Overview

overview

10

Static

static

3

4363463463...63.exe

windows11-21h2-x64

New Text D...od.exe

windows11-21h2-x64

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

16-12-2024 05:27

241216-f5kx6awmh1 10

14-12-2024 20:23

241214-y6jqlasrhy 10

14-12-2024 20:22

241214-y51bysvmbk 10

14-12-2024 20:13

241214-yzc98svkfr 10

14-12-2024 13:14

241214-qgw1masrcy 10

14-12-2024 13:12

241214-qfk7qsvlaq 3

12-12-2024 18:19

241212-wymq6ssnat 10

12-12-2024 18:16

241212-www7tssmet 10

Analysis

  • max time kernel
    79s
  • max time network
    109s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-11-2024 00:45

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
asyncratmercurialgrabbernjratquasarumbralxmrigdefaultoffice04sgvpzjebcollectioncredential_accessdiscoveryevasionexecutionminerpersistenceprivilege_escalationratspywarestealertrojanupx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SGVP

C2

192.168.1.9:4782

150.129.206.176:4782

Ai-Sgvp-33452.portmap.host:33452
Mutex

a35ec7b7-5a95-4207-8f25-7af0a7847fa5

Attributes
  • encryption_key

    09BBDA8FF0524296F02F8F81158F33C0AA74D487

  • install_name

    User Application Data.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windowns Client Startup

  • subdirectory

    Quasar

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

14.243.221.170:2654

Mutex

a7b38fdd-192e-4e47-b9ba-ca9eb81cc7bd

Attributes
  • encryption_key

    8B9AD736E943A06EAF1321AD479071E83805704C

  • install_name

    Runtime Broker.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Runtime Broker

  • subdirectory

    SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

ZJEB

C2

VIPEEK1990-25013.portmap.host:25013

Mutex

ad21b115-2c1b-40cb-adba-a50736b76c21

Attributes
  • encryption_key

    3EBA8BC34FA983893A9B07B831E7CEB183F7492D

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Security Service

  • subdirectory

    SubDir

Extracted

Family

asyncrat

Botnet

Default

C2

technical-southwest.gl.at.ply.gg:58694

forums-appliances.gl.at.ply.gg:1962
Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain
aes.plain

Extracted

Family

mercurialgrabber

C2

https://discordapp.com/api/webhooks/1308883657456619530/0_Ad9EyrLZrIMKH4vjM6XHyvCJJtKddsiohDSyvCWZ8HIxpyNxmVJgrKb_zO-jqSHSO0

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

3.70.228.168:555

Mutex

bslxturcmlpmyqrv

Attributes
  • delay

    1

  • install

    true

  • install_file

    atat.exe

  • install_folder

    %AppData%

aes.plain
aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

66.66.146.74:9511

Mutex

nwJFeGdDXcL2

Attributes
  • delay

    3

  • install

    true

  • install_file

    System32.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Detect Umbral payload 2 IoCs
  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber
  • Mercurialgrabber family
    mercurialgrabber
  • Njrat family
    njrat
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 6 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • Xmrig family
    xmrig
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Async RAT payload 5 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • XMRig Miner payload 1 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 5 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 41 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 1 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Runs ping.exe 1 TTPs 9 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3324
      • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
        "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4092
        • C:\Users\Admin\AppData\Local\Temp\a\SGVP%20Client%20Users.exe
          "C:\Users\Admin\AppData\Local\Temp\a\SGVP%20Client%20Users.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:340
        • C:\Users\Admin\AppData\Local\Temp\a\Registry.exe
          "C:\Users\Admin\AppData\Local\Temp\a\Registry.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1908
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2084
          • C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4420
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4656
        • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
          "C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3488
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3584
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mfOZ9nrWILNn.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3008
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:672
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                5⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:4888
              • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
                "C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe"
                5⤵
                • Executes dropped EXE
                PID:1252
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                  6⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2476
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hXmkiQuFjLhy.bat" "
                  6⤵
                    PID:3720
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      7⤵
                        PID:3596
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        7⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:3812
                      • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
                        "C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:1688
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                          8⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:4908
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9IGYh3zSkZkb.bat" "
                          8⤵
                            PID:2700
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              9⤵
                                PID:4236
                              • C:\Windows\system32\PING.EXE
                                ping -n 10 localhost
                                9⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:5072
                              • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
                                "C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe"
                                9⤵
                                • Executes dropped EXE
                                PID:4084
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                  10⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1276
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mpUnta2zC2B7.bat" "
                                  10⤵
                                    PID:4644
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      11⤵
                                        PID:2708
                                      • C:\Windows\system32\PING.EXE
                                        ping -n 10 localhost
                                        11⤵
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Runs ping.exe
                                        PID:1772
                                      • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe"
                                        11⤵
                                        • Executes dropped EXE
                                        PID:1420
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                          12⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1776
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nR47GBa4dAli.bat" "
                                          12⤵
                                            PID:1004
                                            • C:\Windows\system32\chcp.com
                                              chcp 65001
                                              13⤵
                                                PID:1648
                                              • C:\Windows\system32\PING.EXE
                                                ping -n 10 localhost
                                                13⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:2272
                                              • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe"
                                                13⤵
                                                • Executes dropped EXE
                                                PID:1188
                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                  "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                  14⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4696
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HYJBg9ZEYXO7.bat" "
                                                  14⤵
                                                    PID:5244
                                                    • C:\Windows\system32\chcp.com
                                                      chcp 65001
                                                      15⤵
                                                        PID:5416
                                                      • C:\Windows\system32\PING.EXE
                                                        ping -n 10 localhost
                                                        15⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Runs ping.exe
                                                        PID:5432
                                                      • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe"
                                                        15⤵
                                                        • Executes dropped EXE
                                                        PID:1956
                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                          "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                          16⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4908
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ibDlDMuRZ5Bz.bat" "
                                                          16⤵
                                                            PID:7176
                                                            • C:\Windows\system32\chcp.com
                                                              chcp 65001
                                                              17⤵
                                                                PID:7916
                                                              • C:\Windows\system32\PING.EXE
                                                                ping -n 10 localhost
                                                                17⤵
                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                • Runs ping.exe
                                                                PID:6944
                                                              • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe"
                                                                17⤵
                                                                  PID:5228
                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                    "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                    18⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4556
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Blclf86sIuJO.bat" "
                                                                    18⤵
                                                                      PID:2680
                                                                      • C:\Windows\system32\chcp.com
                                                                        chcp 65001
                                                                        19⤵
                                                                          PID:7144
                                                                        • C:\Windows\system32\PING.EXE
                                                                          ping -n 10 localhost
                                                                          19⤵
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          • Runs ping.exe
                                                                          PID:7744
                                        • C:\Users\Admin\AppData\Local\Temp\a\dsd.exe
                                          "C:\Users\Admin\AppData\Local\Temp\a\dsd.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:1560
                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                            "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:4728
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
                                              5⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:1452
                                        • C:\Users\Admin\AppData\Local\Temp\a\Loader.exe
                                          "C:\Users\Admin\AppData\Local\Temp\a\Loader.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1180
                                        • C:\Users\Admin\AppData\Local\Temp\a\output.exe
                                          "C:\Users\Admin\AppData\Local\Temp\a\output.exe"
                                          3⤵
                                          • Looks for VirtualBox Guest Additions in registry
                                          • Looks for VMWare Tools registry key
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Maps connected drives based on registry
                                          • Checks SCSI registry key(s)
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4932
                                        • C:\Users\Admin\AppData\Local\Temp\a\saloader.exe
                                          "C:\Users\Admin\AppData\Local\Temp\a\saloader.exe"
                                          3⤵
                                          • Drops file in Drivers directory
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:4884
                                          • C:\Windows\SYSTEM32\attrib.exe
                                            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\a\saloader.exe"
                                            4⤵
                                            • Views/modifies file attributes
                                            PID:1260
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\saloader.exe'
                                            4⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1724
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                            4⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2624
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                            4⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4084
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                            4⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4628
                                          • C:\Windows\System32\Wbem\wmic.exe
                                            "wmic.exe" os get Caption
                                            4⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4272
                                          • C:\Windows\System32\Wbem\wmic.exe
                                            "wmic.exe" computersystem get totalphysicalmemory
                                            4⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4684
                                          • C:\Windows\System32\Wbem\wmic.exe
                                            "wmic.exe" csproduct get uuid
                                            4⤵
                                              PID:4744
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                              4⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:2752
                                            • C:\Windows\System32\Wbem\wmic.exe
                                              "wmic" path win32_VideoController get name
                                              4⤵
                                              • Detects videocard installed
                                              PID:568
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\a\saloader.exe" && pause
                                              4⤵
                                              • System Network Configuration Discovery: Internet Connection Discovery
                                              PID:2388
                                              • C:\Windows\system32\PING.EXE
                                                ping localhost
                                                5⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:3716
                                          • C:\Users\Admin\AppData\Local\Temp\a\aidans.dont.run.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a\aidans.dont.run.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:584
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Roaming\windows.exe"' & exit
                                              4⤵
                                                PID:3120
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Roaming\windows.exe"'
                                                  5⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3188
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD1D7.tmp.bat""
                                                4⤵
                                                  PID:3468
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout 3
                                                    5⤵
                                                    • Delays execution with timeout.exe
                                                    PID:4756
                                                  • C:\Users\Admin\AppData\Roaming\windows.exe
                                                    "C:\Users\Admin\AppData\Roaming\windows.exe"
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:2768
                                              • C:\Users\Admin\AppData\Local\Temp\a\handeltest.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\handeltest.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:3724
                                              • C:\Users\Admin\AppData\Local\Temp\a\xs.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\xs.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:4600
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "aspnet_regbrowsers" /tr '"C:\Users\Admin\AppData\Roaming\aspnet_regbrowsers.exe"' & exit
                                                  4⤵
                                                    PID:1636
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /create /f /sc onlogon /rl highest /tn "aspnet_regbrowsers" /tr '"C:\Users\Admin\AppData\Roaming\aspnet_regbrowsers.exe"'
                                                      5⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4040
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC2E2.tmp.bat""
                                                    4⤵
                                                      PID:1316
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout 3
                                                        5⤵
                                                        • Delays execution with timeout.exe
                                                        PID:2240
                                                      • C:\Users\Admin\AppData\Roaming\aspnet_regbrowsers.exe
                                                        "C:\Users\Admin\AppData\Roaming\aspnet_regbrowsers.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:2032
                                                  • C:\Users\Admin\AppData\Local\Temp\a\Tutorial.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a\Tutorial.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4660
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
                                                      4⤵
                                                        PID:1188
                                                    • C:\Users\Admin\AppData\Local\Temp\a\aa.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\a\aa.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4828
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "atat" /tr '"C:\Users\Admin\AppData\Roaming\atat.exe"' & exit
                                                        4⤵
                                                          PID:4564
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /create /f /sc onlogon /rl highest /tn "atat" /tr '"C:\Users\Admin\AppData\Roaming\atat.exe"'
                                                            5⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:4872
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCA26.tmp.bat""
                                                          4⤵
                                                            PID:800
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout 3
                                                              5⤵
                                                              • Delays execution with timeout.exe
                                                              PID:1508
                                                            • C:\Users\Admin\AppData\Roaming\atat.exe
                                                              "C:\Users\Admin\AppData\Roaming\atat.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:4048
                                                        • C:\Users\Admin\AppData\Local\Temp\a\nobody.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\a\nobody.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1992
                                                        • C:\Users\Admin\AppData\Local\Temp\a\ataturk.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\a\ataturk.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:3160
                                                        • C:\Users\Admin\AppData\Local\Temp\a\start.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\a\start.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5008
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System32" /tr '"C:\Users\Admin\AppData\Roaming\System32.exe"' & exit
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3944
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /f /sc onlogon /rl highest /tn "System32" /tr '"C:\Users\Admin\AppData\Roaming\System32.exe"'
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4644
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD39C.tmp.bat""
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4484
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 3
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Delays execution with timeout.exe
                                                              PID:792
                                                            • C:\Users\Admin\AppData\Roaming\System32.exe
                                                              "C:\Users\Admin\AppData\Roaming\System32.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2920
                                                        • C:\Users\Admin\AppData\Local\Temp\a\Winsvc.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\a\Winsvc.exe"
                                                          3⤵
                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                          • Drops startup file
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          PID:3716
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                            4⤵
                                                              PID:1092
                                                          • C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Checks processor information in registry
                                                            PID:4748
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                              4⤵
                                                              • Uses browser remote debugging
                                                              • Drops file in Windows directory
                                                              • Enumerates system info in registry
                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:6016
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xa0,0x108,0x7ffc63a2cc40,0x7ffc63a2cc4c,0x7ffc63a2cc58
                                                                5⤵
                                                                  PID:6028
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2332,i,5887606830548780404,17594408722605343141,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2328 /prefetch:2
                                                                  5⤵
                                                                    PID:3740
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1772,i,5887606830548780404,17594408722605343141,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2420 /prefetch:3
                                                                    5⤵
                                                                      PID:1120
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1876,i,5887606830548780404,17594408722605343141,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2548 /prefetch:8
                                                                      5⤵
                                                                        PID:1960
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,5887606830548780404,17594408722605343141,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3076 /prefetch:1
                                                                        5⤵
                                                                        • Uses browser remote debugging
                                                                        PID:5040
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,5887606830548780404,17594408722605343141,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3128 /prefetch:1
                                                                        5⤵
                                                                        • Uses browser remote debugging
                                                                        PID:2508
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4360,i,5887606830548780404,17594408722605343141,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4504 /prefetch:1
                                                                        5⤵
                                                                        • Uses browser remote debugging
                                                                        PID:4648
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4500,i,5887606830548780404,17594408722605343141,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4320 /prefetch:8
                                                                        5⤵
                                                                          PID:4568
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                        4⤵
                                                                        • Uses browser remote debugging
                                                                        PID:6948
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc51693cb8,0x7ffc51693cc8,0x7ffc51693cd8
                                                                          5⤵
                                                                            PID:5376
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
                                                                            5⤵
                                                                              PID:2464
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 /prefetch:3
                                                                              5⤵
                                                                                PID:6040
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
                                                                                5⤵
                                                                                  PID:2160
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
                                                                                  5⤵
                                                                                  • Uses browser remote debugging
                                                                                  PID:6768
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                                                                                  5⤵
                                                                                  • Uses browser remote debugging
                                                                                  PID:7388
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
                                                                                  5⤵
                                                                                    PID:8000
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2604 /prefetch:2
                                                                                    5⤵
                                                                                      PID:32
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1
                                                                                      5⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:4064
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
                                                                                      5⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:3864
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2588 /prefetch:2
                                                                                      5⤵
                                                                                        PID:7320
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4380 /prefetch:2
                                                                                        5⤵
                                                                                          PID:7664
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,2750946160398225584,15553208940446333194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2152 /prefetch:2
                                                                                          5⤵
                                                                                            PID:7912
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5136
                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          • Accesses Microsoft Outlook profiles
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • outlook_office_path
                                                                                          • outlook_win_path
                                                                                          PID:5280
                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5292
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 92
                                                                                            5⤵
                                                                                            • Program crash
                                                                                            PID:5392
                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5304
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\random.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\random.exe"
                                                                                        3⤵
                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                        • Checks BIOS information in registry
                                                                                        • Executes dropped EXE
                                                                                        • Identifies Wine through registry keys
                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5484
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 1384
                                                                                          4⤵
                                                                                          • Program crash
                                                                                          PID:7104
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\unik.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\unik.exe"
                                                                                        3⤵
                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                        • Checks BIOS information in registry
                                                                                        • Executes dropped EXE
                                                                                        • Identifies Wine through registry keys
                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5652
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 1436
                                                                                          4⤵
                                                                                          • Program crash
                                                                                          PID:6992
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\xblkpfZ8Y4.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\xblkpfZ8Y4.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        PID:5908
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\test28.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\test28.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4616
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\test26.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\test26.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1048
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\test27.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\test27.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3156
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\test29.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\test29.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:6376
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\test25.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\test25.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:7128
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\test24.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\test24.exe"
                                                                                        3⤵
                                                                                          PID:6308
                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\tik-tok-1.0.5.0-installer_iPXA-F1.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\tik-tok-1.0.5.0-installer_iPXA-F1.exe"
                                                                                          3⤵
                                                                                            PID:7564
                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\main_v4.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\main_v4.exe"
                                                                                            3⤵
                                                                                              PID:6792
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist
                                                                                                4⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:916
                                                                                              • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                wmic os get Caption,Version
                                                                                                4⤵
                                                                                                  PID:6084
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                                              2⤵
                                                                                                PID:1804
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5292 -ip 5292
                                                                                              1⤵
                                                                                                PID:5340
                                                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:1468
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5484 -ip 5484
                                                                                                  1⤵
                                                                                                    PID:732
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5652 -ip 5652
                                                                                                    1⤵
                                                                                                      PID:6428

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Reconnaissance

                                                                                                    Resource Development

                                                                                                    Initial Access

                                                                                                    Execution

                                                                                                    Command and Scripting Interpreter

                                                                                                    1
                                                                                                    T1059

                                                                                                    PowerShell

                                                                                                    1
                                                                                                    T1059.001

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Persistence

                                                                                                    Create or Modify System Process

                                                                                                    1
                                                                                                    T1543

                                                                                                    Windows Service

                                                                                                    1
                                                                                                    T1543.003

                                                                                                    Event Triggered Execution

                                                                                                    1
                                                                                                    T1546

                                                                                                    Netsh Helper DLL

                                                                                                    1
                                                                                                    T1546.007

                                                                                                    Modify Authentication Process

                                                                                                    1
                                                                                                    T1556

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Privilege Escalation

                                                                                                    Create or Modify System Process

                                                                                                    1
                                                                                                    T1543

                                                                                                    Windows Service

                                                                                                    1
                                                                                                    T1543.003

                                                                                                    Event Triggered Execution

                                                                                                    1
                                                                                                    T1546

                                                                                                    Netsh Helper DLL

                                                                                                    1
                                                                                                    T1546.007

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Defense Evasion

                                                                                                    Hide Artifacts

                                                                                                    1
                                                                                                    T1564

                                                                                                    Hidden Files and Directories

                                                                                                    1
                                                                                                    T1564.001

                                                                                                    Impair Defenses

                                                                                                    1
                                                                                                    T1562

                                                                                                    Disable or Modify System Firewall

                                                                                                    1
                                                                                                    T1562.004

                                                                                                    Modify Authentication Process

                                                                                                    1
                                                                                                    T1556

                                                                                                    Virtualization/Sandbox Evasion

                                                                                                    4
                                                                                                    T1497

                                                                                                    Credential Access

                                                                                                    Credentials from Password Stores

                                                                                                    1
                                                                                                    T1555

                                                                                                    Credentials from Web Browsers

                                                                                                    1
                                                                                                    T1555.003

                                                                                                    Modify Authentication Process

                                                                                                    1
                                                                                                    T1556

                                                                                                    Steal Web Session Cookie

                                                                                                    1
                                                                                                    T1539

                                                                                                    Unsecured Credentials

                                                                                                    1
                                                                                                    T1552

                                                                                                    Credentials In Files

                                                                                                    1
                                                                                                    T1552.001

                                                                                                    Discovery

                                                                                                    Browser Information Discovery

                                                                                                    1
                                                                                                    T1217

                                                                                                    Peripheral Device Discovery

                                                                                                    2
                                                                                                    T1120

                                                                                                    Process Discovery

                                                                                                    1
                                                                                                    T1057

                                                                                                    Query Registry

                                                                                                    11
                                                                                                    T1012

                                                                                                    Remote System Discovery

                                                                                                    1
                                                                                                    T1018

                                                                                                    System Information Discovery

                                                                                                    7
                                                                                                    T1082

                                                                                                    System Location Discovery

                                                                                                    1
                                                                                                    T1614

                                                                                                    System Language Discovery

                                                                                                    1
                                                                                                    T1614.001

                                                                                                    System Network Configuration Discovery

                                                                                                    1
                                                                                                    T1016

                                                                                                    Internet Connection Discovery

                                                                                                    1
                                                                                                    T1016.001

                                                                                                    Virtualization/Sandbox Evasion

                                                                                                    4
                                                                                                    T1497

                                                                                                    Lateral Movement

                                                                                                    Collection

                                                                                                    Data from Local System

                                                                                                    1
                                                                                                    T1005

                                                                                                    Email Collection

                                                                                                    1
                                                                                                    T1114

                                                                                                    Command and Control

                                                                                                    Web Service

                                                                                                    1
                                                                                                    T1102

                                                                                                    Exfiltration

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\ProgramData\CGCFCBAKKFBF\IEHIIIJDA
                                                                                                      Filesize

                                                                                                      40KB

                                                                                                      MD5

                                                                                                      a182561a527f929489bf4b8f74f65cd7

                                                                                                      SHA1

                                                                                                      8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                      SHA256

                                                                                                      42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                      SHA512

                                                                                                      9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                      Filesize

                                                                                                      2B

                                                                                                      MD5

                                                                                                      d751713988987e9331980363e24189ce

                                                                                                      SHA1

                                                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                      SHA256

                                                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                      SHA512

                                                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      Filesize

                                                                                                      9KB

                                                                                                      MD5

                                                                                                      8c94fcc8d96c522ba4740118267ba83f

                                                                                                      SHA1

                                                                                                      e05ad6bc027433ba8789a28438d417b37a355338

                                                                                                      SHA256

                                                                                                      b75979f31c2cf49e7a6cfbdfa98a4eba868029ec9a4a0b1199ee7f1f90c3c2dd

                                                                                                      SHA512

                                                                                                      4e05e105a26c8fc8e9f897d911e8b64776f882e4d9035c18fc8a54dc7fb24739f6f16fb097661967a8d706fd7d8e130cd5da676deffa0b8e731fe0cb31fd31f3

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                      Filesize

                                                                                                      228KB

                                                                                                      MD5

                                                                                                      e9569532d50f60bd00cdb0e8d648b1b8

                                                                                                      SHA1

                                                                                                      256a2d6a91ec79e64434749c75eb275e79eae0c3

                                                                                                      SHA256

                                                                                                      58e074913245bcf956521732bd1d3ced61191c319f918df424cdbf84364e1342

                                                                                                      SHA512

                                                                                                      5d67c5ed77daf982f1d33be377fb95758364a877ebd2781860278fd203675ec3acd57d2c67dd0302034bf2d5c885901527c2ec6062956a951f7ffd6e98f52789

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      627073ee3ca9676911bee35548eff2b8

                                                                                                      SHA1

                                                                                                      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                      SHA256

                                                                                                      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                      SHA512

                                                                                                      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\seksiak.exe.log
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      15eab799098760706ed95d314e75449d

                                                                                                      SHA1

                                                                                                      273fb07e40148d5c267ca53f958c5075d24c4444

                                                                                                      SHA256

                                                                                                      45030bd997f50bb52c481f7bc86fac5f375d08911bcc106b98d9d8f0c2ce9778

                                                                                                      SHA512

                                                                                                      50c125e2a98740db0a0122d7f4de97c50d84623e800b3d3e173049c8e28ff0fbe4add7677bc56cb2228f78ed17522f67ae8f1b85f62824012414ce38ce0b500c

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      cb557349d7af9d6754aed39b4ace5bee

                                                                                                      SHA1

                                                                                                      04de2ac30defbb36508a41872ddb475effe2d793

                                                                                                      SHA256

                                                                                                      cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

                                                                                                      SHA512

                                                                                                      f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      aad1d98ca9748cc4c31aa3b5abfe0fed

                                                                                                      SHA1

                                                                                                      32e8d4d9447b13bc00ec3eb15a88c55c29489495

                                                                                                      SHA256

                                                                                                      2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

                                                                                                      SHA512

                                                                                                      150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      a1d06b528671536e096a2aa18ac10938

                                                                                                      SHA1

                                                                                                      6f61d38e09ecbe777e66be40e7c9517b98f25743

                                                                                                      SHA256

                                                                                                      087005bc2776ba032d1284bcbac9b551de947a617158df0770a64f2f552355b8

                                                                                                      SHA512

                                                                                                      00fe385ba2a10c9b0f815af09c1381af232ff0cd3cf019125283559582de78c743631aa37172d6b835d8643214e28d704cb7f61494c9019ee05f96670e479d9a

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      08644c93c0863955baeed6562fbdaf7a

                                                                                                      SHA1

                                                                                                      bb4bb41e0ce6585b34408a1dffe2639600ea2e20

                                                                                                      SHA256

                                                                                                      a0892e370bfb27fd98585e2b7fe5bd3f30ac71aa5eb5946808d4c213c6119c52

                                                                                                      SHA512

                                                                                                      4e432e0210d5587ce077c66a713dc34dcb88c4a29456fe2abf595d85e625d5d55f6304e9127a2920f3cea79117939ffc915c675387b6f7d1c7bed110bd856210

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                                                                      Filesize

                                                                                                      264KB

                                                                                                      MD5

                                                                                                      f50f89a0a91564d0b8a211f8921aa7de

                                                                                                      SHA1

                                                                                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                      SHA256

                                                                                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                      SHA512

                                                                                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2G6VS791\download[1].htm
                                                                                                      Filesize

                                                                                                      1B

                                                                                                      MD5

                                                                                                      cfcd208495d565ef66e7dff9f98764da

                                                                                                      SHA1

                                                                                                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                                      SHA256

                                                                                                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                                      SHA512

                                                                                                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O5QKIIIQ\soft[1]
                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      MD5

                                                                                                      a8cf5621811f7fac55cfe8cb3fa6b9f6

                                                                                                      SHA1

                                                                                                      121356839e8138a03141f5f5856936a85bd2a474

                                                                                                      SHA256

                                                                                                      614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

                                                                                                      SHA512

                                                                                                      4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      944B

                                                                                                      MD5

                                                                                                      1a9fa92a4f2e2ec9e244d43a6a4f8fb9

                                                                                                      SHA1

                                                                                                      9910190edfaccece1dfcc1d92e357772f5dae8f7

                                                                                                      SHA256

                                                                                                      0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

                                                                                                      SHA512

                                                                                                      5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      948B

                                                                                                      MD5

                                                                                                      ddbf17224eb02adc2627cfaf80e332c2

                                                                                                      SHA1

                                                                                                      657498a83a4a8d52a4de1ae614a819c9443c3822

                                                                                                      SHA256

                                                                                                      e42c82c09b37d7406b4165e28393a1159455a42cc67eaaa82af291307a1cb89f

                                                                                                      SHA512

                                                                                                      5f5a5fce410256ec759e41cf936d9d320f9c06fe748bbdb325a3377bdda0f2a8e4049afb5cd0ee9e8077868bbba6881b73efb84fe24e5306dcd75a259ec293bb

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      558251ab9bc9c2e10e44975a894657a5

                                                                                                      SHA1

                                                                                                      7e6272db305c4da30b8ce063274bde520f0b4a92

                                                                                                      SHA256

                                                                                                      ef8a4bd0c8abbb6dd921e1c04c7e5b54eaca2079f8ae5eaed3f9db7ec9de43e4

                                                                                                      SHA512

                                                                                                      239a85d42c6546dc28bb7c76b448632a959695b64045baaef6abd83a5246884adba715b74cc1debe4ff126c838a36b4fe10eb2bc080f0957d421f3e932310ecf

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      63e54ca6551a4a091cca75d55e9122b2

                                                                                                      SHA1

                                                                                                      7afd34b6d2008fec2a36d984d535aea7406a66ce

                                                                                                      SHA256

                                                                                                      e263f5f17c235debb019644319a773d5feabd2f80fdb3d7783762ba572fe875b

                                                                                                      SHA512

                                                                                                      22e332795de470945a1864cfe32e90cd993554cf139467610abdb20b1608c2a7e0177f001b2b6f0032daa780980207943b6e1e4f0960e0576a1aea76fd1dd13e

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9IGYh3zSkZkb.bat
                                                                                                      Filesize

                                                                                                      206B

                                                                                                      MD5

                                                                                                      a1c2d66745c0b57414af98aefe93cb3a

                                                                                                      SHA1

                                                                                                      af536b14064b85d16c7f668288b19eea664b3d0b

                                                                                                      SHA256

                                                                                                      7cd38dd528b2a03bd599b46c4ea0561003bc648205b8fe649b0f7f899f1d05af

                                                                                                      SHA512

                                                                                                      128b56562863bf7e5af9f8f025a7406a606056ffd564499f1480d64296a7c924074fed3dae40931b734df6eff003f31f982fc7250b14bca1f86fc85a63c97d26

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ps2hyxp5.dvs.ps1
                                                                                                      Filesize

                                                                                                      60B

                                                                                                      MD5

                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                      SHA1

                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                      SHA256

                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                      SHA512

                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
                                                                                                      Filesize

                                                                                                      234KB

                                                                                                      MD5

                                                                                                      718d9132e5472578611c8a24939d152d

                                                                                                      SHA1

                                                                                                      8f17a1619a16ffbbc8d57942bd6c96b4045e7d68

                                                                                                      SHA256

                                                                                                      09810b0365c5ac275cca1a45ea00b00fdca819b7f10ce2c8a6a50a456d9e1ced

                                                                                                      SHA512

                                                                                                      6ae73ad6156bafa2e3f9a2b3466bca4d0a38d562b40aa29a84b6c9fe9380d2f99d73235b5d70208d6f2a3f607710eebf8c4daed6d387add0d933933fdd8c05de

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Loader.exe
                                                                                                      Filesize

                                                                                                      63KB

                                                                                                      MD5

                                                                                                      56c640c4191b4b95ba344032afd14e77

                                                                                                      SHA1

                                                                                                      c93a0fd32b46718ca3bc7d1c78ae6236b88ef3c9

                                                                                                      SHA256

                                                                                                      ebd4b1ab90350e2f13d46f2a356d5a637d5bec704cf3af211c43a89cb11dd142

                                                                                                      SHA512

                                                                                                      617512f96443b7cc9cc315d2eb0322d8b359218d459e80821563336b67ac263f1da9b00c75bde73320d6540572552c47b436c683c862f19b5ed470273001e63e

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Registry.exe
                                                                                                      Filesize

                                                                                                      3.1MB

                                                                                                      MD5

                                                                                                      6f154cc5f643cc4228adf17d1ff32d42

                                                                                                      SHA1

                                                                                                      10efef62da024189beb4cd451d3429439729675b

                                                                                                      SHA256

                                                                                                      bf901de5b54a593b3d90a2bcfdf0a963ba52381f542bf33299bdfcc3b5b2afff

                                                                                                      SHA512

                                                                                                      050fc8a9a852d87f22296be8fe4067d6fabefc2dec408da3684a0deb31983617e8ba42494d3dbe75207d0810dec7ae1238b17b23ed71668cc099a31e1f6539d1

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\SGVP%20Client%20Users.exe
                                                                                                      Filesize

                                                                                                      3.1MB

                                                                                                      MD5

                                                                                                      2fcfe990de818ff742c6723b8c6e0d33

                                                                                                      SHA1

                                                                                                      9d42cce564dcfa27b2c99450f54ba36d4b6eecaf

                                                                                                      SHA256

                                                                                                      cb731802d3cd29da2c01ffbb8c8ed4ef7de9d91c133b69b974583bede6bfd740

                                                                                                      SHA512

                                                                                                      4f20a27817de94a07071960abe0123277c0607a26de709e2ade201597df71d8c2eec7da353efba94dc6a8369b89db4caeaf9505d02b90dc30c37010a885c3613

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe
                                                                                                      Filesize

                                                                                                      409KB

                                                                                                      MD5

                                                                                                      2d79aec368236c7741a6904e9adff58f

                                                                                                      SHA1

                                                                                                      c0b6133df7148de54f876473ba1c64cb630108c1

                                                                                                      SHA256

                                                                                                      b33f25c28bf15a787d41472717270301071af4f10ec93fa064c96e1a33455c35

                                                                                                      SHA512

                                                                                                      022c5d135f66bc253a25086a2e9070a1ae395bdedd657a7a5554563dace75e1cbfe77c87033d6908d72deeab4a53f50e8bd202c4f6d6a9f17a19a9ebfdfe9538

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Tutorial.exe
                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      07edde1f91911ca79eb6088a5745576d

                                                                                                      SHA1

                                                                                                      00bf2ae194929c4276ca367ef6eca93afba0e917

                                                                                                      SHA256

                                                                                                      755d0128ec5a265f8fe25fa220925c42171682801aa0160707ffc39719270936

                                                                                                      SHA512

                                                                                                      8ed0362290199a6e5b45dc09061a06112eae9a68bea11241a31e330be5ca83a5936f64e1139c33159c91e87320a20904891b3e48802626b809d6b37001c425e7

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Winsvc.exe
                                                                                                      Filesize

                                                                                                      2.1MB

                                                                                                      MD5

                                                                                                      169a647d79cf1b25db151feb8d470fc7

                                                                                                      SHA1

                                                                                                      86ee9ba772982c039b070862d6583bcfed764b2c

                                                                                                      SHA256

                                                                                                      e61431610df015f48ebc4f4bc0492c4012b34d63b2f474badf6085c9dbc7f708

                                                                                                      SHA512

                                                                                                      efb5fd3e37da05611be570fb87929af73e7f16639b5eb23140381434dc974afc6a69f338c75ede069b387015e302c5106bf3a8f2727bb0406e7ca1de3d48a925

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\aa.exe
                                                                                                      Filesize

                                                                                                      74KB

                                                                                                      MD5

                                                                                                      447523b766e4c76092414a6b42080308

                                                                                                      SHA1

                                                                                                      f4218ea7e227bde410f5cbd6b26efd637fc35886

                                                                                                      SHA256

                                                                                                      3e7eb033eaf54c89f14d322597e377be7fd69f9c300f5be0e670b675d2a1a568

                                                                                                      SHA512

                                                                                                      98b68c743d8aab5b9cb0aad2331ab24673e425fbe68ad0ede2f3aafc1394879f8a05c7db5393b3ef3b8c2d21674a35f90c275558f43cdf983d03d995151ec2f9

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\aidans.dont.run.exe
                                                                                                      Filesize

                                                                                                      63KB

                                                                                                      MD5

                                                                                                      9efaf6b98fdde9df4532d1236b60619f

                                                                                                      SHA1

                                                                                                      5d1414d09d54de16b04cd0cd05ccfc0692588fd1

                                                                                                      SHA256

                                                                                                      7c8a5e6cf4e451d61157e113f431a1f3e606fba0e7147ffa9a8f429cb60e47d6

                                                                                                      SHA512

                                                                                                      eabc2c58a7b2d636f13b149199f2dc943c4af3296c5a4605b72293294a449a2ea8da432238748ca2fb69fb944a31ac6fae7e5310cdc57609e5955f62b71e812d

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\ataturk.exe
                                                                                                      Filesize

                                                                                                      56KB

                                                                                                      MD5

                                                                                                      a7b36da8acc804d5dd40f9500277fea9

                                                                                                      SHA1

                                                                                                      5c80776335618c4ad99d1796f72ebeb53a12a40b

                                                                                                      SHA256

                                                                                                      b820302d0d553406ab7b2db246c15ac87cb62a8e9c088bda2261fe5906fc3672

                                                                                                      SHA512

                                                                                                      ee1a8b3fdc049f90c0a4cfe166a7bde04eb6c55a261ad9f9574c995ea782b9e2398ac7028a258ea737aea81326fa3f85e609f3e1510373b9925dc03dcb0dee52

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\dsd.exe
                                                                                                      Filesize

                                                                                                      23KB

                                                                                                      MD5

                                                                                                      2697c90051b724a80526c5b8b47e5df4

                                                                                                      SHA1

                                                                                                      749d44fe2640504f15e9bf7b697f1017c8c2637d

                                                                                                      SHA256

                                                                                                      f8b23a264f58e9001e087af2bf48eed5938db31b5b1b20d973575cfa6a121355

                                                                                                      SHA512

                                                                                                      d0c8d76699f2f88d76eeaf211e59a780969b7692b513495a34013af8380d3fe0616caf03c6e47b8e7721d2f0a369c1dd20860b755b7d607783a99080c5f5315b

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\gvndxfghs.exe
                                                                                                      Filesize

                                                                                                      320KB

                                                                                                      MD5

                                                                                                      3050c0cddc68a35f296ba436c4726db4

                                                                                                      SHA1

                                                                                                      199706ee121c23702f2e7e41827be3e58d1605ea

                                                                                                      SHA256

                                                                                                      6bcddc15bc817e1eff29027edc4b19ef38c78b53d01fb8ffc024ad4df57b55c2

                                                                                                      SHA512

                                                                                                      b95c673a0c267e3ba56ffa26c976c7c0c0a1cc61f3c25f7fc5041919957ad5cb3dfe12d2a7cc0a10b2db41f7e0b42677b8e926d7b4d8679aadbd16976bd8e3ca

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\handeltest.exe
                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      fc58aae64a21beb97e1f8eb000610801

                                                                                                      SHA1

                                                                                                      d377b4da7d8992b0c00455b88550515369b48c78

                                                                                                      SHA256

                                                                                                      a9da5745b96d84d4933b62dd790563ecdf59b5cf45009a192e886dc39c80c389

                                                                                                      SHA512

                                                                                                      601d661020e204565d21a1b7cedc5c081be2a88c226cd7152be6d3ea0ccc72161dcec68026f344028e5409e08178877639d5d6a46564d8e3d68236e484fc03d8

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\main_v4.exe
                                                                                                      Filesize

                                                                                                      9.3MB

                                                                                                      MD5

                                                                                                      b248e08a7a52224f0d74d4a234650c5b

                                                                                                      SHA1

                                                                                                      6218a3c60050b91ad99d07eb378d8027e8e52749

                                                                                                      SHA256

                                                                                                      746454b0fce64c3b29b5279e2ca7c6c68a41b9b5f0cce71449f9fffe0be9cce1

                                                                                                      SHA512

                                                                                                      5ef1bd0c480e635aafa517b57d5bc8dbf577c54dfac9a7887d67761e3017b6a90f5607ced3717c61db9e44833500295e978c88c64d268725aa55230e83c470a8

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\nobody.exe
                                                                                                      Filesize

                                                                                                      74KB

                                                                                                      MD5

                                                                                                      4b1b45bb55ccdd4b078459ade3763e6d

                                                                                                      SHA1

                                                                                                      049344853c902e22e70ae231c669bf0751185716

                                                                                                      SHA256

                                                                                                      1f06ff3d8f50e6c184beca758aaad63936ad20a056b8ae4c8138d85ccc703a46

                                                                                                      SHA512

                                                                                                      b95739746df825e83e59b81f11f841d6029f92bebcd46485df456b23ff1c87cbce097d1e695a9f0a2559bcd9960a4f4fc137bca95233fafe95b13ddf5fabad65

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\output.exe
                                                                                                      Filesize

                                                                                                      41KB

                                                                                                      MD5

                                                                                                      a0e598ec98a975405420be1aadaa3c2a

                                                                                                      SHA1

                                                                                                      d861788839cfb78b5203686334c1104165ea0937

                                                                                                      SHA256

                                                                                                      e6ac8a6dac77f9873024f50befb293b9cf6347aa2e093cd863b551d9c8da5f8d

                                                                                                      SHA512

                                                                                                      e5ee500a8dcddd72e727cfa24e51093cd2b088f7ef89089f1d24145baa41c1ac46bf6be73bfd8cb15e2549349da8c2547d4e391b6e3a456621524fe0f83f9585

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\random.exe
                                                                                                      Filesize

                                                                                                      1.9MB

                                                                                                      MD5

                                                                                                      50a2b1ed762a07b62770d1532a5c0e57

                                                                                                      SHA1

                                                                                                      3e89b640f5bc1cfd6da2dded0f6aea947a7f6353

                                                                                                      SHA256

                                                                                                      859fca2ff16a4c2e55accf995c415e046c4d4150fb3b50064ee26acbb02cb853

                                                                                                      SHA512

                                                                                                      207ad9f0a03fbb9bd58087fb49bd84c71493e4e840a367b0732b8dc836184845c4c0b9f873a9c068ca3295786a283d2bd936aa01cc87e9a3f1e26e2cfcabf7ca

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\saloader.exe
                                                                                                      Filesize

                                                                                                      229KB

                                                                                                      MD5

                                                                                                      1e10af7811808fc24065f18535cf1220

                                                                                                      SHA1

                                                                                                      65995bcb862aa66988e1bb0dbff75dcac9b400c7

                                                                                                      SHA256

                                                                                                      e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed

                                                                                                      SHA512

                                                                                                      f1c623918a3701254805e7648d671b316446a0f98637d3de62d44331cf91502afb57ccb762472491bc4ac037fbf5f7b624eb9d39092b3be0b2ed84da6f3acadc

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\seksiak.exe
                                                                                                      Filesize

                                                                                                      3.1MB

                                                                                                      MD5

                                                                                                      239c5f964b458a0a935a4b42d74bcbda

                                                                                                      SHA1

                                                                                                      7a037d3bd8817adf6e58734b08e807a84083f0ce

                                                                                                      SHA256

                                                                                                      7809ab9c004fbd18f185c7b54554440d7b31f201980aee6e0c62a97c0e4a984c

                                                                                                      SHA512

                                                                                                      2e9e95d5097ce751d2a641a8fc7f8bc824a525a07bc06cd8a60580405fad90543ffa3259e6b2b2e97a70a3c3ed03e73b29f7cb9ebd10e7c62eaef2078805be19

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\start.exe
                                                                                                      Filesize

                                                                                                      45KB

                                                                                                      MD5

                                                                                                      b733e729705bf66c1e5c66d97e247701

                                                                                                      SHA1

                                                                                                      25eec814abdf1fc6afe621e16aa89c4eb42616b9

                                                                                                      SHA256

                                                                                                      9081f9cf986ed111d976a07ee26fc2b1b9992301344197d6d3f83fe0d2616023

                                                                                                      SHA512

                                                                                                      09b59b8942c1409a03ca4e7f77c6007160af4d557386b766516dba392750869c017d0fd5d6fbbfcbb3e559a70ad42adcb498595df186be180cfc04e921d74320

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\test24.exe
                                                                                                      Filesize

                                                                                                      354KB

                                                                                                      MD5

                                                                                                      6afc3c2a816aed290389257f6baedfe2

                                                                                                      SHA1

                                                                                                      7a6882ad4753745201e57efd526d73092e3f09ca

                                                                                                      SHA256

                                                                                                      ad01183c262140571a60c13299710a14a8820cc71261e3c1712657b9e03f5ee1

                                                                                                      SHA512

                                                                                                      802fcfa9497ed12731033d413ec1dc856d52680aec2bf9f0865095dd655a27c35130c4f5493705cba3350f79c07c4e9ac30ea5149192c67edb375dbdaec03b0c

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\test25.exe
                                                                                                      Filesize

                                                                                                      354KB

                                                                                                      MD5

                                                                                                      c9942f1ac9d03abdb6fa52fe6d789150

                                                                                                      SHA1

                                                                                                      9a2a98bd2666344338c9543acfc12bc4bca2469b

                                                                                                      SHA256

                                                                                                      19fd10efb6bdfb8821692fd86388a1feae7683a863dd4aa1288fcd8a9611b7c2

                                                                                                      SHA512

                                                                                                      8544a039e9288e3b5cdfceedef140233a6ba6587989fb7dd2e491477cba89df1350d3807d44f381c9be6fe6af9a7f9fc9e15e8f1071e0de3c82f6189b08d6b41

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\test26.exe
                                                                                                      Filesize

                                                                                                      354KB

                                                                                                      MD5

                                                                                                      b9054fcd207162b0728b5dfae1485bb7

                                                                                                      SHA1

                                                                                                      a687dc87c8fb69c7a6632c990145ae8d598113ce

                                                                                                      SHA256

                                                                                                      db032c18992b20def16589678eb07e0d3f74e971f4efc07196d7cd70a16753bc

                                                                                                      SHA512

                                                                                                      76e33c6b965ffb47f0a2838ca0571134cdf32ab9f6808bc21e6ca060b4d23e15cd686bd6d57571dbc613aa6e17a3702264079f2bc411de1a72a7d1e01afc469f

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\test27.exe
                                                                                                      Filesize

                                                                                                      354KB

                                                                                                      MD5

                                                                                                      ae1904cb008ec47312a8cbb976744cd4

                                                                                                      SHA1

                                                                                                      7fce66e1a25d1b011df3ed8164c83c4cc78d0139

                                                                                                      SHA256

                                                                                                      819105084e3cccedac4ae2512a171657b4d731e84333a561e526d2b4c2043257

                                                                                                      SHA512

                                                                                                      52b185147655bd5cd8b17547b9f76255b54f5f7d9a42b781c4b7a8b68fab172a54417c25e06da794e4cbf80786aeed441e4cbf7f3ecedbcaed652384877a5c4b

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\test28.exe
                                                                                                      Filesize

                                                                                                      354KB

                                                                                                      MD5

                                                                                                      1fa166752d9ff19c4b6d766dee5cce89

                                                                                                      SHA1

                                                                                                      80884d738936b141fa173a2ed2e1802e8dfcd481

                                                                                                      SHA256

                                                                                                      8978e8d5c2cdf2620aa5541469ac7f395c566d7349f709c1d23dda48a0eda0d0

                                                                                                      SHA512

                                                                                                      5a2e8376a1408d44d025c02b27f5e6f24c14671f72677d918bf88e37e5800674cf576dd7bda8ecf08ea50d1cbeadb555abe8796421667408f3f2c5b42475ba7b

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\test29.exe
                                                                                                      Filesize

                                                                                                      354KB

                                                                                                      MD5

                                                                                                      fccc38fc0f68b8d2757ee199db3b5d21

                                                                                                      SHA1

                                                                                                      bc38fe00ad9dd15cecca295e4046a6a3b085d94d

                                                                                                      SHA256

                                                                                                      b9a30bd6a26cade7cd01184c4f28dd3c18da218a3df2df97d3b294b42e34ef14

                                                                                                      SHA512

                                                                                                      219334ec29a50a27f3caf5a9bad1be4b6207890198da34ec55986195f477751a3063b2a782afeeef41474870696440d038e5fd0cb54df17467ffb15ba7ba83a9

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\tik-tok-1.0.5.0-installer_iPXA-F1.exe
                                                                                                      Filesize

                                                                                                      4.2MB

                                                                                                      MD5

                                                                                                      ac8ca19033e167cae06e3ab4a5e242c5

                                                                                                      SHA1

                                                                                                      8794e10c8f053b5709f6610f85fcaed2a142e508

                                                                                                      SHA256

                                                                                                      d6efeb15923ac6c89b65f87a0486e18e0b7c5bff0d4897173809d1515a9ed507

                                                                                                      SHA512

                                                                                                      524aa417a1bbec3e8fafaf88d3f08851b0adf439f7a3facdd712d24314796f22b5602a7340c4efdfd957ee520c490021323b7faaf9061b99f23385c3498e2b0d

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\unik.exe
                                                                                                      Filesize

                                                                                                      1.9MB

                                                                                                      MD5

                                                                                                      8d4744784b89bf2c1affb083790fdc88

                                                                                                      SHA1

                                                                                                      d3f5d8d2622b0d93f7ce5b0da2b5f4ed439c6ec5

                                                                                                      SHA256

                                                                                                      d6a689c92843fce8cbd5391511ed74f7e9b6eb9df799626174a8b4c7160bea75

                                                                                                      SHA512

                                                                                                      b3126463c8d5bb69a161778e871928dc9047b69bfcb56b1af91342034a15e03a1e5a0ccea4ba7334a66a361842e8241046e00500626613a00cb5bec891436641

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\xblkpfZ8Y4.exe
                                                                                                      Filesize

                                                                                                      2.9MB

                                                                                                      MD5

                                                                                                      45fe36d03ea2a066f6dd061c0f11f829

                                                                                                      SHA1

                                                                                                      6e45a340c41c62cd51c5e6f3b024a73c7ac85f88

                                                                                                      SHA256

                                                                                                      832640671878e0d9a061d97288ffaae303ba3b4858ed5d675c2170e7770ec8a6

                                                                                                      SHA512

                                                                                                      c8676bd022fae62a2c03932dd874da8482168698fc99987c8d724b5302f75131839b5b3b6f8288b823c5bb732918f6bc49c377116bb78825807de45b6a10026f

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\xs.exe
                                                                                                      Filesize

                                                                                                      56KB

                                                                                                      MD5

                                                                                                      717f7ee9f178509f07ace113f47bb6d1

                                                                                                      SHA1

                                                                                                      6ce32babec7538b702d38483ac6031c18a209f96

                                                                                                      SHA256

                                                                                                      50f7eb886f7d415e9e64875867aeeeaa8ef129f49ceebd271701e53c4f5acd85

                                                                                                      SHA512

                                                                                                      5ad4328061c67ec4c9db57ff8c56cf048d8b1fe386e554256c720136acd4f9e1d8cb39bc8079ae8ba5eb8d80137bb571ba29ee55bfd22786797445a652d0ef95

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hXmkiQuFjLhy.bat
                                                                                                      Filesize

                                                                                                      206B

                                                                                                      MD5

                                                                                                      abbe06ef23996d7b0e0f836e20f52c54

                                                                                                      SHA1

                                                                                                      797786407893fca2ade9ffa78108fa32e9364fce

                                                                                                      SHA256

                                                                                                      e2dba0f6c2bc4f889d8c41e05cf16fd96de5fb385e3bf233690eae046e09e9c7

                                                                                                      SHA512

                                                                                                      73c0946073e4b5bb3d7e6c9952747e5217289e1e01087e058665883ee67656ab740c8f45b130de9900e14fe4a6078bf89fc5754a01810b2c727e4aac2f1aaa60

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mfOZ9nrWILNn.bat
                                                                                                      Filesize

                                                                                                      206B

                                                                                                      MD5

                                                                                                      6d86d805721c9b8bb2b65a7d24451cca

                                                                                                      SHA1

                                                                                                      4d067f1f811883cfea3b9e65befd8c541ffc8895

                                                                                                      SHA256

                                                                                                      bec015be7402393fc2c106d54a1573142adcb46cac73a2ee57ca745663e27813

                                                                                                      SHA512

                                                                                                      27b41e7afdb8bde91d863ed8a8e9316ea90251524b270781cb2934ff99b88f39a8438f33b1e85a05c7b035c84fd1fb714d328992ef68e9786fedc5b1133a8d28

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mpUnta2zC2B7.bat
                                                                                                      Filesize

                                                                                                      206B

                                                                                                      MD5

                                                                                                      4f8bd5990196f609fc408c90ec065f44

                                                                                                      SHA1

                                                                                                      528367bf6749777c9107569c58388cb07c142bc2

                                                                                                      SHA256

                                                                                                      dd2ae2c63edf9147f59b750e0073059aab3a0c349c267ad0a536078d98159f3e

                                                                                                      SHA512

                                                                                                      9e289d212ae570f156c9abe3d44ae838a0a3c90d0af5a192bf293e571d40b90ecbe69f03353257a3785bcf946c00ab3cf9f62cac350cb8bc718e7ae04590798f

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nR47GBa4dAli.bat
                                                                                                      Filesize

                                                                                                      206B

                                                                                                      MD5

                                                                                                      8945f41ca0fca082da4d4b7734762df2

                                                                                                      SHA1

                                                                                                      75bac1bfaad46b3ebc068c0894bc81e4e7bab407

                                                                                                      SHA256

                                                                                                      3a5d534c9879a6578530a1935f3b41ae27db1153d52bdea10c6b7669d686255a

                                                                                                      SHA512

                                                                                                      cf9d4c5550d870b712de54092e78a99cfd045264481f37beb624277429f8ba8ee01e39c530dd6ef104aedf6d0ef945ea1b946484ee5219bdb70890308f5cc41c

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpC2E2.tmp.bat
                                                                                                      Filesize

                                                                                                      162B

                                                                                                      MD5

                                                                                                      6dcb040d5fecba19e679f4ec1ced652f

                                                                                                      SHA1

                                                                                                      e2dd3759ac0cd7ecd725109eb77bbca61ef3781c

                                                                                                      SHA256

                                                                                                      69d71099c231e334355c29c91aa3a24a955664bed903909d91f3e8384c6f5f98

                                                                                                      SHA512

                                                                                                      c6c8765221a76c0353d443a736dccdd962efabe86e40e793d4c0abe6704bc643c33ae7208a0846fb9570c7dbaa2aaba42d6a0a264660030c9930d73d768fad76

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpCA26.tmp.bat
                                                                                                      Filesize

                                                                                                      148B

                                                                                                      MD5

                                                                                                      330e4957a077eb2189504c54d6757d85

                                                                                                      SHA1

                                                                                                      2aa88297b17e2d63e916fcd2510c3c27806b0551

                                                                                                      SHA256

                                                                                                      c1bddfb1d52883edb5cfd0aa2461aae07a3dcff3f3b474e33fce9e485abc4d0e

                                                                                                      SHA512

                                                                                                      3b49db95fda258a4ea4d65c99f573fdb28efdd85f3ca17edd72a434c4596b31c9de8f300aa8322cd1076adfe02620ff2c70ab17bb90af54b71470f991075c386

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpD1D7.tmp.bat
                                                                                                      Filesize

                                                                                                      151B

                                                                                                      MD5

                                                                                                      c94315dca1b11a32b1bb238d17ad3695

                                                                                                      SHA1

                                                                                                      3b17121622ca14eed609656baae4fe306980861a

                                                                                                      SHA256

                                                                                                      358e859abc6038f1df08e0b00322dde8ccbe293e6b7cee24c3e2c7aebf5be004

                                                                                                      SHA512

                                                                                                      a3f16090a8fbcecba13db50a03cf723067d70c3176d7731d1b6b06c058dac1022de3dd39f22b78200e7619d8cefe4fa34562acb03fceca056324e64e76df968b

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpD39C.tmp.bat
                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      b106efb510d3b6bac7be1c61aad1e260

                                                                                                      SHA1

                                                                                                      674aa36dd1a5f61dfa4163edd7a22b34f97617b0

                                                                                                      SHA256

                                                                                                      2df0b8389abeecddc08b61d1f012a908351178bc25524e24b6b4fd90b6633f38

                                                                                                      SHA512

                                                                                                      cb4fdc2c538bce92b13a3ba809ee9483d37dd36c9ab6a3ebf36c6ba66955d10a471932b106989ce0752ec284a91d598e7130489d66dc7477d488e168f0aed535

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                                                                                                      Filesize

                                                                                                      8B

                                                                                                      MD5

                                                                                                      cf759e4c5f14fe3eec41b87ed756cea8

                                                                                                      SHA1

                                                                                                      c27c796bb3c2fac929359563676f4ba1ffada1f5

                                                                                                      SHA256

                                                                                                      c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                                                                                                      SHA512

                                                                                                      c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                                                                                                      Download Submit

                                                                                                    • memory/340-14-0x00007FFC567D0000-0x00007FFC57292000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/340-283-0x00007FFC567D0000-0x00007FFC57292000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/340-15-0x0000000000B00000-0x0000000000E24000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.1MB

                                                                                                      Download

                                                                                                    • memory/340-16-0x00007FFC567D0000-0x00007FFC57292000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/584-118-0x0000000000B00000-0x0000000000B16000-memory.dmp

                                                                                                      Filesize

                                                                                                      88KB

                                                                                                      Download

                                                                                                    • memory/1180-68-0x00000000008F0000-0x0000000000906000-memory.dmp

                                                                                                      Filesize

                                                                                                      88KB

                                                                                                      Download

                                                                                                    • memory/1724-106-0x0000015548660000-0x0000015548682000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                      Download

                                                                                                    • memory/1804-1664-0x000001DA65920000-0x000001DA65A2A000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.0MB

                                                                                                      Download

                                                                                                    • memory/1804-1663-0x000001DA4B690000-0x000001DA4B698000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      Download

                                                                                                    • memory/1804-5701-0x000001DA4B6A0000-0x000001DA4B6F6000-memory.dmp

                                                                                                      Filesize

                                                                                                      344KB

                                                                                                      Download

                                                                                                    • memory/1804-1662-0x0000000000400000-0x00000000004CE000-memory.dmp

                                                                                                      Filesize

                                                                                                      824KB

                                                                                                      Download

                                                                                                    • memory/1908-28-0x0000000000B90000-0x0000000000EB4000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.1MB

                                                                                                      Download

                                                                                                    • memory/1992-221-0x00000000007C0000-0x00000000007D8000-memory.dmp

                                                                                                      Filesize

                                                                                                      96KB

                                                                                                      Download

                                                                                                    • memory/3160-234-0x00000000001A0000-0x00000000001B4000-memory.dmp

                                                                                                      Filesize

                                                                                                      80KB

                                                                                                      Download

                                                                                                    • memory/3488-47-0x0000000000E10000-0x0000000001134000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.1MB

                                                                                                      Download

                                                                                                    • memory/3716-433-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-399-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-377-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-375-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-372-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-379-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-381-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-383-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-395-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-421-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-425-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-423-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-419-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-415-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-413-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-427-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-431-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-429-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-411-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-435-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-409-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-407-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-405-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-403-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-401-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-385-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-391-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-389-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-387-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-393-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-1653-0x00000235292F0000-0x0000023529344000-memory.dmp

                                                                                                      Filesize

                                                                                                      336KB

                                                                                                      Download

                                                                                                    • memory/3716-397-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-417-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-1566-0x0000023510900000-0x000002351094C000-memory.dmp

                                                                                                      Filesize

                                                                                                      304KB

                                                                                                      Download

                                                                                                    • memory/3716-1565-0x00000235296F0000-0x00000235297FE000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      Download

                                                                                                    • memory/3716-370-0x000002350EA40000-0x000002350EC5C000-memory.dmp

                                                                                                      Filesize

                                                                                                      2.1MB

                                                                                                      Download

                                                                                                    • memory/3716-371-0x0000023529450000-0x00000235295EE000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3716-373-0x0000023529450000-0x00000235295E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download

                                                                                                    • memory/3724-133-0x0000000000850000-0x0000000000858000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      Download

                                                                                                    • memory/3724-142-0x0000000005820000-0x0000000005DC6000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.6MB

                                                                                                      Download

                                                                                                    • memory/3724-144-0x0000000005270000-0x0000000005302000-memory.dmp

                                                                                                      Filesize

                                                                                                      584KB

                                                                                                      Download

                                                                                                    • memory/3724-157-0x0000000005360000-0x000000000536A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                      Download

                                                                                                    • memory/4092-1-0x0000000000800000-0x0000000000808000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      Download

                                                                                                    • memory/4092-97-0x00007FFC567D3000-0x00007FFC567D5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      Download

                                                                                                    • memory/4092-5858-0x00007FFC567D0000-0x00007FFC57292000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/4092-0-0x00007FFC567D3000-0x00007FFC567D5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      Download

                                                                                                    • memory/4092-159-0x00007FFC567D0000-0x00007FFC57292000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/4092-2-0x00007FFC567D0000-0x00007FFC57292000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/4420-34-0x000000001C360000-0x000000001C3B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      320KB

                                                                                                      Download

                                                                                                    • memory/4420-35-0x000000001C470000-0x000000001C522000-memory.dmp

                                                                                                      Filesize

                                                                                                      712KB

                                                                                                      Download

                                                                                                    • memory/4600-156-0x0000000000740000-0x0000000000754000-memory.dmp

                                                                                                      Filesize

                                                                                                      80KB

                                                                                                      Download

                                                                                                    • memory/4660-175-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      Download

                                                                                                    • memory/4660-257-0x00000000061E0000-0x00000000061EA000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                      Download

                                                                                                    • memory/4660-259-0x00000000062B0000-0x000000000634C000-memory.dmp

                                                                                                      Filesize

                                                                                                      624KB

                                                                                                      Download

                                                                                                    • memory/4748-5857-0x0000000000400000-0x000000000066D000-memory.dmp

                                                                                                      Filesize

                                                                                                      2.4MB

                                                                                                      Download

                                                                                                    • memory/4748-997-0x0000000000400000-0x000000000066D000-memory.dmp

                                                                                                      Filesize

                                                                                                      2.4MB

                                                                                                      Download

                                                                                                    • memory/4828-199-0x00000000004F0000-0x0000000000508000-memory.dmp

                                                                                                      Filesize

                                                                                                      96KB

                                                                                                      Download

                                                                                                    • memory/4884-271-0x000001F975900000-0x000001F975912000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                      Download

                                                                                                    • memory/4884-96-0x000001F973150000-0x000001F973190000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                      Download

                                                                                                    • memory/4884-173-0x000001F974F60000-0x000001F974F7E000-memory.dmp

                                                                                                      Filesize

                                                                                                      120KB

                                                                                                      Download

                                                                                                    • memory/4884-162-0x000001F975950000-0x000001F9759C6000-memory.dmp

                                                                                                      Filesize

                                                                                                      472KB

                                                                                                      Download

                                                                                                    • memory/4884-270-0x000001F9758D0000-0x000001F9758DA000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                      Download

                                                                                                    • memory/4932-84-0x0000000000340000-0x0000000000350000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                      Download

                                                                                                    • memory/5008-263-0x0000000000130000-0x0000000000142000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                      Download

                                                                                                    • memory/5136-1570-0x0000000002FB0000-0x0000000003012000-memory.dmp

                                                                                                      Filesize

                                                                                                      392KB

                                                                                                      Download

                                                                                                    • memory/5136-1568-0x0000000000CF0000-0x0000000000D46000-memory.dmp

                                                                                                      Filesize

                                                                                                      344KB

                                                                                                      Download

                                                                                                    • memory/5136-1569-0x0000000002E70000-0x0000000002E76000-memory.dmp

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      Download

                                                                                                    • memory/5136-1571-0x0000000005640000-0x0000000005646000-memory.dmp

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      Download

                                                                                                    • memory/5484-1652-0x0000000000400000-0x00000000008B9000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.7MB

                                                                                                      Download

                                                                                                    • memory/5484-5837-0x0000000000400000-0x00000000008B9000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.7MB

                                                                                                      Download

                                                                                                    • memory/5484-1585-0x0000000000400000-0x00000000008B9000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.7MB

                                                                                                      Download

                                                                                                    • memory/5652-2385-0x0000000000400000-0x00000000008BA000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.7MB

                                                                                                      Download

                                                                                                    • memory/5652-5855-0x0000000000400000-0x00000000008BA000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.7MB

                                                                                                      Download

                                                                                                    • memory/5652-1595-0x0000000000400000-0x00000000008BA000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.7MB

                                                                                                      Download

                                                                                                    • memory/5908-4697-0x00007FF681F10000-0x00007FF682B60000-memory.dmp

                                                                                                      Filesize

                                                                                                      12.3MB

                                                                                                      Download

                                                                                                    • memory/5908-1610-0x00007FF681F10000-0x00007FF682B60000-memory.dmp

                                                                                                      Filesize

                                                                                                      12.3MB

                                                                                                      Download