Overview

overview

10

Static

static

1

Windows.png

windows7-x64

Analysis

  • max time kernel
    299s
  • max time network
    1117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28-09-2024 16:25

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Windows.png

  • Size

    95KB

  • MD5

    25893d2488027e4ae586f15916911d38

  • SHA1

    5f58e2d23b6dce49186b7544e3058dcebfde2ea3

  • SHA256

    67e0f4834202beb3182c33c2c3cb9d01b3d0971023396855c11caf295a30c4ec

  • SHA512

    55fa72168a0cf45b5204096fe5c619874d173b6a01220638d45d33be2bf3590d6b092f9c1d1eec2af7cc31cbb0cb2cb7125400d0912773c3eca20407e3e52ea7

  • SSDEEP

    1536:fbVVTVBuKsommJ/RVa3kpeaQcxJAFm88zV1MYf/Ksb18dN6c3ehUctWYVMSRb4if:fBduhojJy3UlCmrzVCYjZPtUc4TSRbY6

Score
10/10
badrabbitdharmagandcrabbackdoorcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-1488793075-819845221-1497111674-1000\ZCXFU-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ZCXFU The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/e882f1f367654ac | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAADhS/6sUdyyLmeqk8v+a5sOnd0rzNtZsUJjTVcX7hPfpUu+Pd8v80Ic7UHVsQgDWh+ZclxsUNa+pndPz3LkHGmWgPd3h74I5LJous9jddVPErj41cSXZ4H8HqtSp2VbCvd6ptlKZ1RwH+V10JOq5iqS1e8xO1eN4Ltyj44dkt/5PkL5TfWt4lK+I5LGGi/DwU58ycaBLcbItP+qU3aXMO3H0E3oHZ0D9W6gfObD4dUJ9cG7kykzms63FZaWn/Ieix4YDOiOJ8J2PSTK7/g+talwMJ0CvE/ebZYjNK5ZfeX3brPhz/YFkwJQ3n4H8v5HCn78yMt1c7yr7fEvjQ+q9P5zjcajtGSmGUbMbQTbqh0JHBoyoij4hCMJGPYH1J0tyAtkYNLKXSbMdSGzVnRfBppaTDDdDIFOTb+Gb/PLrPI1caNHN7fs4PbjtTJxLa20+Mg18XKlzj7Ea4U++1jDKF56qvDZ5jZ/SZDR7E/7OR5k1PT5PNXS6J19i2zI8yHNu9IOsiKNIQFLVcviTji+XJbAFJmF1Gc4bkAKv7Ge4Vz/f8nSchyx8K5cllan4LeMDYHiO1iVN49WZc1DpFO8g06S41UXzytln2aGg/qsEpnjhl7ljtl2F6T/oqNd/s2W6dMV7m75Hea6N8GFWnxtrasUPXQ4ja9DH6/oBKFhbuIFyQXXhPUnC1oRzxOPqm+elNgqmqI7Wexseg4MCaKfBrjxTyup9SA0IsQrY20WwYalJsDK/2yZqXUwqcLkjv3fE6WlfdpkQWZKSZeF1hXV0wwXfJjiAm7LOznJpwPYHNXJBxwnDaglY7QCT5wz+pLQRCb7JXKWT6O+GFDw2tJfY/nonKklTi5tRii6AXt5+FxosLfuwAfdLu9j8FexWCxEE7Vr2dK4R5qj2crFhqImGpFhNaoNiW3LIkrS2qBis0rG4Y0zTQKJu0i70riE32K3Y54zVb9ixG2tgwVKU5pheXpXzPhTHy6Bp15VxkvdLXOtfIpyPWOHtgWDPR0IxhWCKV9L98lU/Av3DqeBo0MXNvR4M5afCU9GoToT7SxOPNbB13ujopqZEFBbMwPc4wz2CdWh8dX/VKC4Yn94/584opA6TPXDJ5nL122NX5pNk1ik+SPku3y+pA9+pNPIsz9hxNP4IobLRWNv5CoUDkPfwLdLVFjhMWmm5xkqqlK3SWfuJEW2hBpa/ukLgdEGOM0kPD39mo4Idi8bAiXe07HRaq7mcabhAViJA7CfC9j/lj+Rv02MZQgPHlCGZVvDxm4qyEBu1mDKJNsua0urTw8RydT0/7MeLklAHN47z5cGDV287iZ6UgpmGWDRBbUpu2lMnt2uQfBTPDjk0kjtpxHj+jQvTFnN0z67ILPgRsQX+1yAc7y3dMTmdMHJLtLkdoW2BHxuKshxuKtCcM86L8JiSZElVxfPZmmBZCLGaszeqn9e6wW+HgcZqe68U57HEdhI8+Z5A84ftCszQ7o0c1UtU0TqSGV3B34L83vR2xY2zYf1rXQbFYMHW9HEudAJ2V43z41rnDYyPusEUUcwcFoO5fwSU6H1vg1Kue1WXQLBELiPpi6sYnqq7mFLeOmigqGW20+ennMgIgoisuKXtch+KTOSjbo3yFuDSAIoDKUmxfGfh4PGI1cpsvk6bHjvw8UH0XuET4xlto//ZcBvVUtx/zWP+shktc946Acx9dezIl+SpDu4Lg0oZalEH0ooPzDBNl5Ccnvuz/7KV21oxUEXo72wHoPsi+6QY8/US9lKBqsc0RT5lwRfah99z+4OJymAeoFA0NT3FM2YxAxWbvbIWY8RBO+m3/ObTqbct1EIKINQ9wBsGnxx2Qedjozg1rCo+/CyfVUpBlC7qMuGE/2k5zqoPGF+wg/xH7V8L8AHrM4gIGxTgMgN/awBEKtsKGuRAVNjWu32dSm/fihwvIUWTktbpKufo22AH7M2fwflo4K9nJZ4IbJ9/ehQ0xFSfL2rC15+BVCr1ThNa4RKjnY+OENwCsrolruHDzUWGLTux0RD0I5Jl02Kk3QlJcYsU2hREUeHaO+dFltNgIdKt5wfRuu21jKV550tpdbN/TjH3XqUpSPDt8HZUuLHoN6F72TimxQ2TkuNcIU0jPhK2rNCm6DjVcmBueW/h5KIZSoisPiKmIUWZY1cOPKGzg5RCBxkaw879Sz8fxAbLu9fuu2ifU06hSGKV/TUpRchQD1fB9N+/HOopPkrpubLASrlNxLV7sFcscyY= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDr9MzJMpDfAueVs+DJRX7IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSUyDNtLKJf9BbBiVq+MY9R+a3NrHKmdGRiEfRP4ry6vM9LODjDaPvr3tWv+YKTznJt/bAL0J01/eNSzezgKAqoTvFqJ2HPDmx5ShGudnoMloV6iCVyOmvqB9vZrwLrtsyoC8F1fKlXDmT7rN4cOwygU+wTkywb+cfzdw/LWqjqbjWwFvi9DPXKP+ghY2cWKz+6gkLvCeiiYFcEv1EtSM9ANLhxdQDIBf1BEGWyeuMbJ0O1h0/u+RWez0Et3TBCrbrZtdJPEKVLcogLrgbsAnNcG2VuLCZEZKsSbTenISaf0Ihb4k0t1Gacy3SiKIADBDFnYH2qA1whEaNxA== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/e882f1f367654ac

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Deletes NTFS Change Journal 2 TTPs 1 IoCs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Clears Windows event logs 1 TTPs 4 IoCs
    evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (312) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (384) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Downloads MZ/PE file
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Deletes itself 1 IoCs
  • Drops startup file 7 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs
  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Windows.png
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:540
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6939758,0x7fef6939768,0x7fef6939778
      2⤵
        PID:2268
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:2
        2⤵
          PID:2700
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
          2⤵
            PID:2792
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
            2⤵
              PID:2560
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2228 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:1
              2⤵
                PID:3032
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2236 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:1
                2⤵
                  PID:324
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1144 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:2
                  2⤵
                    PID:2152
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1320 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:1
                    2⤵
                      PID:448
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3428 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                      2⤵
                        PID:1196
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3496 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                        2⤵
                          PID:764
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                          2⤵
                            PID:1536
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3892 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:1
                            2⤵
                              PID:2068
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3672 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:1
                              2⤵
                                PID:1748
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                2⤵
                                  PID:2836
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1160 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:1
                                  2⤵
                                    PID:1620
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3768 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                    2⤵
                                      PID:1968
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3848 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:1
                                      2⤵
                                        PID:952
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1604 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                        2⤵
                                          PID:2716
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4268 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                          2⤵
                                            PID:2852
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3768 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                            2⤵
                                              PID:1512
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1232 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                              2⤵
                                                PID:2620
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=684 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                2⤵
                                                  PID:2500
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1048 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                  2⤵
                                                    PID:2336
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2280 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                    2⤵
                                                      PID:832
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3752 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                      2⤵
                                                        PID:2984
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                        2⤵
                                                          PID:268
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2280 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                          2⤵
                                                            PID:1160
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4308 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                            2⤵
                                                              PID:2156
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1072 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                              2⤵
                                                                PID:800
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1548 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                2⤵
                                                                  PID:1584
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2648 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                  2⤵
                                                                    PID:880
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2064 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                    2⤵
                                                                      PID:1972
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2316 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                      2⤵
                                                                        PID:324
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2400 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                        2⤵
                                                                          PID:2460
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3428 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                          2⤵
                                                                            PID:2316
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4308 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                            2⤵
                                                                              PID:1936
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3552 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                              2⤵
                                                                                PID:2860
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2584 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                2⤵
                                                                                  PID:2804
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                  2⤵
                                                                                    PID:1804
                                                                                  • C:\Users\Admin\Downloads\butterflyondesktop.exe
                                                                                    "C:\Users\Admin\Downloads\butterflyondesktop.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2656
                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-JLQEV.tmp\butterflyondesktop.tmp
                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-JLQEV.tmp\butterflyondesktop.tmp" /SL5="$12016E,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1332
                                                                                  • C:\Users\Admin\Downloads\CookieClickerHack.exe
                                                                                    "C:\Users\Admin\Downloads\CookieClickerHack.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2572
                                                                                  • C:\Users\Admin\Downloads\WinNuke.98.exe
                                                                                    "C:\Users\Admin\Downloads\WinNuke.98.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2620
                                                                                  • C:\Users\Admin\Downloads\CoronaVirus.exe
                                                                                    "C:\Users\Admin\Downloads\CoronaVirus.exe"
                                                                                    2⤵
                                                                                    • Deletes itself
                                                                                    • Drops startup file
                                                                                    • Executes dropped EXE
                                                                                    • Adds Run key to start application
                                                                                    • Drops desktop.ini file(s)
                                                                                    • Drops file in System32 directory
                                                                                    • Drops file in Program Files directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2200
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe"
                                                                                      3⤵
                                                                                        PID:1704
                                                                                        • C:\Windows\system32\mode.com
                                                                                          mode con cp select=1251
                                                                                          4⤵
                                                                                            PID:3280
                                                                                          • C:\Windows\system32\vssadmin.exe
                                                                                            vssadmin delete shadows /all /quiet
                                                                                            4⤵
                                                                                            • Interacts with shadow copies
                                                                                            PID:1116
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          "C:\Windows\system32\cmd.exe"
                                                                                          3⤵
                                                                                            PID:13568
                                                                                            • C:\Windows\system32\mode.com
                                                                                              mode con cp select=1251
                                                                                              4⤵
                                                                                                PID:3532
                                                                                              • C:\Windows\system32\vssadmin.exe
                                                                                                vssadmin delete shadows /all /quiet
                                                                                                4⤵
                                                                                                • Interacts with shadow copies
                                                                                                PID:12032
                                                                                            • C:\Windows\System32\mshta.exe
                                                                                              "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                                                              3⤵
                                                                                              • Modifies Internet Explorer settings
                                                                                              PID:3276
                                                                                            • C:\Windows\System32\mshta.exe
                                                                                              "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                                                              3⤵
                                                                                              • Modifies Internet Explorer settings
                                                                                              PID:5632
                                                                                          • C:\Users\Admin\Downloads\CookieClickerHack.exe
                                                                                            "C:\Users\Admin\Downloads\CookieClickerHack.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2808
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2484 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:13808
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3528 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:14264
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:11128
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2400 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:13576
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4252 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:13652
                                                                                          • C:\Users\Admin\Downloads\GandCrab.exe
                                                                                            "C:\Users\Admin\Downloads\GandCrab.exe"
                                                                                            2⤵
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates connected drives
                                                                                            • Sets desktop wallpaper using registry
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Checks processor information in registry
                                                                                            PID:10608
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:13028
                                                                                              • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                vssadmin delete shadows /all /quiet
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Interacts with shadow copies
                                                                                                PID:1624
                                                                                          • C:\Users\Admin\Downloads\GandCrab.exe
                                                                                            "C:\Users\Admin\Downloads\GandCrab.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates connected drives
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Checks processor information in registry
                                                                                            PID:14964
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\Downloads\GandCrab.exe" /f /q
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:11280
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout -c 5
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:13320
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1628 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:13472
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3768 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:13440
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4248 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:11192
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4348 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:4980
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4356 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:4132
                                                                                          • C:\Users\Admin\Downloads\BadRabbit.exe
                                                                                            "C:\Users\Admin\Downloads\BadRabbit.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4824
                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                              C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                                                              3⤵
                                                                                              • Drops file in Windows directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:10184
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /c schtasks /Delete /F /TN rhaegal
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:11632
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /Delete /F /TN rhaegal
                                                                                                  5⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:14316
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3604073031 && exit"
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:14344
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3604073031 && exit"
                                                                                                  5⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:14632
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 16:47:00
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:14660
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 16:47:00
                                                                                                  5⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:5884
                                                                                              • C:\Windows\FE7B.tmp
                                                                                                "C:\Windows\FE7B.tmp" \\.\pipe\{E06FBDD7-71CC-4D5B-8135-64E4104EC6B8}
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5508
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
                                                                                                4⤵
                                                                                                  PID:6680
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil cl Setup
                                                                                                    5⤵
                                                                                                    • Clears Windows event logs
                                                                                                    PID:8284
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil cl System
                                                                                                    5⤵
                                                                                                    • Clears Windows event logs
                                                                                                    PID:5932
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil cl Security
                                                                                                    5⤵
                                                                                                    • Clears Windows event logs
                                                                                                    PID:6028
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil cl Application
                                                                                                    5⤵
                                                                                                    • Clears Windows event logs
                                                                                                    PID:6472
                                                                                                  • C:\Windows\SysWOW64\fsutil.exe
                                                                                                    fsutil usn deletejournal /D C:
                                                                                                    5⤵
                                                                                                    • Deletes NTFS Change Journal
                                                                                                    PID:3464
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  /c schtasks /Delete /F /TN drogon
                                                                                                  4⤵
                                                                                                    PID:6416
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /Delete /F /TN drogon
                                                                                                      5⤵
                                                                                                        PID:8792
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1160 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:12360
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4392 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:12408
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:12328
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4408 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:13856
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4392 --field-trial-handle=1200,i,13013835037956224081,13120829743035177888,131072 /prefetch:8
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:13412
                                                                                                • C:\Users\Admin\Downloads\rickroll.exe
                                                                                                  "C:\Users\Admin\Downloads\rickroll.exe"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:8444
                                                                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:1996
                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                  1⤵
                                                                                                    PID:2140
                                                                                                  • C:\Windows\system32\LogonUI.exe
                                                                                                    "LogonUI.exe" /flags:0x0
                                                                                                    1⤵
                                                                                                      PID:14372
                                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                                      "LogonUI.exe" /flags:0x1
                                                                                                      1⤵
                                                                                                        PID:6708

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Reconnaissance

                                                                                                      Resource Development

                                                                                                      Initial Access

                                                                                                      Execution

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      Windows Management Instrumentation

                                                                                                      1
                                                                                                      T1047

                                                                                                      Persistence

                                                                                                      Boot or Logon Autostart Execution

                                                                                                      1
                                                                                                      T1547

                                                                                                      Registry Run Keys / Startup Folder

                                                                                                      1
                                                                                                      T1547.001

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      Privilege Escalation

                                                                                                      Boot or Logon Autostart Execution

                                                                                                      1
                                                                                                      T1547

                                                                                                      Registry Run Keys / Startup Folder

                                                                                                      1
                                                                                                      T1547.001

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      Defense Evasion

                                                                                                      Direct Volume Access

                                                                                                      1
                                                                                                      T1006

                                                                                                      Indicator Removal

                                                                                                      3
                                                                                                      T1070

                                                                                                      Clear Windows Event Logs

                                                                                                      1
                                                                                                      T1070.001

                                                                                                      File Deletion

                                                                                                      2
                                                                                                      T1070.004

                                                                                                      Modify Registry

                                                                                                      3
                                                                                                      T1112

                                                                                                      Credential Access

                                                                                                      Credentials from Password Stores

                                                                                                      2
                                                                                                      T1555

                                                                                                      Credentials from Web Browsers

                                                                                                      1
                                                                                                      T1555.003

                                                                                                      Windows Credential Manager

                                                                                                      1
                                                                                                      T1555.004

                                                                                                      Unsecured Credentials

                                                                                                      1
                                                                                                      T1552

                                                                                                      Credentials In Files

                                                                                                      1
                                                                                                      T1552.001

                                                                                                      Discovery

                                                                                                      Browser Information Discovery

                                                                                                      1
                                                                                                      T1217

                                                                                                      Peripheral Device Discovery

                                                                                                      1
                                                                                                      T1120

                                                                                                      Query Registry

                                                                                                      4
                                                                                                      T1012

                                                                                                      System Information Discovery

                                                                                                      4
                                                                                                      T1082

                                                                                                      System Location Discovery

                                                                                                      1
                                                                                                      T1614

                                                                                                      System Language Discovery

                                                                                                      1
                                                                                                      T1614.001

                                                                                                      Lateral Movement

                                                                                                      Collection

                                                                                                      Data from Local System

                                                                                                      1
                                                                                                      T1005

                                                                                                      Command and Control

                                                                                                      Web Service

                                                                                                      1
                                                                                                      T1102

                                                                                                      Exfiltration

                                                                                                      Impact

                                                                                                      Data Destruction

                                                                                                      1
                                                                                                      T1485

                                                                                                      Defacement

                                                                                                      1
                                                                                                      T1491

                                                                                                      Inhibit System Recovery

                                                                                                      3
                                                                                                      T1490

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-067654AC.[[email protected]].ncov
                                                                                                        Filesize

                                                                                                        23.5MB

                                                                                                        MD5

                                                                                                        45d474264ef368f48926319120ca996e

                                                                                                        SHA1

                                                                                                        2b94dfb01fd80d86d00c3c7793bb0ab11ecc60b0

                                                                                                        SHA256

                                                                                                        eccfa81bb5ae1b16071509689620f479112fec606dc15eb4d63d8f6900a27cb9

                                                                                                        SHA512

                                                                                                        b9f3b5f1de46e98b7dd5aa5ba225288b2569c6e02623f3ec26e611e07eb23dba5b864d975b8e53e8bc5a5612746f4368c19de9e49ea9abaa5c65c6583aefed9a

                                                                                                        Download Submit

                                                                                                      • C:\Program Files (x86)\Butterfly on Desktop\is-IHVPA.tmp
                                                                                                        Filesize

                                                                                                        3.0MB

                                                                                                        MD5

                                                                                                        81aab57e0ef37ddff02d0106ced6b91e

                                                                                                        SHA1

                                                                                                        6e3895b350ef1545902bd23e7162dfce4c64e029

                                                                                                        SHA256

                                                                                                        a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287

                                                                                                        SHA512

                                                                                                        a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\057a6680-81d0-4170-8606-780d0fbbe5ca.tmp
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        48047572852ef8d1f396c4dc3ce37aa2

                                                                                                        SHA1

                                                                                                        4c97c80b22f76a3b33de4064cd5e1c6545e250c3

                                                                                                        SHA256

                                                                                                        5b7ee7fde9755dce209005790f6072d409aabb9abc8f7cffc0c8f1d3f31b944b

                                                                                                        SHA512

                                                                                                        931dd5a18b0366e2bdbe749804f2808a1987948ced0f97cf8ff6ff1910bfcee62b61f9488971dac584cdd6410297d6a947bd8a543ef5b98fae9bec5364d1fddb

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        df2986bfcc5cf158df40da7ff4df9bab

                                                                                                        SHA1

                                                                                                        95afeb4f27c7da3736827942b630c4e7c5b40807

                                                                                                        SHA256

                                                                                                        58fbff4d57d59d2ae9f8788125436758bb4d194f4dc0b0479dbb550578d9bd0f

                                                                                                        SHA512

                                                                                                        af8d875e58f9097f0271f71312500c5a679a680d0b16aa2f2495279d8bfca96199aeb42ab2b9026e137fd7ca2d1e5f5cbf23b7773acd58090db34a56f9edffa5

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                                                                                                        Filesize

                                                                                                        264KB

                                                                                                        MD5

                                                                                                        f50f89a0a91564d0b8a211f8921aa7de

                                                                                                        SHA1

                                                                                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                        SHA256

                                                                                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                        SHA512

                                                                                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        624f5fa40ac52e7ad890d2501d0a4ca6

                                                                                                        SHA1

                                                                                                        079ff0f22881ec8d5cbc957a71423560e5a29486

                                                                                                        SHA256

                                                                                                        ff445c303e2d9307fa1a93fdd8646b18980c4a2fb487988c3ae1288407ff147a

                                                                                                        SHA512

                                                                                                        7c1c4c974c39ca87f42a33d65ae2cb472512c6cbcc068d8430594a3051293d5d244bbed3ba2ad3256c23fc5c4812e221e6edfcf64e70cf7add2a86bdb06f17a0

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        853B

                                                                                                        MD5

                                                                                                        ed1a4eeb3e359f10a179e84a42ca6c00

                                                                                                        SHA1

                                                                                                        965a36be7152f620e6ddba1c0be17b2750b1aab7

                                                                                                        SHA256

                                                                                                        8e16f524bc85162aedecf9e2a01bd59cf085541959e9498abf805acf4dab69d7

                                                                                                        SHA512

                                                                                                        cec8fc28693835939efdf8cb1d44cbda553f9afd166c219f070a13178cfc802f691578e807802542c6bd420def73ef198a85d57cfe279552f8c4e6c77c20f20b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        690B

                                                                                                        MD5

                                                                                                        bfc0050a59669d0e7a00614faf30288a

                                                                                                        SHA1

                                                                                                        c12664c5e67e7dcb217a6095a9dfbfcdc8cdb7e0

                                                                                                        SHA256

                                                                                                        178b613dc7213a071abe2ee31b5a067b43065519952cc8fe4b0458d1c8104185

                                                                                                        SHA512

                                                                                                        8a60e92a932a17a6e9d31da8ee1db7144bb8b513ba2572bb5bcdee65f06f9ca6f2394f2728109e8c5fbf355b8017287cfb1c70a62d52b1d6287392ad88fa233b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        853B

                                                                                                        MD5

                                                                                                        3ed1ca86a3c7cb782c61d09cc1057a1f

                                                                                                        SHA1

                                                                                                        19a73f57bf7dbaa85258f84b80be25ade9e77018

                                                                                                        SHA256

                                                                                                        ecef0a38c2d102b19d880f9a9ba7939035bdbca2896f31dd10e65d6d3e028090

                                                                                                        SHA512

                                                                                                        97df18aa27c3f8b8c16f8be8d7b66e1a668a9605c1e2e51b2759653d1de556516e07c0153e35a8dba7954a4832b188df36d9f1e9b337d00146fa1aef5bcadc98

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        853B

                                                                                                        MD5

                                                                                                        61c403f110197891425a3349924d5852

                                                                                                        SHA1

                                                                                                        356531b073025b93ad36b711a81becfcccb88c6a

                                                                                                        SHA256

                                                                                                        949e6db190002ed37938b4a21f7227e7334b3f1000c0086ebbca3c4298a6f060

                                                                                                        SHA512

                                                                                                        a0259b88fb0f560eede65a21eef70e6e7aa420b6d95b56fdc178abd9e132cc469d83b1c1a15597204b0a5b84e950432e1c9d28a388c65490a1d1fe2194e8c583

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        849B

                                                                                                        MD5

                                                                                                        6dc0e8bfd3fcf80b6d12cf8e99b84fa8

                                                                                                        SHA1

                                                                                                        d45c5a424fc41466ad2f27db36e974eac61afed8

                                                                                                        SHA256

                                                                                                        727dd17633496afcdaca5e73fc26c36c1e8be995964ab9b63fff6666a2bd69dc

                                                                                                        SHA512

                                                                                                        e09f8e3d9c21ffa5854240f893c9d594807f35bbfa37f45b7e197fbd08e0f433206fac4f2c80684254fed9092ef783fbcc02ab4773767840aa9e4fba935c0018

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        849B

                                                                                                        MD5

                                                                                                        60f683d5b9210fff7572b5af96566f57

                                                                                                        SHA1

                                                                                                        7b04ff825588d18298f1a4dfa52e1cbf71ba1e55

                                                                                                        SHA256

                                                                                                        217646cb2225ac85816c6eca377a75d2e3be1cac22ec4a0cfe200d58feba1cd4

                                                                                                        SHA512

                                                                                                        1afa8604987199f27f6f9ce8739af8d620e0f32583fed2c4804caebdfcc08a92f1d18e332b182a3384c81659a6f00a5d169aa357e6c09e587539db275e3f4387

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        853B

                                                                                                        MD5

                                                                                                        efc73c9e81eef3b4dfb27a1bd5a6df1e

                                                                                                        SHA1

                                                                                                        301f6083cf8538017ed97348f3cb81f292752d2c

                                                                                                        SHA256

                                                                                                        a2dcb433d32530ab3296a9441278134f4ff802fbce93185b033a1714a00dfa17

                                                                                                        SHA512

                                                                                                        e2bc7bf102af89824c16cca16f97864c96a4b0302d20d3c9d8349069a9b9404fec8603c5e98b757fd3a6e6e1cc1a8e20c318bbbc3433a407297433cad9e62e0b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        853B

                                                                                                        MD5

                                                                                                        6946c8082f8f021bc332a4f9811dc9ec

                                                                                                        SHA1

                                                                                                        b6b0491bf4a3a235799f135766d4b6e4c52092cb

                                                                                                        SHA256

                                                                                                        caf1404f24de5726dde95e2f5c3ed405e0bef300b04ada792469f459c2f399db

                                                                                                        SHA512

                                                                                                        cf06b7800a534ca646bcc6aa5a61120a3794c49d61e323c21737d496ad891003812b45d73687040575da799b729ac2787882a34e4f23f03d7371c5c642cb3d76

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        849B

                                                                                                        MD5

                                                                                                        484ceda151b26c2b13097b5c6a5d35b5

                                                                                                        SHA1

                                                                                                        39b55180db09d0cb3538db89a30dbeaecb193786

                                                                                                        SHA256

                                                                                                        9ed933fa039c735deaec8dbcbf432260e6944946c4a62311d70c043f942d674a

                                                                                                        SHA512

                                                                                                        1847aa4562264f18dfa038dd38a02e79b562acced5a699db1020965579cd8c8dab8785e7ad0900e09548d4a67721ca81f4374a76db7bca9e02f2ceaf4061b0a0

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        847B

                                                                                                        MD5

                                                                                                        35878822a6b931acdc975c7fdf9efee6

                                                                                                        SHA1

                                                                                                        8d937c30b6fe01a30b3c38b01a7771d3cbe79e0e

                                                                                                        SHA256

                                                                                                        6520a7c69428354b4ad4a9586dbb308be31e9e4817276537f40bf6eb4b3b995e

                                                                                                        SHA512

                                                                                                        03f52622f671e6f3580ac95b6ca794c6d6aa96e55d3c2fb0f76a4b955878d434002133f6a2ed76cf82b72237de810dcae79c38339ebc941d98c1c33a914c878c

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        851B

                                                                                                        MD5

                                                                                                        1df2bec3b3dda9dace87b60b1452b574

                                                                                                        SHA1

                                                                                                        e5f1ff8b542231fecc8f85887fce6f1bd1c99957

                                                                                                        SHA256

                                                                                                        bdcb3febf580175ba6ceb6e5082b20a8a1fd802181b9cb68869be9d6dc37280b

                                                                                                        SHA512

                                                                                                        c5e5e81ce2db8f238e47faf2036173b1ee33d96676d89adf40f55da8bbd0a1176befc0245c783934b07f2f7135e67fe16db3a36a474fda7a3631c922ac780689

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        849B

                                                                                                        MD5

                                                                                                        3cd1fff3fd402399ab708bc91de81399

                                                                                                        SHA1

                                                                                                        cca84695039d5a30f75e75e6e0022f11b4b4b8f5

                                                                                                        SHA256

                                                                                                        b5d0155eca53c64446422e62edfe1a133f04ec163bd258e1745459e9780efa6b

                                                                                                        SHA512

                                                                                                        1141846cfa2f5e88f05c7aa72f454bcdc49a224582c56522c57688ae69a21ea7e449e4d415e44785967cf67f0c793f0cecf404c56871191a818993cedf32f68d

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        849B

                                                                                                        MD5

                                                                                                        a6ec32c3fea44429973f1680e9b4e0f0

                                                                                                        SHA1

                                                                                                        d1953626a104866dc4cff7ca1872e5f21ffb6100

                                                                                                        SHA256

                                                                                                        dabad435a9ac7bc435134c90c0fa987b14271d8259b5942edaee7fea4983e2ef

                                                                                                        SHA512

                                                                                                        1ad8ceaf21f95a04e3c204eab596306ca39055d2b1f97319f976811cb9ff785cb83685d0654af6c8fbe612221d9cd355c8dced2a2f062547200355dcb1bd8aa1

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        363B

                                                                                                        MD5

                                                                                                        c35aebd467f66d252b1f43c9ebed15bd

                                                                                                        SHA1

                                                                                                        aadab824d80e56808c65171a2ce73d9b9225f857

                                                                                                        SHA256

                                                                                                        ba6f29112218154f2720a31a5b1fa97d9b3a88a12a5a2f2e8742b420db1305b8

                                                                                                        SHA512

                                                                                                        df582b125ee7a22d7b7a596a8f967d282fdc7a17725bd5f7ff083984cf58393425f067a3b4688293865caf048f24969d47e78a4138f8b2b2a24e3d1e6e7beb41

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        845B

                                                                                                        MD5

                                                                                                        00539d9d4f6e822444fbc38fe0d15b5c

                                                                                                        SHA1

                                                                                                        1050bb80b67328486f6d067f16f7619cc02135e7

                                                                                                        SHA256

                                                                                                        a9ac55d7a567adfe64078b8a272c65e46cf55d0e7417a8a93249bf8be67b7d96

                                                                                                        SHA512

                                                                                                        107c5a1aa7f747d45583f7e858b2b80ee1aef3cb962c6dfce714111d50600ef7e8bf00c2d87dd1be58623d8888cd2a2d71138ccede96dce9fbf886b8016faad7

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        847B

                                                                                                        MD5

                                                                                                        fe4024196622a6079833e08bb4a811cf

                                                                                                        SHA1

                                                                                                        141e195b97aabdc3fbcf07329e492843243c1558

                                                                                                        SHA256

                                                                                                        0b7f06e6faf7f36b2ea9b5d8b21592d013c2910e5244b8cc555773aa36f8b921

                                                                                                        SHA512

                                                                                                        512d10e47f26bf2e55c239681696bfeae9c863974a6119845b67c22f66c149b40f38f2ca89c500cb38ee10868559c30c5016cad9187ee19b9175f35fdf45b059

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        853B

                                                                                                        MD5

                                                                                                        a185b6c00370e2d6e5f6eea6bfa5af54

                                                                                                        SHA1

                                                                                                        6a63f7716401acb8cd2968e355b977bc8c35d96e

                                                                                                        SHA256

                                                                                                        54030b8ddf1898219949b68c820a6f286f250df31bb2111586bda17599691219

                                                                                                        SHA512

                                                                                                        a61ebece87eeb736a6d8137d6735fd88e543a32cacde98af6530a18078d1dcf8f3d7a0d2b426b3d3fa6e23fbe702c4e10f53bf466e20ea4dc35cb832cf71e227

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        853B

                                                                                                        MD5

                                                                                                        ba583e547a342fd36ea85dd2b2838b99

                                                                                                        SHA1

                                                                                                        98d052f2794ad98dbbe3c6e23b67a7b15aa542f6

                                                                                                        SHA256

                                                                                                        b9e193759181aa29b0a8cd6f7aedd6a8780908548401150fcc21c91211404aa0

                                                                                                        SHA512

                                                                                                        1c7b495542aeb2d639db731d87583701981e25ecfb604e6ae9f03b5ca05a3e4e082c60b7d3e45762167e3a7763ed6064f4664468f407d9ecc68d98a67cd3c21b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                        Filesize

                                                                                                        853B

                                                                                                        MD5

                                                                                                        6e6ad10861e29ccda13c6e2a0086b5e8

                                                                                                        SHA1

                                                                                                        3659f3e98dccd1f15d2960a7e7d58a6a296f6899

                                                                                                        SHA256

                                                                                                        a8db2083d2be4c6e61f161ad6e64b90b8f68a6306ff1f28bde2c1384ba9e9063

                                                                                                        SHA512

                                                                                                        d2ebcefc8798739ad54abed85ff831efa89c1af2801c00ccfc738a7d41f5c51839f04c0d8cbca71579043837670ac134b2083f795c6455161a72705cb159566b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        6KB

                                                                                                        MD5

                                                                                                        b35556a346a52c2abadcd654dc435f4f

                                                                                                        SHA1

                                                                                                        ce0b9a26e5aae88992137af7b365fdfe1de883aa

                                                                                                        SHA256

                                                                                                        84c81d01219141b9929eb43a20e4bcccdc6cb7d2ec5ff9f18101324ff1a2def0

                                                                                                        SHA512

                                                                                                        c4adda2027ffd0f7bd71d3de0e0a48caceefbfd980f3e7301eb50cabdc6fda4a6ce3eefc5c5b651ba28970acea582636d5a3fa6ea8222e8cd4a9455b2f07d89a

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        6KB

                                                                                                        MD5

                                                                                                        68fc555a7a77b2edb69ca7befd50b4ea

                                                                                                        SHA1

                                                                                                        89a2784804cbe2edc289900ba7c4ffab4f191947

                                                                                                        SHA256

                                                                                                        76f7f77eebf1665e6c30022be0b55aa54d0c864108e42e95392524e71fada282

                                                                                                        SHA512

                                                                                                        4b7bcfcd49d1039fffe4d025f10239f6b95302671569128c46a5e443e12668464e4c200479d9c6af3d7c73747a14a0a28c0051db14ed8cd3e5510b8b07738f63

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        6KB

                                                                                                        MD5

                                                                                                        2f8b37f11fa778c93bd80b36bcfd05fd

                                                                                                        SHA1

                                                                                                        4f890f29c491121ae464da241a088e6a869a8690

                                                                                                        SHA256

                                                                                                        f5269574140a4eca9dd679f0b73f5f6658fcd0f9d5ee3a1da01f00ff4b29ad7a

                                                                                                        SHA512

                                                                                                        b611ba0ec5a7c9cdd12aa6d0755eb60ed4758cead72329a67b1499659f4b600f7cbaafac897aebedbc1b45771f7108f892a560f1d6906873d851f2b0d9b700f6

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        a83ca6bd9119ab8973b04976d5b11b7f

                                                                                                        SHA1

                                                                                                        2659c321fc933fd2c39af6a3a220401612c34748

                                                                                                        SHA256

                                                                                                        3a23c49efa90f21b3e136615307199df250d79998b80b02bb3e2662bebc2c150

                                                                                                        SHA512

                                                                                                        71723c6b949dfb8107a3581e7fa804f0e76c06629587950d87804b59de7436c66180fca6196f63f9240578e28386c20598a1cf2bf0916990c21e6472f5068db2

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        c465dc09a865396f2542bad58e17726a

                                                                                                        SHA1

                                                                                                        fdcade2ca4ce005d8876a08f8dd738a51d84574a

                                                                                                        SHA256

                                                                                                        a4b041756354c75f10ec72f99afb4b3a16ee494de0469b64802bfefefea42114

                                                                                                        SHA512

                                                                                                        bd0d842286f637c7dcd3ca85d56c5516eeb50917e2683da169aba2835eec450285b54c620eb857a2e2fe7b2edfb38d2a6701b7c0737a28743e3ef554fdd18300

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        a6b0d473273a3a346db6645e1f80f0b0

                                                                                                        SHA1

                                                                                                        4dba153e693ddc5fd41d5751e3a16e2443d563ac

                                                                                                        SHA256

                                                                                                        0a3820dc199e4067b533ccd432e7b74f9479a649d72f6c38fbb521ab3cb93ee4

                                                                                                        SHA512

                                                                                                        1cb64ed1dc32cd9b928766212159b6e5bf140daf5fd1df5bf143452e2c5570d20628062cd5a794a4bce983e1017838f7d2aa2f798eaf75b48af74ebb0d920f6c

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        09654bb93ae453335251080da21c24d1

                                                                                                        SHA1

                                                                                                        bccbe2a0ed801999cf92d2d65654a8ae8eaa2f58

                                                                                                        SHA256

                                                                                                        e779cd10a1418b79986d50b0f73cfab40fc8da0bf262498747d38d240bb26da9

                                                                                                        SHA512

                                                                                                        6e5e1d4d6bd624a352bf7cd3caeadbfd95012a457a804b386f306fce4d497866072acd531cfa965a46ca34726b98c0c3b4bdd936aff0058e9af19ac45391e263

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        5KB

                                                                                                        MD5

                                                                                                        3f8600be082ff59adf4523b03c232949

                                                                                                        SHA1

                                                                                                        af332b2171cd2b2e7ee89f8261b7ba7df7dba08d

                                                                                                        SHA256

                                                                                                        4723f527b80e883cf86a26be65e8698ba5f6656f163aba540752e75097e514e8

                                                                                                        SHA512

                                                                                                        034090abdd0b2c72db37a22375733c92b06c5124db2336e6b056547a76fef2a310e6116bea240775d95a78c6ebb67923f4b527632c1d46d59202c0a3416f7a0f

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        9a0e8ea6223e3976c89447513d7250ac

                                                                                                        SHA1

                                                                                                        a14605b4b675656272c3ebdf3412e414a20c7bc6

                                                                                                        SHA256

                                                                                                        0fc1f8a7f20cd522d362f23333f0f67dac16333e0191d293e9c51cc1019b9a23

                                                                                                        SHA512

                                                                                                        23b59b23d96fc76478a467ce0ea9af957f4c95058e791a67229c64443ab624fe79dc0bada9d23cf969821a52ca0b351a45bccc8202ef0f5e6a47aa9615bfbd7a

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        5943007ffeb29012c92677a379639e7d

                                                                                                        SHA1

                                                                                                        2b2b99d08acb2d667e9bfd265c14e5ecb2a10127

                                                                                                        SHA256

                                                                                                        a7cfb2069fcd86d82da6f45772f2f4d3f1ae5255346900659efa9aa32dccd0cd

                                                                                                        SHA512

                                                                                                        eae16aa43977b54bf0a29a14910f0ed1d8bdb0f2b8477ca176795148a640b4cbab98e0ceb0416ec66d7e0d36b3bd079aae2b982f545244b18f3011126e1b90bd

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        18e723571b00fb1694a3bad6c78e4054

                                                                                                        SHA1

                                                                                                        afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                                                                        SHA256

                                                                                                        8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                                                                        SHA512

                                                                                                        43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                        Filesize

                                                                                                        82KB

                                                                                                        MD5

                                                                                                        fea9ddd51e53e30dbad31cc8fd1046a0

                                                                                                        SHA1

                                                                                                        df50105e9085fe2dbd577124423e778843c3bec8

                                                                                                        SHA256

                                                                                                        cd0a8812f9e2ab33fbf8eb78be4a8960fd52fc2e0660ff6fede5c894ce1aefac

                                                                                                        SHA512

                                                                                                        a753bee1a11ae9abc5fbf653ae3f6b2c3f3ddd18693313e4374fc3db1fb970beb84254c12035a3de65c71157e43970978f8e51d34eb8fc01ee7817a55c271a23

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                        Filesize

                                                                                                        75KB

                                                                                                        MD5

                                                                                                        529450a81e6856e43ac43b878befbef3

                                                                                                        SHA1

                                                                                                        d2df69cfaa9ec8d4dc94f656f781562d2b189398

                                                                                                        SHA256

                                                                                                        f4ac661c5efdb36998e36353769eefee59f56b706b3d2aeab89cb8a24bb851f3

                                                                                                        SHA512

                                                                                                        a4acca2957cd2e817a17f6ca76ba14ad0841d0930733ac4626bc8ee512953ef995327f89e03503ce271fea29cea9c78e9df3f6d3b16df787902226aa5c4adcd0

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Cab2D59.tmp
                                                                                                        Filesize

                                                                                                        70KB

                                                                                                        MD5

                                                                                                        49aebf8cbd62d92ac215b2923fb1b9f5

                                                                                                        SHA1

                                                                                                        1723be06719828dda65ad804298d0431f6aff976

                                                                                                        SHA256

                                                                                                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                                                                        SHA512

                                                                                                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Tar2DC9.tmp
                                                                                                        Filesize

                                                                                                        181KB

                                                                                                        MD5

                                                                                                        4ea6026cf93ec6338144661bf1202cd1

                                                                                                        SHA1

                                                                                                        a1dec9044f750ad887935a01430bf49322fbdcb7

                                                                                                        SHA256

                                                                                                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                                                                        SHA512

                                                                                                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\Downloads\BadRabbit.exe
                                                                                                        Filesize

                                                                                                        431KB

                                                                                                        MD5

                                                                                                        fbbdc39af1139aebba4da004475e8839

                                                                                                        SHA1

                                                                                                        de5c8d858e6e41da715dca1c019df0bfb92d32c0

                                                                                                        SHA256

                                                                                                        630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

                                                                                                        SHA512

                                                                                                        74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\Downloads\CookieClickerHack.exe
                                                                                                        Filesize

                                                                                                        68KB

                                                                                                        MD5

                                                                                                        bc1e7d033a999c4fd006109c24599f4d

                                                                                                        SHA1

                                                                                                        b927f0fc4a4232a023312198b33272e1a6d79cec

                                                                                                        SHA256

                                                                                                        13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

                                                                                                        SHA512

                                                                                                        f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\Downloads\CoronaVirus.exe
                                                                                                        Filesize

                                                                                                        1.0MB

                                                                                                        MD5

                                                                                                        055d1462f66a350d9886542d4d79bc2b

                                                                                                        SHA1

                                                                                                        f1086d2f667d807dbb1aa362a7a809ea119f2565

                                                                                                        SHA256

                                                                                                        dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

                                                                                                        SHA512

                                                                                                        2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\Downloads\GandCrab.exe
                                                                                                        Filesize

                                                                                                        291KB

                                                                                                        MD5

                                                                                                        e6b43b1028b6000009253344632e69c4

                                                                                                        SHA1

                                                                                                        e536b70e3ffe309f7ae59918da471d7bf4cadd1c

                                                                                                        SHA256

                                                                                                        bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

                                                                                                        SHA512

                                                                                                        07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\Downloads\WinNuke.98.exe
                                                                                                        Filesize

                                                                                                        32KB

                                                                                                        MD5

                                                                                                        eb9324121994e5e41f1738b5af8944b1

                                                                                                        SHA1

                                                                                                        aa63c521b64602fa9c3a73dadd412fdaf181b690

                                                                                                        SHA256

                                                                                                        2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

                                                                                                        SHA512

                                                                                                        7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\Downloads\butterflyondesktop.exe
                                                                                                        Filesize

                                                                                                        2.8MB

                                                                                                        MD5

                                                                                                        1535aa21451192109b86be9bcc7c4345

                                                                                                        SHA1

                                                                                                        1af211c686c4d4bf0239ed6620358a19691cf88c

                                                                                                        SHA256

                                                                                                        4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

                                                                                                        SHA512

                                                                                                        1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\Downloads\rickroll.exe
                                                                                                        Filesize

                                                                                                        129KB

                                                                                                        MD5

                                                                                                        0ec108e32c12ca7648254cf9718ad8d5

                                                                                                        SHA1

                                                                                                        78e07f54eeb6af5191c744ebb8da83dad895eca1

                                                                                                        SHA256

                                                                                                        48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

                                                                                                        SHA512

                                                                                                        1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

                                                                                                        Download Submit

                                                                                                      • F:\$RECYCLE.BIN\S-1-5-21-1488793075-819845221-1497111674-1000\ZCXFU-MANUAL.txt
                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        MD5

                                                                                                        1c7de4ca7374ead8ec6360944a76d37d

                                                                                                        SHA1

                                                                                                        f35bcd29e64b9dd2436c804749aaeb30243ce767

                                                                                                        SHA256

                                                                                                        def176fe8d9a84dbb56a9d91c76a3235c44c1754eb41c8ed7db74ccda3ce7f2c

                                                                                                        SHA512

                                                                                                        82614b83204ed8a644b0769208bdf48cd41121d43a3fbe5c33d6d78d6915ec19ceef96d9602314c5797d6547c0c62338a724343b794de5e7656b33db3e20d67f

                                                                                                        Download Submit

                                                                                                      • \Users\Admin\AppData\Local\Temp\is-B3AKT.tmp\_isetup\_shfoldr.dll
                                                                                                        Filesize

                                                                                                        22KB

                                                                                                        MD5

                                                                                                        92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                        SHA1

                                                                                                        3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                        SHA256

                                                                                                        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                        SHA512

                                                                                                        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                        Download Submit

                                                                                                      • \Users\Admin\AppData\Local\Temp\is-JLQEV.tmp\butterflyondesktop.tmp
                                                                                                        Filesize

                                                                                                        688KB

                                                                                                        MD5

                                                                                                        c765336f0dcf4efdcc2101eed67cd30c

                                                                                                        SHA1

                                                                                                        fa0279f59738c5aa3b6b20106e109ccd77f895a7

                                                                                                        SHA256

                                                                                                        c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

                                                                                                        SHA512

                                                                                                        06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

                                                                                                        Download Submit

                                                                                                      • memory/540-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/1332-863-0x0000000000400000-0x00000000004BC000-memory.dmp

                                                                                                        Filesize

                                                                                                        752KB

                                                                                                        Download

                                                                                                      • memory/1332-869-0x0000000000400000-0x00000000004BC000-memory.dmp

                                                                                                        Filesize

                                                                                                        752KB

                                                                                                        Download

                                                                                                      • memory/1332-820-0x0000000000400000-0x00000000004BC000-memory.dmp

                                                                                                        Filesize

                                                                                                        752KB

                                                                                                        Download

                                                                                                      • memory/2200-903-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.4MB

                                                                                                        Download

                                                                                                      • memory/2200-3374-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.4MB

                                                                                                        Download

                                                                                                      • memory/2200-912-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.4MB

                                                                                                        Download

                                                                                                      • memory/2656-861-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                        Filesize

                                                                                                        80KB

                                                                                                        Download

                                                                                                      • memory/2656-870-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                        Filesize

                                                                                                        80KB

                                                                                                        Download

                                                                                                      • memory/2656-815-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                                        Filesize

                                                                                                        40KB

                                                                                                        Download

                                                                                                      • memory/2656-811-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                        Filesize

                                                                                                        80KB

                                                                                                        Download

                                                                                                      • memory/8444-22581-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                        Download

                                                                                                      • memory/10184-22487-0x0000000000970000-0x00000000009D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        416KB

                                                                                                        Download

                                                                                                      • memory/10184-22483-0x0000000000970000-0x00000000009D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        416KB

                                                                                                        Download

                                                                                                      • memory/10184-22475-0x0000000000970000-0x00000000009D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        416KB

                                                                                                        Download

                                                                                                      • memory/10608-22440-0x0000000000400000-0x00000000052B3000-memory.dmp

                                                                                                        Filesize

                                                                                                        78.7MB

                                                                                                        Download

                                                                                                      • memory/14964-22377-0x0000000000400000-0x00000000052B3000-memory.dmp

                                                                                                        Filesize

                                                                                                        78.7MB

                                                                                                        Download