff851c07a9f9ebc9e71b7f675cc20b06a2439c

            SHA256

            de1d7fe86a0b70a7a268d2960109833f4d126d5d9e3acb36697e8ff59c56017f

            SHA512

            c6f4b1eb353a554ca49bab5e894a4d7c46e2674d32f2f0d5a9231400d14a9ea5604c079193cd0bed9fea409bb71b5779c0c03671e104cb0740fe8ade3e530ca6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\Identifications.exe
            Filesize

            9.2MB

            MD5

            5f283d0e9d35b9c56fb2b3514a5c4f86

            SHA1

            5869ef600ba564ae7bc7db52b9c70375607d51aa

            SHA256

            41657910cd010c7e5ebbbfc11a2636fa1868a9bffe78d98b8faa7bd0e9c5c3b8

            SHA512

            b5b78975c6328feb5e1986698174a85ddf722a639234eb6fe80cfccabaa7d0c09678c9465fd6a9586a0a412f2586d9e9d38eb5243626a2b44a8c8512322415b3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_new.exe
            Filesize

            6.8MB

            MD5

            a2ed2bf5957b0b2d33eb778a443d15d0

            SHA1

            889b45e70070c3ef4b8cd900fdc43140a5ed8105

            SHA256

            866f59529cf4e0a4c2c4bcd2b9d5d18ece73bf99470ea1be81b26f91b586b174

            SHA512

            b50b7416bc75324866407e08fd9bb29b0abed501e0720bb77721ce4922d7512221f93becc9cd37efd73b4bf0984d4db5a4da13e896f988256333d972e22ffba8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_pps.exe
            Filesize

            8.3MB

            MD5

            8cafdbb0a919a1de8e0e9e38f8aa19bd

            SHA1

            63910a00e3e63427ec72e20fb0eb404cc1ff7e9c

            SHA256

            1e2e566871e5e2d6b37ed00747f8ecd4c7098d39a2fdc8f272b1ff2962122733

            SHA512

            cd65da486929240c041a7c0316a23402fc0364d778056eeeb1a07cba9b0687e6604c4f46c6f0655c6e8b8992be633aac6741bc1b841e1058e1b46fca5f0bce22

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
            Filesize

            19KB

            MD5

            1318fbc69b729539376cb6c9ac3cee4c

            SHA1

            753090b4ffaa151317517e8925712dd02908fe9e

            SHA256

            e972fb08a4dcde8d09372f78fe67ba283618288432cdb7d33015fc80613cb408

            SHA512

            7a72a77890aa74ea272473018a683f1b6961e5e765eb90e5be0bb397f04e58b09ab47cfb6095c2fea91f4e0d39bd65e21fee54a0eade36378878b7880bcb9d22

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\dccrypt.exe
            Filesize

            2.4MB

            MD5

            55398a65a9d1abb512e943a0d8901cb0

            SHA1

            9dfa573fad30f5010bc91cdf0752461aacaf36cf

            SHA256

            e91ebc7e19b4dec3ce6f2aaf4ee8fb9fb24cba265088781f9845d8a32d1f2948

            SHA512

            5cc41e3b79e35597f288737a7f65c035c56524c94d98dcb9892d656d92a6652a9f3b42a96b09d3fb10bd6e3c84fbe326efc64e252c0bc62d19ee6e80f1fdd556

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\gaqzslqimafjcxr.sys
            Filesize

            624KB

            MD5

            5eb2f44651d3e4b90664bab3070409ff

            SHA1

            6d71d69243bc2495a107ca45d5989a6fc1545570

            SHA256

            32726fa33be861472d0b26286073b49500e3fd3bd1395f63bc114746a9195efb

            SHA512

            55eef39a6845567c8bf64d04e5414537837ae7937229849f7bb1f28e4ddc22428aa1d56af177606c1ea31dd8799ff96d1dfa0f80cb266afe31ca1b43fe9313b5

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\jp.exe
            Filesize

            339KB

            MD5

            808502752ca0492aca995e9b620d507b

            SHA1

            668c40bb6c792b3502b4eefd0916febc8dbd5182

            SHA256

            0f56c703e9b7ddeb90646927bac05a5c6d95308c8e13b88e5d4f4b572423e036

            SHA512

            9a35ea626bb411531efe905a4a81c3dfdebf86b222d3005e846c87f9501b3d91a6164ef44c2ca72070fe8c33f2bfbfb58b4f96353be1aa8c2c6f9390827a5afa

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
            Filesize

            9KB

            MD5

            8d8e6c7952a9dc7c0c73911c4dbc5518

            SHA1

            9098da03b33b2c822065b49d5220359c275d5e94

            SHA256

            feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

            SHA512

            91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
            Filesize

            5.4MB

            MD5

            41ab08c1955fce44bfd0c76a64d1945a

            SHA1

            2b9cb05f4de5d98c541d15175d7f0199cbdd0eea

            SHA256

            dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493

            SHA512

            38834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
            Filesize

            20KB

            MD5

            1382c0a4a9e0a9a2c942458652a4a0e4

            SHA1

            55ed8ebd6281c280c3e77763773d789a6057e743

            SHA256

            4cb590dfafb7653379326e840d9b904a3cf05451999c4f9eb66c6e7116b68875

            SHA512

            cc1ba7e779536b57409c974f16b0d8706fdf8749fb9eca36716d4e84d4f420a650b6476ac08570e684ad1e492da3bbacc15a4e5be4b94a1b708909d683da0b7e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\qNVQKFyM.exe
            Filesize

            3.8MB

            MD5

            e3a6a985899b7b14de0e539045fa8856

            SHA1

            1fdfc2ea75c2f52526dfa96834ec2f383d0c02f8

            SHA256

            30ab8dea3f9af09e931fe9c72cc52c5a1a69ab6de752f20d13e465c7a4bda6d4

            SHA512

            7e5f43999a1c4e46134446a259604fe9ea8d3c5688751baa83c33fa3d104e8ef2a35e2ac3c437d6ab98bf8f74696508ab643ac6030ba63c9aec7c219441ce451

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\r.exe
            Filesize

            88KB

            MD5

            ababca6d12d96e8dd2f1d7114b406fae

            SHA1

            dcd9798e83ec688aacb3de8911492a232cb41a32

            SHA256

            a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

            SHA512

            b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\regasm.exe
            Filesize

            694KB

            MD5

            62b9f8d4c98febbcd68e635c14d8d882

            SHA1

            9689119fff4101543313c9fc73072cc3f7cb9736

            SHA256

            e93063292dbb2c3209541ea13e57d0cca3225f35eb18977d2b3400a97255a49d

            SHA512

            7eb0993733bd683b5b4ad128c1f7d746de4125da05d5e8bdbde1070705175ac12b431ab1924d08652462a3f4e5bf63bfb60717ac6b476186eff30e4aa9e2ee05

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
            Filesize

            6KB

            MD5

            cfb7fbf1d4b077a0e74ed6e9aab650a8

            SHA1

            a91cfbcc9e67e8f4891dde04e7d003fc63b7d977

            SHA256

            d93add71a451ec7c04c99185ae669e59fb866eb38f463e9425044981ed1bcae0

            SHA512

            b174d0fed1c605decc4e32079a76fbb324088b710ce1a3fe427a9a30c7bdcd6ac1ad223970cdc64061705f9a268afa96463ee73536b46991981d041517b77785

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\verus-solver.exe
            Filesize

            432KB

            MD5

            409a8395747cebaefa1e1981c4eef62e

            SHA1

            987ae8b6741df673b230df04e349228b06bf1207

            SHA256

            62262e9b886df554547c1645a2048a2ee57d406718d89036b1f2c600eacde7cc

            SHA512

            a35ce7cf39ca2d6eaf26feb3c242be4936c56b4b41f82517c6788e2ad84ed4737f9033e3f88c7982727584a0d4914b98770b47c0f1bdf9e0b6c0fd3c8c71fcdf

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\wahost.exe
            Filesize

            561KB

            MD5

            c4e132981278de75588c85590d9bbad4

            SHA1

            f071a2714fec8215dd88cd96f82f52de38c49fa6

            SHA256

            ec48091b8b9cc09fd9d73415078622d8b3c5fb2de818caa20814a43b1d1c14c7

            SHA512

            665f360c8b9835bd5e6183fbd3e197a2546ed9585c80fb3019715ed9581cf0ffc16ec11dc9d9b93b14377b003b138fb56c83018c0ff0392fe0684b60c0a60498

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\x64.exe
            Filesize

            19KB

            MD5

            c5a325ee2a50f7670cd5bd685721ee06

            SHA1

            70d2ea04f1def5eb21e50d2721963f6f86878085

            SHA256

            be612ad3ca300081821d969d2e57bd3c1b01362caf13496d311677762a0387c5

            SHA512

            7cdd860c8e6e60c7f7b3694167543ea77e6c4beb1ce81560af5ecb913147f25161b13041632e37fa9bc4ab15ac7eeb5995effc24cd5a4558d7b34c16cc9571b3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Tmp9CF2.tmp
            Filesize

            2KB

            MD5

            1420d30f964eac2c85b2ccfe968eebce

            SHA1

            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

            SHA256

            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

            SHA512

            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_blf12ycr.v5v.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\tbtnds.dat
            Filesize

            3KB

            MD5

            8f585cfd4bcb25d0c06778ef82f37804

            SHA1

            3e7f6d52f672a3f17d7da0d2f141fcb44d621b0a

            SHA256

            9fe63f3bb2d7a142c208fe8e9978b8cc2a7de22cf5256fd60581bb461614d1be

            SHA512

            057a5c7985a9ccab37258b5f49a7bfe814b82e4bcddef200ab1ee19e78bc61c173821059e0b410cb3cb44c2dd55adc72300ed8b2908da596d64eb8ad36d1532a

            Download Submit

          • C:\serverperf\Portwebwin.exe
            Filesize

            2.1MB

            MD5

            b706af07e8a87b688024a52a49d9676f

            SHA1

            75e94c859ba5acfe7a09f59b4d3c50a92fa9192a

            SHA256

            40a6508de2984c0b3869ee1de21a5aa04cabddc21d54554956f3ad9d2a390c2a

            SHA512

            227d8199d6674f3ff51fd02b9105ab06314e1fb82ab7057bd43660b4c58e843bc6399c8c0f3d381c0ed6748a7e9089b13f0f3f177689cd7a35d136c408453d55

            Download Submit

          • C:\serverperf\Rf9n8rAaQutOZQd6TFDgcQ0Y3BLG9XLXz1nDso2.vbe
            Filesize

            245B

            MD5

            ca5432879ede28c26db0fe6abeff116f

            SHA1

            69018b42d1d0fb90675ed89b5ef470060bccf2c4

            SHA256

            8a12973aa5a19751ea7fd0d01ce30fa1dad714d241084b8b2055dc63aec152c4

            SHA512

            03759619209d2ccd50f2710d55fe3ecdb9522d69a6509be9af2c6b70b9bf735eaf6a36503bd1b62db8be7a7e57e01d158fd6011b664ab93d38a65a7e29633336

            Download Submit

          • C:\serverperf\gc411KmXHpEBvwsmBcLMcGXH8jhoDdLsi9TAz2QKUXLoYkYDWV2rtqOl.bat
            Filesize

            80B

            MD5

            ae1623f3f34bd2670cd2ce4c6628b08e

            SHA1

            955bcf3d0ed3e8dbe4e654f955eb55e34bf59c89

            SHA256

            babf7e33e87db860f527fe5cef835786b0d85d75129252e26bbfd6079a74b50e

            SHA512

            c7109605eb0a40d273344f998b6205422508604335f567652f785dfa7cf6b7a6d055f9327c6f0ace2ef7334e7cd4530087f09bccc508e7bf2d1e7b43a010f56f

            Download Submit

          • memory/324-277-0x00000000087C0000-0x0000000008DD8000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/324-281-0x0000000008400000-0x000000000844C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/324-280-0x00000000082A0000-0x00000000082DC000-memory.dmp

            Filesize

            240KB

            Download

          • memory/324-279-0x0000000008240000-0x0000000008252000-memory.dmp

            Filesize

            72KB

            Download

          • memory/324-278-0x00000000082F0000-0x00000000083FA000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/324-297-0x000000000A370000-0x000000000A89C000-memory.dmp

            Filesize

            5.2MB

            Download

          • memory/324-256-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

            Download

          • memory/324-291-0x0000000009340000-0x00000000093B6000-memory.dmp

            Filesize

            472KB

            Download

          • memory/324-294-0x0000000009310000-0x000000000932E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/324-257-0x0000000005750000-0x0000000005CF6000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/324-296-0x0000000009C70000-0x0000000009E32000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/324-258-0x0000000005240000-0x00000000052D2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/324-259-0x0000000005160000-0x000000000516A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1088-804-0x0000000005D90000-0x00000000060E7000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/1088-818-0x00000000076D0000-0x00000000076E5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/1088-807-0x000000006C0E0000-0x000000006C12C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1088-816-0x0000000007340000-0x00000000073E4000-memory.dmp

            Filesize

            656KB

            Download

          • memory/1088-817-0x0000000007690000-0x00000000076A1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1132-765-0x000002407CF00000-0x000002407CF22000-memory.dmp

            Filesize

            136KB

            Download

          • memory/1528-924-0x0000000140000000-0x000000014118D000-memory.dmp

            Filesize

            17.6MB

            Download

          • memory/1528-909-0x0000000140000000-0x000000014118D000-memory.dmp

            Filesize

            17.6MB

            Download

          • memory/1584-745-0x0000000007590000-0x00000000075A6000-memory.dmp

            Filesize

            88KB

            Download

          • memory/1584-739-0x0000000000050000-0x00000000000E2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/1584-789-0x00000000076D0000-0x00000000076DE000-memory.dmp

            Filesize

            56KB

            Download

          • memory/1584-790-0x00000000076E0000-0x0000000007748000-memory.dmp

            Filesize

            416KB

            Download

          • memory/1844-320-0x00000000071D0000-0x00000000071E1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1844-321-0x0000000007220000-0x0000000007235000-memory.dmp

            Filesize

            84KB

            Download

          • memory/1844-307-0x00000000056D0000-0x0000000005A27000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/1844-309-0x000000006FE50000-0x000000006FE9C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1844-318-0x0000000006D20000-0x0000000006DC4000-memory.dmp

            Filesize

            656KB

            Download

          • memory/2104-93-0x0000000007D60000-0x00000000083DA000-memory.dmp

            Filesize

            6.5MB

            Download

          • memory/2104-82-0x000000006F4A0000-0x000000006F4EC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/2104-96-0x0000000007960000-0x00000000079F6000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2104-98-0x0000000007910000-0x000000000791E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/2104-61-0x0000000002E90000-0x0000000002EC6000-memory.dmp

            Filesize

            216KB

            Download

          • memory/2104-99-0x0000000007920000-0x0000000007935000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2104-100-0x0000000007A00000-0x0000000007A1A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/2104-95-0x0000000007740000-0x000000000774A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2104-101-0x0000000007A20000-0x0000000007A28000-memory.dmp

            Filesize

            32KB

            Download

          • memory/2104-94-0x00000000076E0000-0x00000000076FA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/2104-62-0x0000000005730000-0x0000000005D5A000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/2104-92-0x0000000007580000-0x0000000007624000-memory.dmp

            Filesize

            656KB

            Download

          • memory/2104-91-0x0000000006960000-0x000000000697E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/2104-97-0x00000000078E0000-0x00000000078F1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/2104-81-0x0000000007330000-0x0000000007364000-memory.dmp

            Filesize

            208KB

            Download

          • memory/2104-78-0x00000000063A0000-0x00000000063EC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/2104-77-0x0000000006360000-0x000000000637E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/2104-74-0x0000000005E20000-0x0000000006177000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/2104-65-0x00000000055B0000-0x0000000005616000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2104-64-0x0000000005540000-0x00000000055A6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2104-63-0x00000000054A0000-0x00000000054C2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2440-648-0x00000000008C0000-0x0000000000F18000-memory.dmp

            Filesize

            6.3MB

            Download

          • memory/2440-649-0x0000000005990000-0x0000000005A88000-memory.dmp

            Filesize

            992KB

            Download

          • memory/2748-805-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

            Download

          • memory/2872-855-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

            Download

          • memory/3116-125-0x0000000140000000-0x0000000141242000-memory.dmp

            Filesize

            18.3MB

            Download

          • memory/3116-145-0x0000000140000000-0x0000000141242000-memory.dmp

            Filesize

            18.3MB

            Download

          • memory/3116-152-0x0000000140000000-0x0000000141242000-memory.dmp

            Filesize

            18.3MB

            Download

          • memory/3116-148-0x0000000140000000-0x0000000141242000-memory.dmp

            Filesize

            18.3MB

            Download

          • memory/3116-147-0x0000000140000000-0x0000000141242000-memory.dmp

            Filesize

            18.3MB

            Download

          • memory/3116-499-0x0000000140000000-0x0000000141242000-memory.dmp

            Filesize

            18.3MB

            Download

          • memory/3116-146-0x0000000140000000-0x0000000141242000-memory.dmp

            Filesize

            18.3MB

            Download

          • memory/3188-3-0x0000000074B10000-0x00000000752C1000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3188-12-0x0000000074B10000-0x00000000752C1000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3188-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3188-4-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3188-2-0x00000000059A0000-0x0000000005A3C000-memory.dmp

            Filesize

            624KB

            Download

          • memory/3188-1-0x0000000000F40000-0x0000000000F48000-memory.dmp

            Filesize

            32KB

            Download

          • memory/3196-611-0x0000000006B90000-0x0000000006BDC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3196-588-0x0000000000870000-0x00000000008C2000-memory.dmp

            Filesize

            328KB

            Download

          • memory/3324-354-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/3784-892-0x0000000000400000-0x00000000004B4000-memory.dmp

            Filesize

            720KB

            Download

          • memory/3784-893-0x00000000051D0000-0x00000000051E2000-memory.dmp

            Filesize

            72KB

            Download

          • memory/3784-914-0x0000000006020000-0x00000000060AC000-memory.dmp

            Filesize

            560KB

            Download

          • memory/3820-187-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-189-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-199-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-201-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-203-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-169-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-205-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-195-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-207-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-193-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-209-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-211-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-213-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-215-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-217-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-219-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-221-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-223-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-225-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-197-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-167-0x00000000055A0000-0x00000000055BC000-memory.dmp

            Filesize

            112KB

            Download

          • memory/3820-166-0x00000000056E0000-0x0000000005840000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/3820-165-0x0000000000880000-0x0000000000C52000-memory.dmp

            Filesize

            3.8MB

            Download

          • memory/3820-191-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-168-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-185-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-171-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-173-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-175-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-183-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-181-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-179-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/3820-177-0x00000000055A0000-0x00000000055B5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/4340-334-0x0000000005A70000-0x0000000005D94000-memory.dmp

            Filesize

            3.1MB

            Download

          • memory/4340-338-0x00000000061D0000-0x0000000006220000-memory.dmp

            Filesize

            320KB

            Download

          • memory/4340-339-0x00000000069F0000-0x0000000006AA2000-memory.dmp

            Filesize

            712KB

            Download

          • memory/4804-536-0x00000000008C0000-0x0000000000AB2000-memory.dmp

            Filesize

            1.9MB

            Download

          • memory/4892-916-0x0000000000400000-0x000000000044A000-memory.dmp

            Filesize

            296KB

            Download