Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 16:44

General

  • Target

    file.exe

  • Size

    1.8MB

  • MD5

    3c068f1e2d2b3a52f24a641a127e2034

  • SHA1

    9c9e1f4f52b82067c06811ade34903073afa8f7d

  • SHA256

    6b145fe49cdcb76b2f6d3aa8109654eca5575a91ba6600adac8854671044f45a

  • SHA512

    e0478644e127db7f082eb2e1e610134d7f3084bb1028634bef55bdbd6a46eaf19035458b82500989b8c4c50cd705bd915c54c2d53d1090ce5a1e3b226a2ffaa4

  • SSDEEP

    49152:IDbL46qozidCP2wl/fxd4nV9CcIOizG77FnNZJqJ:I/M6Jids2wjdGf3iq77FnzJq

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

bundle

C2

185.215.113.67:15206

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3932
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:2864
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5068
            • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
              "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3696
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:432
                • C:\Users\Admin\AppData\Roaming\GE0iK7c4Rc.exe
                  "C:\Users\Admin\AppData\Roaming\GE0iK7c4Rc.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4080
                • C:\Users\Admin\AppData\Roaming\AdTxpR8EGb.exe
                  "C:\Users\Admin\AppData\Roaming\AdTxpR8EGb.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4372
            • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
              "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4104
              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2756
            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4456
            • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
              "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2796
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4876
            • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
              "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:856
            • C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
              "C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1816
            • C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe
              "C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4360
              • C:\Windows\SysWOW64\Explorer.exe
                "C:\Windows\SysWOW64\Explorer.exe"
                5⤵
                  PID:3752
                • C:\Windows\SysWOW64\Explorer.exe
                  "C:\Windows\SysWOW64\Explorer.exe"
                  5⤵
                    PID:2776
                  • C:\Windows\SysWOW64\Explorer.exe
                    "C:\Windows\SysWOW64\Explorer.exe"
                    5⤵
                      PID:4500
                    • C:\Windows\SysWOW64\Explorer.exe
                      "C:\Windows\SysWOW64\Explorer.exe"
                      5⤵
                        PID:4416
                      • C:\Windows\SysWOW64\Explorer.exe
                        "C:\Windows\SysWOW64\Explorer.exe"
                        5⤵
                          PID:1724
                        • C:\Windows\SysWOW64\Explorer.exe
                          "C:\Windows\SysWOW64\Explorer.exe"
                          5⤵
                            PID:3508
                          • C:\Windows\SysWOW64\Explorer.exe
                            "C:\Windows\SysWOW64\Explorer.exe"
                            5⤵
                              PID:3156
                            • C:\Windows\SysWOW64\Explorer.exe
                              "C:\Windows\SysWOW64\Explorer.exe"
                              5⤵
                                PID:220
                              • C:\Windows\SysWOW64\Explorer.exe
                                "C:\Windows\SysWOW64\Explorer.exe"
                                5⤵
                                  PID:4080
                                • C:\Windows\SysWOW64\Explorer.exe
                                  "C:\Windows\SysWOW64\Explorer.exe"
                                  5⤵
                                    PID:852
                                  • C:\Windows\SysWOW64\Explorer.exe
                                    "C:\Windows\SysWOW64\Explorer.exe"
                                    5⤵
                                      PID:324
                                    • C:\Windows\SysWOW64\Explorer.exe
                                      "C:\Windows\SysWOW64\Explorer.exe"
                                      5⤵
                                        PID:3000
                                      • C:\Windows\SysWOW64\Explorer.exe
                                        "C:\Windows\SysWOW64\Explorer.exe"
                                        5⤵
                                          PID:3776
                                        • C:\Windows\SysWOW64\Explorer.exe
                                          "C:\Windows\SysWOW64\Explorer.exe"
                                          5⤵
                                            PID:2872
                                          • C:\Windows\SysWOW64\Explorer.exe
                                            "C:\Windows\SysWOW64\Explorer.exe"
                                            5⤵
                                              PID:1904
                                            • C:\Windows\SysWOW64\Explorer.exe
                                              "C:\Windows\SysWOW64\Explorer.exe"
                                              5⤵
                                                PID:1744
                                              • C:\Windows\SysWOW64\Explorer.exe
                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                5⤵
                                                  PID:4688
                                                • C:\Windows\SysWOW64\Explorer.exe
                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                  5⤵
                                                    PID:4756
                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                    5⤵
                                                      PID:1736
                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                      5⤵
                                                        PID:1260
                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                        5⤵
                                                          PID:2096
                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                          5⤵
                                                            PID:2204
                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                            5⤵
                                                              PID:2860
                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                              5⤵
                                                                PID:1780
                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                5⤵
                                                                  PID:4560
                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                  5⤵
                                                                    PID:1404
                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                    5⤵
                                                                      PID:3896
                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                      5⤵
                                                                        PID:1408
                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                        5⤵
                                                                          PID:4648
                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                          5⤵
                                                                            PID:3496
                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                            5⤵
                                                                              PID:4160
                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                              5⤵
                                                                                PID:640
                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                5⤵
                                                                                  PID:4152
                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                  5⤵
                                                                                    PID:988
                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                    5⤵
                                                                                      PID:3840
                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                      5⤵
                                                                                        PID:4488
                                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                                        5⤵
                                                                                          PID:4612
                                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                                          5⤵
                                                                                            PID:2360
                                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                                            5⤵
                                                                                              PID:4480
                                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                                              5⤵
                                                                                                PID:2132
                                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                5⤵
                                                                                                  PID:5080
                                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                  5⤵
                                                                                                    PID:5104
                                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                    5⤵
                                                                                                      PID:1016
                                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                      5⤵
                                                                                                        PID:2068
                                                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                        5⤵
                                                                                                          PID:2464
                                                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                          5⤵
                                                                                                            PID:1048
                                                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                            5⤵
                                                                                                              PID:392
                                                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                              5⤵
                                                                                                                PID:1036
                                                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                5⤵
                                                                                                                  PID:2620
                                                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                  5⤵
                                                                                                                    PID:3208
                                                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                    5⤵
                                                                                                                      PID:3824
                                                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                      5⤵
                                                                                                                        PID:3720
                                                                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                        5⤵
                                                                                                                          PID:5076
                                                                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                          5⤵
                                                                                                                            PID:2000
                                                                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                            5⤵
                                                                                                                              PID:3352
                                                                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                              5⤵
                                                                                                                                PID:2484
                                                                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:3332
                                                                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:1220
                                                                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                    5⤵
                                                                                                                                      PID:1396
                                                                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                      5⤵
                                                                                                                                        PID:4752
                                                                                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:4768
                                                                                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                          5⤵
                                                                                                                                            PID:4284
                                                                                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                            5⤵
                                                                                                                                              PID:4340
                                                                                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:3628
                                                                                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:464
                                                                                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:532
                                                                                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4920
                                                                                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:2948
                                                                                                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:536
                                                                                                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:4788
                                                                                                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:3880
                                                                                                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:3872
                                                                                                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:3940
                                                                                                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:4352
                                                                                                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4520
                                                                                                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:2844
                                                                                                                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:3608
                                                                                                                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:1128
                                                                                                                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:4184
                                                                                                                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:4528
                                                                                                                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1364
                                                                                                                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:4696
                                                                                                                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4616
                                                                                                                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2624
                                                                                                                                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:384
                                                                                                                                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:3664
                                                                                                                                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:2328
                                                                                                                                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:2760
                                                                                                                                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:2396
                                                                                                                                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                      • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                        • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:4748
                                                                                                                                                                                                          • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:3148
                                                                                                                                                                                                            • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:1624
                                                                                                                                                                                                              • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:3316
                                                                                                                                                                                                                • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:368
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                                    "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:1148
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Explorer.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\Explorer.exe"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe' -Force
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:1652
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3772
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2028
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:2504
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1972
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:3580
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                PID:2076
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:2844
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:4572
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                PID:2004

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                              • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                593KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                              • C:\ProgramData\nss3.dll

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                313KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2d647cf43622ed10b6d733bb5f048fc3

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6b9c5f77a9ef064a23e5018178f982570cbc64c6

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                62400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                8e74497aff3b9d2ddb7e7f819dfc69ba

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                1d18154c206083ead2d30995ce2847cbeb6cdbc1

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                416KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                f5d7b79ee6b6da6b50e536030bcc3b59

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                751b555a8eede96d55395290f60adc43b28ba5e2

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                187KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                7a02aa17200aeac25a375f290a4b4c95

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                7cc94ca64268a9a9451fb6b682be42374afc22fd

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.6MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                4e30c35be46df08098c89f7126f84a62

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                046fafcca22ff95942b5e389274145c13676e910

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                f0a44e2dc77549bbfe6e02d6b66e819ee50df7ce9dcec6276db404266df06590

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                19311e2cf0b057985a55e9cc5f2e9f6fd50ea7c48e6731cb14bb9314b5ae2cc5da5a52219f62e1076523e8ce6dd3f46088101b408dc6728c26454bd145bd895e

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.6MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                7e6a519688246fe1180f35fe0d25d370

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8e8719ac897dfef7305311dc216f570af40709af

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                32a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0faa6e1a78e6bb809eb5a7cdcdf68e17

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                f1ba39e702710365c345ab034bcd1a6d5ec8d4ad

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                9d6966889f6ec503ae2bd99c666b55429d1835e538e1ac15f06c3524241c0c92

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                261cd43b42ccbe7b6b393d454270dd22110c062632707f73bf045f91aee0f09b4387cac8ba7a9275b1ddaa427240606f654f74224fe6fcd38c8ae40b3c4f8ee7

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                30daa686c1f31cc4833bd3d7283d8cdc

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                70f74571fafe1b359cfe9ce739c3752e35d16cf5

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                454KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                37d198ad751d31a71acc9cb28ed0c64e

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8eb519b7a6df66d84c566605da9a0946717a921d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                03b1ed4c105e5f473357dad1df17cf98

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                faf5046ff19eafd3a59dcf85be30496f90b5b6b1

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                3f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.8MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                3c068f1e2d2b3a52f24a641a127e2034

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                9c9e1f4f52b82067c06811ade34903073afa8f7d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                6b145fe49cdcb76b2f6d3aa8109654eca5575a91ba6600adac8854671044f45a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                e0478644e127db7f082eb2e1e610134d7f3084bb1028634bef55bdbd6a46eaf19035458b82500989b8c4c50cd705bd915c54c2d53d1090ce5a1e3b226a2ffaa4

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Tmp9B07.tmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bzzkolgr.xl3.ps1

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                60B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.9MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                b826dd92d78ea2526e465a34324ebeea

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\AdTxpR8EGb.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                30f46f4476cdc27691c7fdad1c255037

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b53415af5d01f8500881c06867a49a5825172e36

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\GE0iK7c4Rc.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                544KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                88367533c12315805c059e688e7cdfe9

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                64a107adcbac381c10bd9c5271c2087b7aa369ec

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e5be5b7a69a95caa603c03b297545d56

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                02961de04e862be8ffbbb9b6466d058bae1c71ea

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                01fd15992a82d4b7de666dce6dd3331180ab422103c7903fda21fe8535338eba

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                c6ba6f2840abb058876d81b419d3c9914dea2a945a90ae79aa8aa69e8160784bc7041d09e312918ed87c744ed1e214854dd1dcf67cd1e4be4ad0538a36bf55fb

                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                aa60d7755d5a23aaba15d7e1555aa410

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                86161ac3fc74599ef77c21e6d4525d4d2407a330

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                a9d7cb990c537410262c28d8017bd8c2ffbdcc9850133a81bf3cc5100f090e4e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                2e51315c3704d082686ee84b93ea15e623e785280051e6482e172ddd9fa76c0234303132dbdff4174972877c00b004c43289782e1b27417ab863d852c8ae35e2

                                                                                                                                                                                                                              • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                fba612eeb015040e2746998f014d48bb

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6a0b6255fd631eeb7a3e5c8378e71410464608a6

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                efed14402dbda73ef60c40cde4d6095269dd87531980a735f3bb35ad4b598a89

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                3370be0f65c58366664475d361be58253ad5eb8e8924f820c36b7f5a6980f420548152e2962efd4e2f20435b7e1003c896cc00f2df2185947edcb4ca6d34d1db

                                                                                                                                                                                                                              • memory/432-97-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/432-120-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/432-99-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/432-100-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/432-95-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/856-316-0x0000000002920000-0x0000000002E45000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.1MB

                                                                                                                                                                                                                              • memory/856-319-0x0000000002920000-0x0000000002E45000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.1MB

                                                                                                                                                                                                                              • memory/856-317-0x0000000063280000-0x00000000634BE000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.2MB

                                                                                                                                                                                                                              • memory/856-322-0x0000000002920000-0x0000000002E45000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.1MB

                                                                                                                                                                                                                              • memory/856-318-0x000000006E600000-0x000000006E69D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                628KB

                                                                                                                                                                                                                              • memory/856-321-0x0000000002920000-0x0000000002E45000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.1MB

                                                                                                                                                                                                                              • memory/856-323-0x0000000002920000-0x0000000002E45000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.1MB

                                                                                                                                                                                                                              • memory/856-324-0x0000000002920000-0x0000000002E45000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.1MB

                                                                                                                                                                                                                              • memory/1652-1546-0x000001E67C570000-0x000001E67C592000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/1816-364-0x0000000006B70000-0x0000000006BBC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/1816-343-0x0000000000930000-0x0000000000982000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                328KB

                                                                                                                                                                                                                              • memory/2004-1525-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/2004-1523-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/2076-213-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/2076-212-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/2728-42-0x00000000731AE000-0x00000000731AF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                              • memory/2728-43-0x0000000000900000-0x0000000000954000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                336KB

                                                                                                                                                                                                                              • memory/2796-298-0x0000000000400000-0x000000000079D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.6MB

                                                                                                                                                                                                                              • memory/3148-0-0x0000000000710000-0x0000000000BC4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3148-2-0x0000000000711000-0x000000000073F000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                184KB

                                                                                                                                                                                                                              • memory/3148-18-0x0000000000710000-0x0000000000BC4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3148-1-0x0000000077594000-0x0000000077596000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                              • memory/3148-3-0x0000000000710000-0x0000000000BC4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3148-4-0x0000000000710000-0x0000000000BC4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3580-1536-0x000001CB42480000-0x000001CB4253C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                752KB

                                                                                                                                                                                                                              • memory/3696-93-0x00000000008D0000-0x00000000009E2000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/3932-19-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-266-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-209-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-207-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-195-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-204-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-214-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-16-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-262-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-208-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-21-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-148-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-20-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-299-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-147-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/3932-196-0x00000000005E0000-0x0000000000A94000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                              • memory/4080-199-0x00000000094E0000-0x00000000096A2000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.8MB

                                                                                                                                                                                                                              • memory/4080-125-0x0000000000080000-0x000000000010E000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                568KB

                                                                                                                                                                                                                              • memory/4080-200-0x0000000009BE0000-0x000000000A10C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                              • memory/4360-1511-0x0000000008190000-0x00000000081AA000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                              • memory/4360-386-0x00000000009A0000-0x0000000000A18000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                480KB

                                                                                                                                                                                                                              • memory/4372-123-0x0000000000BD0000-0x0000000000C22000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                328KB

                                                                                                                                                                                                                              • memory/4456-300-0x0000000000680000-0x00000000008C3000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                              • memory/4456-229-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                972KB

                                                                                                                                                                                                                              • memory/4456-197-0x0000000000680000-0x00000000008C3000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                              • memory/4456-1170-0x0000000000680000-0x00000000008C3000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                              • memory/4876-296-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                              • memory/4876-297-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                              • memory/4876-293-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                              • memory/4876-403-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                              • memory/4876-1519-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                              • memory/5068-165-0x00000000066B0000-0x0000000006716000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                              • memory/5068-48-0x0000000004E00000-0x0000000004E92000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                584KB

                                                                                                                                                                                                                              • memory/5068-71-0x00000000084E0000-0x00000000085EA000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                              • memory/5068-45-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                328KB

                                                                                                                                                                                                                              • memory/5068-47-0x00000000053B0000-0x0000000005954000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.6MB

                                                                                                                                                                                                                              • memory/5068-72-0x0000000006B60000-0x0000000006B72000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                              • memory/5068-73-0x0000000006BC0000-0x0000000006BFC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                240KB

                                                                                                                                                                                                                              • memory/5068-74-0x0000000006C00000-0x0000000006C4C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/5068-178-0x0000000008F60000-0x0000000008FB0000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                320KB

                                                                                                                                                                                                                              • memory/5068-70-0x0000000006C60000-0x0000000007278000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.1MB

                                                                                                                                                                                                                              • memory/5068-67-0x00000000062D0000-0x00000000062EE000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                              • memory/5068-66-0x0000000005C60000-0x0000000005CD6000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                472KB

                                                                                                                                                                                                                              • memory/5068-49-0x0000000004D90000-0x0000000004D9A000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                40KB

                                                                                                                                                                                                                              • memory/5084-435-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-441-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-431-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-430-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-449-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-447-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-439-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-1509-0x000001B8FCDA0000-0x000001B8FCE44000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                656KB

                                                                                                                                                                                                                              • memory/5084-1510-0x000001B8FCE50000-0x000001B8FCE9C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/5084-437-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-443-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-445-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-433-0x000001B8FCC70000-0x000001B8FCD95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                              • memory/5084-1532-0x000001B8FCEA0000-0x000001B8FCEF4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                336KB

                                                                                                                                                                                                                              • memory/5084-429-0x000001B8FCC70000-0x000001B8FCD9C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                              • memory/5084-428-0x000001B8FCB40000-0x000001B8FCC6A000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                              • memory/5084-427-0x000001B8E2400000-0x000001B8E2560000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.4MB