Overview

overview

10

Static

static

3

4363463463...63.exe

windows7-x64

10

4363463463...63.exe

windows10-2004-x64

10

New Text D...od.exe

windows7-x64

1

New Text D...od.exe

windows10-2004-x64

1

New Text D...od.exe

windows7-x64

1

New Text D...od.exe

windows10-2004-x64

1

Resubmissions

02-09-2024 02:19

240902-crxs1syfmm 10

07-07-2024 21:02

240707-zvllgsyaqp 10

01-07-2024 21:37

240701-1gjemsverk 10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 02:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4363463463464363463463463.exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score
10/10
lummaphorphiexstealcxmrigcryvalencigacredential_accessdefense_evasiondiscoveryevasionexecutionloaderminerpersistencepyinstallerspywarestealerthemidatrojanupxworm

Malware Config

Extracted

Family

stealc

Botnet

cry

C2

http://193.176.190.41

Attributes
  • url_path

    /2fa883eebd632382.php

Extracted

Family

stealc

Botnet

valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

lumma

C2

https://miracledzmnqwui.shop/api

https://interactiedovspm.shop/api

https://charecteristicdxp.shop/api

https://complaintsipzzx.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • Phorphiex payload 3 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
  • Windows security bypass 2 TTPs 18 IoCs
    evasiontrojan
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • XMRig Miner payload 5 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Sets service image path in registry 2 TTPs 9 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 42 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 14 IoCs
    defense_evasion
  • Loads dropped DLL 52 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 14 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 21 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies registry class 33 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 32 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3484
      • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
        "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2408
        • C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3788
          • C:\Windows\sysmablsvr.exe
            C:\Windows\sysmablsvr.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3708
            • C:\Users\Admin\AppData\Local\Temp\968416102.exe
              C:\Users\Admin\AppData\Local\Temp\968416102.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3844
              • C:\Users\Admin\AppData\Local\Temp\1062310550.exe
                C:\Users\Admin\AppData\Local\Temp\1062310550.exe
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:2924
            • C:\Users\Admin\AppData\Local\Temp\2823715327.exe
              C:\Users\Admin\AppData\Local\Temp\2823715327.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3788
        • C:\Users\Admin\AppData\Local\Temp\Files\Wpm2.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\Wpm2.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3696
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 696
            4⤵
            • Program crash
            PID:4480
        • C:\Users\Admin\AppData\Local\Temp\Files\PctOccurred.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\PctOccurred.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3456
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k move Powell Powell.cmd & Powell.cmd & exit
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1816
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4472
            • C:\Windows\SysWOW64\findstr.exe
              findstr /I "wrsa.exe opssvc.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4116
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2276
            • C:\Windows\SysWOW64\findstr.exe
              findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1260
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c md 193997
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4408
            • C:\Windows\SysWOW64\findstr.exe
              findstr /V "JulieAppMagneticWhenever" Hist
              5⤵
              • System Location Discovery: System Language Discovery
              PID:540
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b ..\Medicines + ..\While + ..\Remained + ..\Bs + ..\Ak + ..\Statistical + ..\Entity + ..\Autumn + ..\Scott + ..\Keyboards y
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1788
            • C:\Users\Admin\AppData\Local\Temp\193997\Restructuring.pif
              Restructuring.pif y
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2756
            • C:\Windows\SysWOW64\choice.exe
              choice /d y /t 5
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3528
        • C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_new.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_new.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Sets service image path in registry
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Impair Defenses: Safe Mode Boot
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: LoadsDriver
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:4656
          • C:\Windows\System32\notepad.exe
            "C:\Windows\System32\notepad.exe" C:\Users\Admin\Documents\jvohfgijfgdhgfhgfh.txt
            4⤵
            • Opens file in notepad (likely ransom note)
            • Suspicious use of FindShellTrayWindow
            PID:3528
        • C:\Users\Admin\AppData\Local\Temp\Files\t.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4744
          • C:\Windows\sysarddrvs.exe
            C:\Windows\sysarddrvs.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: SetClipboardViewer
            PID:660
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2800
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2404
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3580
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4380
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2988
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4688
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2728
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4160
            • C:\Users\Admin\AppData\Local\Temp\1618212856.exe
              C:\Users\Admin\AppData\Local\Temp\1618212856.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1444
            • C:\Users\Admin\AppData\Local\Temp\1574813051.exe
              C:\Users\Admin\AppData\Local\Temp\1574813051.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1652
        • C:\Users\Admin\AppData\Local\Temp\Files\dmshell.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\dmshell.exe"
          3⤵
          • Executes dropped EXE
          PID:2908
          • C:\Windows\SYSTEM32\cmd.exe
            cmd
            4⤵
              PID:1632
          • C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2884
            • C:\Windows\syslyqdvr.exe
              C:\Windows\syslyqdvr.exe
              4⤵
              • Modifies security service
              • Windows security bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: SetClipboardViewer
              PID:3704
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4680
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4056
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3084
                • C:\Windows\SysWOW64\sc.exe
                  sc stop UsoSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:944
                • C:\Windows\SysWOW64\sc.exe
                  sc stop WaaSMedicSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:1552
                • C:\Windows\SysWOW64\sc.exe
                  sc stop wuauserv
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:2016
                • C:\Windows\SysWOW64\sc.exe
                  sc stop DoSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:2172
                • C:\Windows\SysWOW64\sc.exe
                  sc stop BITS
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:4536
              • C:\Users\Admin\AppData\Local\Temp\1888230409.exe
                C:\Users\Admin\AppData\Local\Temp\1888230409.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2112
              • C:\Users\Admin\AppData\Local\Temp\2626928615.exe
                C:\Users\Admin\AppData\Local\Temp\2626928615.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1632
          • C:\Users\Admin\AppData\Local\Temp\Files\66c4c6ec7d961_crypto.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\66c4c6ec7d961_crypto.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3904
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              4⤵
                PID:4620
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:2768
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & del "C:\ProgramData\*.dll"" & exit
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:224
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 5
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:2292
            • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:944
              • C:\Users\Admin\AppData\Local\Temp\3079025237.exe
                C:\Users\Admin\AppData\Local\Temp\3079025237.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3004
            • C:\Users\Admin\AppData\Local\Temp\Files\latest.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\latest.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4504
              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1917298 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Files\latest.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1302416131-1437503476-2806442725-1000"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4968
            • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"
              3⤵
              • Executes dropped EXE
              PID:4980
              • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2076
                • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                  C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                  5⤵
                  • Executes dropped EXE
                  PID:4436
                  • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                    C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2116
            • C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:3168
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\SysWOW64\cmd.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:3188
                • C:\Windows\SysWOW64\explorer.exe
                  "C:\Windows\SysWOW64\explorer.exe"
                  5⤵
                    PID:1952
              • C:\Users\Admin\AppData\Local\Temp\Files\stealc_valenciga.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\stealc_valenciga.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:2212
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\stealc_valenciga.exe" & del "C:\ProgramData\*.dll"" & exit
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3084
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 5
                    5⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:3472
              • C:\Users\Admin\AppData\Local\Temp\Files\1.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3972
              • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4604
                • C:\Users\Admin\AppData\Local\Temp\241064857.exe
                  C:\Users\Admin\AppData\Local\Temp\241064857.exe
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2448
              • C:\Users\Admin\AppData\Local\Temp\Files\a.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3632
              • C:\Users\Admin\AppData\Local\Temp\Files\66ce053d9a01d_BitcoinCore.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\66ce053d9a01d_BitcoinCore.exe"
                3⤵
                • Executes dropped EXE
                PID:4564
              • C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4016
              • C:\Users\Admin\AppData\Local\Temp\Files\r.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3472
            • C:\Users\Admin\AppData\Local\Temp\193997\Restructuring.pif
              C:\Users\Admin\AppData\Local\Temp\193997\Restructuring.pif
              2⤵
              • Executes dropped EXE
              PID:2276
            • C:\Users\Admin\AppData\Local\Temp\193997\Restructuring.pif
              C:\Users\Admin\AppData\Local\Temp\193997\Restructuring.pif
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2012
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 476
                3⤵
                • Program crash
                PID:2148
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 1044
                3⤵
                • Program crash
                PID:1620
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4376
            • C:\Windows\System32\schtasks.exe
              C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
              2⤵
                PID:3472
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:432
              • C:\Windows\System32\notepad.exe
                C:\Windows\System32\notepad.exe
                2⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2736
              • C:\Program Files (x86)\KUTO VPN\kutoproxy.exe
                "C:\Program Files (x86)\KUTO VPN\kutoproxy.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:4012
                • C:\Program Files (x86)\KUTO VPN\wv.exe
                  "C:\Program Files (x86)\KUTO VPN\wv.exe" true
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:532
                  • C:\Windows\system32\notepad.exe
                    notepad C:\Users\Admin\AppData\Local\._kte_\Readme.txt
                    4⤵
                    • Suspicious use of FindShellTrayWindow
                    PID:4948
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3696 -ip 3696
              1⤵
                PID:1568
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2012 -ip 2012
                1⤵
                  PID:1356
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2012 -ip 2012
                  1⤵
                    PID:868
                  • C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
                    "C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
                    1⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2700

                  Network

                  MITRE ATT&CK Matrix ATT&CK v13

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  System Services

                  1
                  T1569

                  Service Execution

                  1
                  T1569.002

                  Persistence

                  Create or Modify System Process

                  2
                  T1543

                  Windows Service

                  2
                  T1543.003

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Privilege Escalation

                  Create or Modify System Process

                  2
                  T1543

                  Windows Service

                  2
                  T1543.003

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Defense Evasion

                  Modify Registry

                  5
                  T1112

                  Impair Defenses

                  4
                  T1562

                  Disable or Modify Tools

                  2
                  T1562.001

                  Safe Mode Boot

                  1
                  T1562.009

                  Virtualization/Sandbox Evasion

                  1
                  T1497

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  4
                  T1552

                  Credentials In Files

                  4
                  T1552.001

                  Discovery

                  Query Registry

                  6
                  T1012

                  Virtualization/Sandbox Evasion

                  1
                  T1497

                  System Information Discovery

                  5
                  T1082

                  Process Discovery

                  1
                  T1057

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Data from Local System

                  3
                  T1005

                  Exfiltration

                  Command and Control

                  Web Service

                  1
                  T1102

                  Impact

                  Service Stop

                  1
                  T1489

                  Resource Development

                  Reconnaissance

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\KUTO VPN\Uninstall\IRIMG2.JPG
                    Filesize

                    20KB

                    MD5

                    8da00a281dd2d7b7861e785eb5f6086e

                    SHA1

                    326145a4c6ecf80fdc3b95ff70cf5772820461a5

                    SHA256

                    52922ab69824570d12d004eb9281cf926f4d30dca53ae05aac52611f36db12a2

                    SHA512

                    a0da4bf4a81ff5e4998be2a204e9357ac26eed339e1311a78e8bff105d30e1e5f3a7c88c1f3cc1e610f668dd8cab72acbcd356973b924d46418aaa968515bd0a

                    Download Submit
                  • C:\Program Files (x86)\KUTO VPN\Uninstall\uninstall.xml
                    Filesize

                    7KB

                    MD5

                    07e6a1d35c032b37e267a8be5ea091d1

                    SHA1

                    9806fc7afbb99cca3a5f0459d67bd075ab957a98

                    SHA256

                    7cf37260adac9375c5c8e6ce83b591d04d4cf7305a2e3a711765630785a23396

                    SHA512

                    823078474e8ca7fa29b68becf57c4c542e4a84544432fe092eb12d4aff52d3a3e1929bad503dd4059f8cc87f28e865a3e3155e899bbc29310725b384e74251f2

                    Download Submit
                  • C:\Program Files (x86)\KUTO VPN\kutoproxy.exe
                    Filesize

                    6.7MB

                    MD5

                    bf0755a5506b8ce30d02a9cbac4fe5a3

                    SHA1

                    71c3f5409593ca2cc58e0e82619b9a120a6a634b

                    SHA256

                    beab0244ea325d5db3ac91dbb4d083a6ac38dfdc8848f2f8735aa42428530c07

                    SHA512

                    f7a8c22c65248aba548d16da64129c03d3549aa7a4e0f4be1d01fcd6534a5c44ac3bee92668d210c1635c1ed62645770b5087d266e79f9de05b34606a5369c60

                    Download Submit
                  • C:\ProgramData\mozglue.dll
                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    Download Submit
                  • C:\Users\Admin\AppData\Local\._kte_\.aa4
                    Filesize

                    208B

                    MD5

                    ab942de0f8032dd22ad7be65b048c901

                    SHA1

                    d4e39d531b07253f5b4c96931c9fc41a19615498

                    SHA256

                    4c97f35b6a8ddf4a0b0789ce2e6a07ddd31688fdbe9dc4e8bcb9fd3352f27a4e

                    SHA512

                    847021a67f5a051a2e801735397f76b06098c493a45ed844b772ae5466392c2572016eb1e7827b8bf647ff7f3f74628c2cd5499860b76e8753b95cfd02b8cda6

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    Filesize

                    3KB

                    MD5

                    fee026663fcb662152188784794028ee

                    SHA1

                    3c02a26a9cb16648fad85c6477b68ced3cb0cb45

                    SHA256

                    dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

                    SHA512

                    7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                    Filesize

                    2KB

                    MD5

                    968cb9309758126772781b83adb8a28f

                    SHA1

                    8da30e71accf186b2ba11da1797cf67f8f78b47c

                    SHA256

                    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                    SHA512

                    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KDOTUZKP\1[1]
                    Filesize

                    10KB

                    MD5

                    b2584cbd46067f6e7fd1ba8872d9c2d0

                    SHA1

                    aa90c04e9d9a7cfd4e066fb6043f99ae782b0f08

                    SHA256

                    21cfa730d3cf7210c2a2ac6a79933f1faccf0c98b72aff8f6b3dd374fead05f4

                    SHA512

                    8f388b3c4a58340d6e272107fd603d5563a84c0297e5ece921257d673f7af1ca3483457047bb1c437737a4907a6e3964784665a20b0e578a5d2d6022b68341bc

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    18KB

                    MD5

                    e89bfdd2ffa09254e216c0b5f837565d

                    SHA1

                    f5a56c0b1a0c191c469fdfe0d6ba8aa7361e94d5

                    SHA256

                    fc3de7460122f983bbcdc892ff5e728b25c64ea0bb7c4384c4f2bd7f16ab57dd

                    SHA512

                    dc3c14e760ff27eb64e7cf16f77b7c6a3706348bc40327cb4921ed6b608ca8d38b596d37c767155134dce6d24338e426c9fe38c4b1903b1584532452db060612

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    18KB

                    MD5

                    45bfc23b61700d3781df484256f935f8

                    SHA1

                    6f59c0cab3af390f9b48e15071a42cb7ce8c3001

                    SHA256

                    b00e5dd19067b6d8d62ef87bf6a63d3bfe89b2b1ada1e0e697be60bffa2b105f

                    SHA512

                    32969ec06d094a4a36a315adb20eff65e67f3db1367d36d08959a15a1299c562e264dec64c8d811d41fbd65a24cecc588079bc0a44902194edd0224b5ca0aab5

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    1KB

                    MD5

                    d95b08252ed624f6d91b46523f110f29

                    SHA1

                    17577997bc1fb5d3fbe59be84013165534415dc3

                    SHA256

                    342ce7c39bf9992d31d4b61ef138b2b084c96c74736ed00bb19aae49be16ca02

                    SHA512

                    0c4288176d56f4ee6d8f08f568fba07ad859f50a395c39d2afd3baf55d3d29ca065a1ce305d1bd790477c35977c0ffa230543e805622f80a77bcee71b24eb257

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\1062310550.exe
                    Filesize

                    5.4MB

                    MD5

                    41ab08c1955fce44bfd0c76a64d1945a

                    SHA1

                    2b9cb05f4de5d98c541d15175d7f0199cbdd0eea

                    SHA256

                    dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493

                    SHA512

                    38834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\1574813051.exe
                    Filesize

                    10KB

                    MD5

                    f0f58ddeeec3c66f0c47e69785560458

                    SHA1

                    de8fde23c14a98e320bff0b677ba0c0e9f632137

                    SHA256

                    5656ef015afcd41a93981a7e809d79f1ed69a08e9ae2491cf731176f23532565

                    SHA512

                    a81acdc27f6c2f89e279665a53df3e5330900937f2943d9264c49b2265a2d563443df5ed130e07181ec7c76376505bedd3ca99b2ea4191669a5fee43a7e995fe

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\193997\Restructuring.pif
                    Filesize

                    872KB

                    MD5

                    c56b5f0201a3b3de53e561fe76912bfd

                    SHA1

                    2a4062e10a5de813f5688221dbeb3f3ff33eb417

                    SHA256

                    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                    SHA512

                    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\193997\y
                    Filesize

                    662KB

                    MD5

                    d6a0473754ad77650d88eaa94cf4bcf0

                    SHA1

                    d2123bf8b796fe6f76e570641037d9420b3f3c78

                    SHA256

                    355d2dc53492ea6ba26263dd8a2f7544ae3a36c17f64cccb6ad84007bebafbb7

                    SHA512

                    14d844255fb657a039d4f94ddcc58acc79d44fdc58882ace49a453c537db86ceeef9a10640d83ff20af2caa0e880de3e77b7afbf2af79291873c0f81db72d3bc

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\2823715327.exe
                    Filesize

                    10KB

                    MD5

                    83ea65863e6a835bcf1feda2987737ee

                    SHA1

                    96560e2d97ce8066b72bd456a0bf060245d28ad6

                    SHA256

                    ab5736fc570a6670674e894da46d87f67ea4622969a2abc9319c4151d910e4aa

                    SHA512

                    12cc826476208c83a1d5bafc24c12ab6a2239b4d4b4b06117780bcdb4f0cb6799baf57bcc616c5c03111f557d2ce7da9d2ef20871133fa384fb8ce9ca0b6e7cd

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\968416102.exe
                    Filesize

                    10KB

                    MD5

                    4fe8dc617311f7b6a4b8ebe0b1e24090

                    SHA1

                    2bd9341f17c8c0c62e56e1863b1d2f9c43cb30e5

                    SHA256

                    5016e413b0c563efc920165e7235c9f2706808877668bd297b41435acc7aade4

                    SHA512

                    910a12fbaffd45b0f797a95c6678a32c4a27adbb7d1474f183f8863d310d31fbba17d5d747da87ac4a30dd7cb22c67a4d1c25b302ef0c3f6954d91a459c692db

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Ak
                    Filesize

                    63KB

                    MD5

                    2078e604090ab3f34e7254584f5b5e18

                    SHA1

                    6c6923837538fe0516a7395fd114c6000da29fdb

                    SHA256

                    9b129a2e4cef84ec4f1101524cdec497f7daeed3fda8cac227803772ebb80ca7

                    SHA512

                    af16f5679fc77dfd32c2bc2bfcaf80f56d633a3cb47941565f35ca84c5b385eeebd4caf8a703860a2e3b1a55a808a576a85ed0c5a6595ffa7d2fb0435dbee08f

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Autumn
                    Filesize

                    62KB

                    MD5

                    452ec03a6dc9758ff5c0d17f9e55572a

                    SHA1

                    194df13d1dd92f3c986bb1b196eebf6e25900412

                    SHA256

                    bd9b030da3887b0cb821ef37aab7771d7d048c05835c3eb5ee034cd077a85cd3

                    SHA512

                    f2d6979ac9915991020522d4c7218e431a437d9b06b40c395923fdacc514056f01ca127f4264697f0e49faf88b15df8eb6cca80f69e0983f4af7dcda51a87f6c

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Bs
                    Filesize

                    52KB

                    MD5

                    5383c87dff2feb9b2c8e93c4bed93e34

                    SHA1

                    1487faf6f6e098fd878f4536bb99cf8c628b12a4

                    SHA256

                    963b21a66a6afd24e3c8eab4e9d3fa803caca58f2f1e2cbd2e80451ab2b5bb73

                    SHA512

                    af6219b70b180518f7a5866e95719e23a28394b814239f38250383511b7da1d3712dbd49be75e375f66226192dfc2d46dd905f0733e6bfffe13eeac3ef9f975d

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Entity
                    Filesize

                    75KB

                    MD5

                    116177ea561e297830d84e68e4851a28

                    SHA1

                    80545b33450655d3e5e7c055aace79a31eadd3af

                    SHA256

                    3570fa88359a94df74450f1be19f8fb54e566270f968254ac56b616a424b8446

                    SHA512

                    86e8f3dc6a9b18f4e5a9f2cb1f58baabe782ca264105967987e0eae987f00eeece800ee4f3c126b95ea471c5fd6530d11a87bb9be5a7a2c66ea473b84be6f839

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\66c4c6ec7d961_crypto.exe
                    Filesize

                    2.8MB

                    MD5

                    2bd4145da31909b2dc0d423a626224a7

                    SHA1

                    d9427ef6a480a7bf215c6a8c66f62ed381f46ce3

                    SHA256

                    b3e2fe43f3024cc479415e745cd9826752debe4e8b208e5e5b7cc510723b787d

                    SHA512

                    2e7791925e1d47971ae6bfc3e7615fa3763dd0ddd53bbc01221a925d8e1fb8afaf2bbec8ae2a16a0de1aca0006adf849c4f6a91f525b49a1acd676485a7253d4

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\66ce053d9a01d_BitcoinCore.exe
                    Filesize

                    8.3MB

                    MD5

                    2221a252ea5de03bdbb75168c3ef5a96

                    SHA1

                    b012e1e981a6bd850a0eeb7d4ab5b891f7b4a24e

                    SHA256

                    f2a246644a98ccce35ba182a1348d422a89cbc0cab445b50f6482a16a5edc20e

                    SHA512

                    093ad6ff0aee65c501b6dcb0b313357913e2917080edf3f97c2360fc2c9acfc01db159a158bf87c3d1d5628493b910ebaa4a4ce68695fd3dfb13d5fb1edf4b96

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_new.exe
                    Filesize

                    6.8MB

                    MD5

                    a2ed2bf5957b0b2d33eb778a443d15d0

                    SHA1

                    889b45e70070c3ef4b8cd900fdc43140a5ed8105

                    SHA256

                    866f59529cf4e0a4c2c4bcd2b9d5d18ece73bf99470ea1be81b26f91b586b174

                    SHA512

                    b50b7416bc75324866407e08fd9bb29b0abed501e0720bb77721ce4922d7512221f93becc9cd37efd73b4bf0984d4db5a4da13e896f988256333d972e22ffba8

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\PctOccurred.exe
                    Filesize

                    1.3MB

                    MD5

                    31f04226973fdade2e7232918f11e5da

                    SHA1

                    ff19422e7095cb81c10f6e067d483429e25937df

                    SHA256

                    007c6dfe4466894d678c06e6b30df77225450225ddd8e904e731cab32e82c512

                    SHA512

                    42198fc375993a09da3c8a2766ee6831cf52ff8cd60b3eb4256a361afa6963f64a0aff49adb87c3b22950e03c8ef58a94655959771f8d2d5b754012706220f66

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\Wpm2.exe
                    Filesize

                    265KB

                    MD5

                    25c75c74ec87ede8338e514ed520126d

                    SHA1

                    e3b7901e7e8e7a1f367e57daaa0bb84caafe8881

                    SHA256

                    e88b9925c5243daf42c9779adbeadb405542eac22a0444ad0c51ff6c05f1a226

                    SHA512

                    765855f69012bf6e32d7475453d2233415898f5c58ca160c6d2e9debe7afd66ae9f8ef3b71baf5dcc9af30af4c4d60425dc73bd37011c6841e2c251cefc02ceb

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
                    Filesize

                    19KB

                    MD5

                    1318fbc69b729539376cb6c9ac3cee4c

                    SHA1

                    753090b4ffaa151317517e8925712dd02908fe9e

                    SHA256

                    e972fb08a4dcde8d09372f78fe67ba283618288432cdb7d33015fc80613cb408

                    SHA512

                    7a72a77890aa74ea272473018a683f1b6961e5e765eb90e5be0bb397f04e58b09ab47cfb6095c2fea91f4e0d39bd65e21fee54a0eade36378878b7880bcb9d22

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\dmshell.exe
                    Filesize

                    7KB

                    MD5

                    a62abdeb777a8c23ca724e7a2af2dbaa

                    SHA1

                    8b55695b49cb6662d9e75d91a4c1dc790660343b

                    SHA256

                    84bde93f884b8308546980eb551da6d2b8bc8d4b8f163469a39ccfd2f9374049

                    SHA512

                    ac04947446c4cb81bb61d9326d17249bca144b8af1ecdf1ac85b960c603e333b67ab08791e0501aee08939f54e517e6574895b1e49a588011008f8f060731169

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                    Filesize

                    12.0MB

                    MD5

                    b7796f62789b21cc93452ed1b107f1f5

                    SHA1

                    461f2de0f5168c8083d514c29611d3fbf9e3d646

                    SHA256

                    fb271ea3bab8547869fec815396c389ace130cc6d8942d7098b9a6a9a3826a8f

                    SHA512

                    2dc33fc12c805cc05309717ab1377114cf746ae17a86710eb7a038ebe10d16c9765977e889363c7b2bd997bdc313ac4d9dc186a018e91e11c5139b63a8576308

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\javaw.exe
                    Filesize

                    6.0MB

                    MD5

                    d0aafd0bb1f33d521481596c47d8e2a7

                    SHA1

                    de84aad41a01735aee9266c610902ed3e297a8e9

                    SHA256

                    56f01205438d04d00d25549261f146bb33c9ddee8ede9980b433c61051a2a3d2

                    SHA512

                    88e7ef76e24edee65c3cbd106bd9feb27f4913a08bb9cb67b9f9a937c24edab284daee242927eb577b100c4e120e39a2f0922d47f7a8d12b068b16a69f66b84e

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\latest.exe
                    Filesize

                    9.7MB

                    MD5

                    998ad119051bbbbc400a7f87970c101b

                    SHA1

                    3ebd4835c25922d85ac6102c99a8a71b9dd9a67a

                    SHA256

                    f8a3157af030b21a6b211fdf89b08c468b9e340e0a1f05238bd99f8e51a17f2f

                    SHA512

                    ac85858592bd2b7436413845e659c8721b584d372bfbbefe369dec0ba277f392db34c5e014cb0c7a2c006a168e4580a06189f7670b8fbd955f1def47fded9de0

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
                    Filesize

                    95KB

                    MD5

                    f9d5d8b4fbeffbffead34ea87da2d1c9

                    SHA1

                    d8db7444944e63a485cbb2f1acc86c01cc40150b

                    SHA256

                    dc69f2b947673cdb4775a4ae081e009f6a713a35000e43e5fa86d5eabe99a7e4

                    SHA512

                    38ddd39867a0d437e847c29469f3599c7c2f0ca61efebbfbae6d3898e130dd33e57ee2c036847ac0f9e3b1a3fd463d409f7ed3b3f6edeb8202cd10f705079723

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
                    Filesize

                    9KB

                    MD5

                    8d8e6c7952a9dc7c0c73911c4dbc5518

                    SHA1

                    9098da03b33b2c822065b49d5220359c275d5e94

                    SHA256

                    feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

                    SHA512

                    91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
                    Filesize

                    20KB

                    MD5

                    1382c0a4a9e0a9a2c942458652a4a0e4

                    SHA1

                    55ed8ebd6281c280c3e77763773d789a6057e743

                    SHA256

                    4cb590dfafb7653379326e840d9b904a3cf05451999c4f9eb66c6e7116b68875

                    SHA512

                    cc1ba7e779536b57409c974f16b0d8706fdf8749fb9eca36716d4e84d4f420a650b6476ac08570e684ad1e492da3bbacc15a4e5be4b94a1b708909d683da0b7e

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\stealc_valenciga.exe
                    Filesize

                    187KB

                    MD5

                    cb24cc9c184d8416a66b78d9af3c06a2

                    SHA1

                    806e4c0fc582460e8db91587b39003988b8ff9f5

                    SHA256

                    53ebff6421eac84a4337bdf9f33d409ca84b5229ac9e001cd95b6878d8bdbeb6

                    SHA512

                    3f4feb4bbe98e17c74253c0fec6b8398075aecc4807a642d999effafc10043b3bcf79b1f7d43a33917f709e78349206f0b6f1530a46b7f833e815db13aeeb33a

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\t.exe
                    Filesize

                    79KB

                    MD5

                    e2e3268f813a0c5128ff8347cbaa58c8

                    SHA1

                    4952cbfbdec300c048808d79ee431972b8a7ba84

                    SHA256

                    d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

                    SHA512

                    cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
                    Filesize

                    88KB

                    MD5

                    ababca6d12d96e8dd2f1d7114b406fae

                    SHA1

                    dcd9798e83ec688aacb3de8911492a232cb41a32

                    SHA256

                    a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

                    SHA512

                    b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
                    Filesize

                    6KB

                    MD5

                    cfb7fbf1d4b077a0e74ed6e9aab650a8

                    SHA1

                    a91cfbcc9e67e8f4891dde04e7d003fc63b7d977

                    SHA256

                    d93add71a451ec7c04c99185ae669e59fb866eb38f463e9425044981ed1bcae0

                    SHA512

                    b174d0fed1c605decc4e32079a76fbb324088b710ce1a3fe427a9a30c7bdcd6ac1ad223970cdc64061705f9a268afa96463ee73536b46991981d041517b77785

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Files\wmqsxncpntfzjhh.sys
                    Filesize

                    624KB

                    MD5

                    5eb2f44651d3e4b90664bab3070409ff

                    SHA1

                    6d71d69243bc2495a107ca45d5989a6fc1545570

                    SHA256

                    32726fa33be861472d0b26286073b49500e3fd3bd1395f63bc114746a9195efb

                    SHA512

                    55eef39a6845567c8bf64d04e5414537837ae7937229849f7bb1f28e4ddc22428aa1d56af177606c1ea31dd8799ff96d1dfa0f80cb266afe31ca1b43fe9313b5

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Hist
                    Filesize

                    486B

                    MD5

                    01f1ebfab9f7716fd124ef8edd32a90f

                    SHA1

                    85a045dab05d4c1360f97f3e3d32679e844766c8

                    SHA256

                    379fdc3da78974a0332ec7b4c0704d500869ab83afadeba852cd2b510aec4f80

                    SHA512

                    3f1300fc81667a73026fe79f4984278e65d87ba1d2ccb1833c50319f5cf5d44a6865bd9ad8cd12586e0500f99c670174b8e544e440d7d5e3be27acf2e068e8b1

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Keyboards
                    Filesize

                    2KB

                    MD5

                    648848687fe144ab2925ff056f85e839

                    SHA1

                    ad8601e28076e553bdce4b49e5585d193ce9f26f

                    SHA256

                    68340ba1f2afcb31904ad77653b22b19601a86d2031b39ce320611fc26a30462

                    SHA512

                    ff5b5d86710242944a6c5a6ba6ec29e57e561ce156022243f0d6028a8ec2eba0d6f13dcb2ab007a5c38c5f69fb8bb5816ddcead72588626a6626bb1336f77b27

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Medicines
                    Filesize

                    63KB

                    MD5

                    394e00f0b18a19021b82919b0953a251

                    SHA1

                    3dfd4dbf28f4aa4c08c74b70662c01c950bf3ad9

                    SHA256

                    9d32778c46127d2af6991663c47dac68ac3424181063b44e82e3b82af73369a1

                    SHA512

                    b5e6c76075e19bdcbcd0ae4ccf9acb37154d84dbe1a17b9c2e40ce9e4d5b194774d608d812ae54f8f6331e255d3f1820a526eb8ad80b174babe6a39a2002f5f5

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Powell
                    Filesize

                    7KB

                    MD5

                    4ae2c64145fe81c75f62a1ac65904a58

                    SHA1

                    fd70229a1fcd534498c7179ca3a02abb6523a277

                    SHA256

                    315e74622a85b4dce78188b734154a595ff1a1a8cb191b2d92a95be1c0bdbc37

                    SHA512

                    bf81502fe99ba78b414577df49c86c98c8154f409c41ee536dcf29fe979a859e40561b3d97245ee76d9ccfc908f9a623372c77ec05b8a8e665777aae01a475a0

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Remained
                    Filesize

                    94KB

                    MD5

                    7eb0c07b15f6891636b5b18e6c8782eb

                    SHA1

                    41f132b6db4d2b5253e91d84e927995a00e96976

                    SHA256

                    a378de033ee73a1881a1d65e6a49686d087614d46286360698b639b62c097e84

                    SHA512

                    688e2327e9afb9561fb7b4e932efdd22ce56e0efdfcba80eb058cbabb6595c93216590290281a3ae34b45f623d2dd1325edfd5375f3caac129ae2d7b4777f754

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Scott
                    Filesize

                    96KB

                    MD5

                    7e600368be6cc5c03b1bf613a36885d1

                    SHA1

                    c0cc74598ef38940fc48ccb01fa27e9b27e80e62

                    SHA256

                    0b4bfde6485d29cba34de2cd28191b5fc21dfcd3aca109f68599e19a609cbe44

                    SHA512

                    b6b66babcadd81d4e4e5b62e778ea79acc2a48b9c0ab9bf81a7ec61f9f9ccf394bc16982b80f07b113645a24f209d68cddc733266d0f0e3d722567f120d425cc

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Statistical
                    Filesize

                    84KB

                    MD5

                    5822d1bc4305d9f19939768fdfbf4d31

                    SHA1

                    30949a77d5c66825c5255566a2c074142d114f04

                    SHA256

                    15ae29d30cebd36f8b499edd660444cb16e880ec5469e14c608f76a59f15faa7

                    SHA512

                    b474b021d0e8b405ea64bda4afef1c191834236c759a5e52fb8813fdfca14536942c9600624cfd1d675fd9e119579795c86dddabbf909eea21a585236b2489c7

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\Stewart
                    Filesize

                    872KB

                    MD5

                    121c1acb3a03bd31c6ae1e13db4469c8

                    SHA1

                    e1d7be7f98ad139a0a0db4ef4014af420915ff2e

                    SHA256

                    1ecdd3d64dc38399a17c68412ecba9b9c1a31b9911605f22a362b4f0a1c7f21d

                    SHA512

                    898740bb7499b5d889c6b81b780cf76ace4ded1c50e26c6b9149fc9143724789328a937d0d6496e5838af5964813ff4d9edb0f8f696d8054ff5e03613f351583

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\While
                    Filesize

                    71KB

                    MD5

                    8d0730549c077df4608642def3a3797b

                    SHA1

                    70ff0d8c5a80918766cee21a944ffcf1a589c35a

                    SHA256

                    34c4628b7b7f34ba02bf64d730eb7e957f943dc404f2f36a543b8d406b78775c

                    SHA512

                    ddb2ebebc032ace041df5ff83e2a4b68086ec4f89bd8a30f36cfe6fb7909ac895c00730c47a267bf5ba31ecf5863e4108c869a9d18dab538f4c18a5ee3a3d20f

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bbnq0xei.sse.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
                    Filesize

                    5KB

                    MD5

                    5dc2d6c2cdb0bd1447dc42810344fa1e

                    SHA1

                    72a320ba46fc5116cef786fb2cd03aea2e65e4f9

                    SHA256

                    eca7064b09fa0b62582a795965b3d980e299293a4d5052d7925b40002ea9000b

                    SHA512

                    b114ebe7cb67b9f5413023613dbc0d2f0d63d8404b7de719f3d042d5250257fc6f874daca7c80020bcfb0bc51534481470b1038424279508f338d6aaa400f217

                    Download Submit
                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                    Filesize

                    1.3MB

                    MD5

                    53817a366d16165e18b0babc60239ff5

                    SHA1

                    05aec27173f52d698b91bce48a10c159e032f103

                    SHA256

                    07365770631759420e679342ea3cc3b720286b5bfb5289f54396b432eea40580

                    SHA512

                    50e67e3bfe6f3132153fcd20667a25b15c0b8f4e1e45b0ebe38d698e8524591e405d5407947ea5e0cef21a530f39944f9a7404429bba95771ccbffd9cf0ee3a1

                    Download Submit
                  • memory/532-725-0x00007FF7B7F50000-0x00007FF7B8391000-memory.dmp
                    Filesize

                    4.3MB

                    Download
                  • memory/532-735-0x00007FF7B7F50000-0x00007FF7B8391000-memory.dmp
                    Filesize

                    4.3MB

                    Download
                  • memory/532-793-0x00007FF7B7F50000-0x00007FF7B8391000-memory.dmp
                    Filesize

                    4.3MB

                    Download
                  • memory/2012-240-0x00000000007A0000-0x00000000007FB000-memory.dmp
                    Filesize

                    364KB

                    Download
                  • memory/2012-238-0x00000000007A0000-0x00000000007FB000-memory.dmp
                    Filesize

                    364KB

                    Download
                  • memory/2012-209-0x00000000007A0000-0x00000000007FB000-memory.dmp
                    Filesize

                    364KB

                    Download
                  • memory/2212-519-0x0000000000B90000-0x0000000000DD3000-memory.dmp
                    Filesize

                    2.3MB

                    Download
                  • memory/2212-704-0x0000000000B90000-0x0000000000DD3000-memory.dmp
                    Filesize

                    2.3MB

                    Download
                  • memory/2404-293-0x0000000007830000-0x0000000007844000-memory.dmp
                    Filesize

                    80KB

                    Download
                  • memory/2404-245-0x0000000005A70000-0x0000000005AD6000-memory.dmp
                    Filesize

                    408KB

                    Download
                  • memory/2404-242-0x0000000004CE0000-0x0000000004D16000-memory.dmp
                    Filesize

                    216KB

                    Download
                  • memory/2404-243-0x00000000053D0000-0x00000000059F8000-memory.dmp
                    Filesize

                    6.2MB

                    Download
                  • memory/2404-292-0x0000000007820000-0x000000000782E000-memory.dmp
                    Filesize

                    56KB

                    Download
                  • memory/2404-244-0x0000000005220000-0x0000000005242000-memory.dmp
                    Filesize

                    136KB

                    Download
                  • memory/2404-294-0x0000000007920000-0x000000000793A000-memory.dmp
                    Filesize

                    104KB

                    Download
                  • memory/2404-295-0x0000000007900000-0x0000000007908000-memory.dmp
                    Filesize

                    32KB

                    Download
                  • memory/2404-283-0x0000000007860000-0x00000000078F6000-memory.dmp
                    Filesize

                    600KB

                    Download
                  • memory/2404-282-0x0000000007650000-0x000000000765A000-memory.dmp
                    Filesize

                    40KB

                    Download
                  • memory/2404-281-0x00000000075E0000-0x00000000075FA000-memory.dmp
                    Filesize

                    104KB

                    Download
                  • memory/2404-285-0x0000000007800000-0x0000000007811000-memory.dmp
                    Filesize

                    68KB

                    Download
                  • memory/2404-246-0x0000000005C50000-0x0000000005CB6000-memory.dmp
                    Filesize

                    408KB

                    Download
                  • memory/2404-256-0x0000000005CC0000-0x0000000006014000-memory.dmp
                    Filesize

                    3.3MB

                    Download
                  • memory/2404-280-0x0000000007C90000-0x000000000830A000-memory.dmp
                    Filesize

                    6.5MB

                    Download
                  • memory/2404-279-0x00000000074C0000-0x0000000007563000-memory.dmp
                    Filesize

                    652KB

                    Download
                  • memory/2404-265-0x0000000006290000-0x00000000062AE000-memory.dmp
                    Filesize

                    120KB

                    Download
                  • memory/2404-266-0x00000000062C0000-0x000000000630C000-memory.dmp
                    Filesize

                    304KB

                    Download
                  • memory/2404-278-0x00000000074A0000-0x00000000074BE000-memory.dmp
                    Filesize

                    120KB

                    Download
                  • memory/2404-268-0x000000006FBA0000-0x000000006FBEC000-memory.dmp
                    Filesize

                    304KB

                    Download
                  • memory/2404-267-0x0000000007260000-0x0000000007292000-memory.dmp
                    Filesize

                    200KB

                    Download
                  • memory/2700-376-0x00007FF6C8C00000-0x00007FF6C9176000-memory.dmp
                    Filesize

                    5.5MB

                    Download
                  • memory/2736-413-0x00007FF7BACB0000-0x00007FF7BB49F000-memory.dmp
                    Filesize

                    7.9MB

                    Download
                  • memory/2736-377-0x000001F1A7A30000-0x000001F1A7A50000-memory.dmp
                    Filesize

                    128KB

                    Download
                  • memory/2736-705-0x00007FF7BACB0000-0x00007FF7BB49F000-memory.dmp
                    Filesize

                    7.9MB

                    Download
                  • memory/2736-730-0x00007FF7BACB0000-0x00007FF7BB49F000-memory.dmp
                    Filesize

                    7.9MB

                    Download
                  • memory/2736-503-0x00007FF7BACB0000-0x00007FF7BB49F000-memory.dmp
                    Filesize

                    7.9MB

                    Download
                  • memory/2768-414-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                    Filesize

                    972KB

                    Download
                  • memory/2768-403-0x0000000000400000-0x0000000000643000-memory.dmp
                    Filesize

                    2.3MB

                    Download
                  • memory/2768-404-0x0000000000400000-0x0000000000643000-memory.dmp
                    Filesize

                    2.3MB

                    Download
                  • memory/2908-226-0x0000000140000000-0x0000000140004248-memory.dmp
                    Filesize

                    16KB

                    Download
                  • memory/2908-286-0x0000000140000000-0x0000000140004248-memory.dmp
                    Filesize

                    16KB

                    Download
                  • memory/2924-349-0x00007FF778A40000-0x00007FF778FB6000-memory.dmp
                    Filesize

                    5.5MB

                    Download
                  • memory/3168-531-0x00007FFB44070000-0x00007FFB456E7000-memory.dmp
                    Filesize

                    22.5MB

                    Download
                  • memory/3188-709-0x00007FFB65D50000-0x00007FFB65F45000-memory.dmp
                    Filesize

                    2.0MB

                    Download
                  • memory/3904-402-0x0000000005440000-0x0000000005462000-memory.dmp
                    Filesize

                    136KB

                    Download
                  • memory/3904-401-0x00000000056B0000-0x000000000583C000-memory.dmp
                    Filesize

                    1.5MB

                    Download
                  • memory/3904-400-0x0000000000A90000-0x0000000000D60000-memory.dmp
                    Filesize

                    2.8MB

                    Download
                  • memory/4012-710-0x0000000000C80000-0x0000000002192000-memory.dmp
                    Filesize

                    21.1MB

                    Download
                  • memory/4012-732-0x0000000000C80000-0x0000000002192000-memory.dmp
                    Filesize

                    21.1MB

                    Download
                  • memory/4012-733-0x0000000000C80000-0x0000000002192000-memory.dmp
                    Filesize

                    21.1MB

                    Download
                  • memory/4056-327-0x00000000078D0000-0x00000000078E4000-memory.dmp
                    Filesize

                    80KB

                    Download
                  • memory/4056-317-0x000000006FBA0000-0x000000006FBEC000-memory.dmp
                    Filesize

                    304KB

                    Download
                  • memory/4364-0-0x0000000074CCE000-0x0000000074CCF000-memory.dmp
                    Filesize

                    4KB

                    Download
                  • memory/4364-3-0x0000000074CC0000-0x0000000075470000-memory.dmp
                    Filesize

                    7.7MB

                    Download
                  • memory/4364-4-0x0000000074CCE000-0x0000000074CCF000-memory.dmp
                    Filesize

                    4KB

                    Download
                  • memory/4364-2-0x00000000051F0000-0x000000000528C000-memory.dmp
                    Filesize

                    624KB

                    Download
                  • memory/4364-1-0x00000000007E0000-0x00000000007E8000-memory.dmp
                    Filesize

                    32KB

                    Download
                  • memory/4364-5-0x0000000074CC0000-0x0000000075470000-memory.dmp
                    Filesize

                    7.7MB

                    Download
                  • memory/4376-332-0x00000256CD110000-0x00000256CD132000-memory.dmp
                    Filesize

                    136KB

                    Download
                  • memory/4564-670-0x0000000140000000-0x0000000140278000-memory.dmp
                    Filesize

                    2.5MB

                    Download
                  • memory/4564-672-0x0000000140000000-0x0000000140278000-memory.dmp
                    Filesize

                    2.5MB

                    Download
                  • memory/4564-671-0x0000000140000000-0x0000000140278000-memory.dmp
                    Filesize

                    2.5MB

                    Download
                  • memory/4564-663-0x0000000140000000-0x0000000140278000-memory.dmp
                    Filesize

                    2.5MB

                    Download
                  • memory/4564-669-0x0000000140000000-0x0000000140278000-memory.dmp
                    Filesize

                    2.5MB

                    Download
                  • memory/4656-93-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-463-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-388-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-91-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-90-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-357-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-649-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-708-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-94-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-198-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-92-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-210-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4656-284-0x0000000140000000-0x000000014118D000-memory.dmp
                    Filesize

                    17.6MB

                    Download
                  • memory/4968-571-0x0000000000400000-0x00000000007CA000-memory.dmp
                    Filesize

                    3.8MB

                    Download
                  • memory/4968-449-0x0000000000400000-0x00000000007CA000-memory.dmp
                    Filesize

                    3.8MB

                    Download
                  • memory/4968-637-0x0000000000400000-0x00000000007CA000-memory.dmp
                    Filesize

                    3.8MB

                    Download
                  • memory/4968-645-0x0000000000400000-0x00000000007CA000-memory.dmp
                    Filesize

                    3.8MB

                    Download