Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

683f0e829e...6c.exe

windows7-x64

8

683f0e829e...6c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/02/2025, 20:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.exe

  • Size

    17.1MB

  • MD5

    4ba81cd6a16ffd3bf5e0e7338df60a5f

  • SHA1

    e92ec4e696661c50d2ccbe05e44d19c413f58d18

  • SHA256

    683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c

  • SHA512

    3113b8c8eb65a3a927c10762d24fd871fa9ca29df2f5121272b6a8e46ec48a8cd1b6957ebfa4bc70084e68f14cf7eeb5f676c7d65672fe0aa0a4865a78c1c26c

  • SSDEEP

    393216:/Fj0IBCLzNxfYrp0ei6EMF9AFulgy8k7JaajjfHnDY5Su:/FXBmNOrpHi6E0Uk7wSnk

Score
10/10
asyncratvenomratdefaultdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationrat

Malware Config

Extracted

Family

asyncrat

Version

v1.2.2

Botnet

Default

C2

27.124.4.150:51311

Mutex

owgonhhweps

Attributes
  • delay

    5

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • VenomRAT 1 IoCs

    Detects VenomRAT.

    rat
  • Venomrat family
    venomrat
  • Async RAT payload 1 IoCs
    rat
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Using powershell.exe command.

    execution
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Enumerates processes with tasklist 1 TTPs 11 IoCs
    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.exe
    "C:\Users\Admin\AppData\Local\Temp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Users\Admin\AppData\Local\Temp\is-DN6EM.tmp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DN6EM.tmp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.tmp" /SL5="$A007C,17513082,161280,C:\Users\Admin\AppData\Local\Temp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.exe
        "C:\Users\Admin\AppData\Local\Temp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.exe" /VERYSILENT
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:572
        • C:\Users\Admin\AppData\Local\Temp\is-RS0E0.tmp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-RS0E0.tmp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.tmp" /SL5="$6025E,17513082,161280,C:\Users\Admin\AppData\Local\Temp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.exe" /VERYSILENT
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3396
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\pHHY_506.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3328
            • C:\Users\Public\Documents\pHHY_506.exe
              C:\Users\Public\Documents\pHHY_506.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3012
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1640
              • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
                7⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                PID:2436
              • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
                7⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                PID:4344
              • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
                7⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                PID:2496
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh advfirewall firewall Delete rule name=lets
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4392
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall Delete rule name=lets
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:1508
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh advfirewall firewall Delete rule name=lets.exe
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4348
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall Delete rule name=lets.exe
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:4900
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4564
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall Delete rule name=LetsPRO.exe
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2388
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2396
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall Delete rule name=LetsPRO
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:4684
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2380
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall Delete rule name=LetsVPN
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2464
              • C:\Program Files (x86)\letsvpn\LetsPRO.exe
                "C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1516
                • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe
                  "C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe" checkNetFramework
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1284
              • C:\Program Files (x86)\letsvpn\LetsPRO.exe
                "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5048
                • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe
                  "C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4780
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /C ipconfig /all
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:3616
                    • C:\Windows\SysWOW64\ipconfig.exe
                      ipconfig /all
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Gathers network information
                      PID:1516
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /C route print
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1072
                    • C:\Windows\SysWOW64\ROUTE.EXE
                      route print
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:1892
                  • C:\Windows\SysWOW64\netsh.exe
                    C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
                    9⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:3016
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /C arp -a
                    9⤵
                    • Network Service Discovery
                    • System Location Discovery: System Language Discovery
                    PID:436
                    • C:\Windows\SysWOW64\ARP.EXE
                      arp -a
                      10⤵
                      • Network Service Discovery
                      • System Location Discovery: System Language Discovery
                      PID:1616
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\ksUu.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4972
            • C:\Users\Public\Documents\ksUu.exe
              C:\Users\Public\Documents\ksUu.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1772
              • C:\Users\Admin\AppData\Local\Temp\is-TQRCJ.tmp\ksUu.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-TQRCJ.tmp\ksUu.tmp" /SL5="$7025E,1610660,141312,C:\Users\Public\Documents\ksUu.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1296
                • C:\Users\Public\Documents\ksUu.exe
                  "C:\Users\Public\Documents\ksUu.exe" /VERYSILENT
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1824
                  • C:\Users\Admin\AppData\Local\Temp\is-8F66E.tmp\ksUu.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-8F66E.tmp\ksUu.tmp" /SL5="$801EC,1610660,141312,C:\Users\Public\Documents\ksUu.exe" /VERYSILENT
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:5064
                    • C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe
                      "C:\Users\Admin\AppData\Roaming\\NVIDIA app\\864\\msedgewebview2.exe"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:4100
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                        11⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5096
                      • C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe
                        "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:2212
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                          12⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1620
                        • C:\Windows\system32\tasklist.exe
                          "tasklist" /FI "IMAGENAME eq regsvr32.exe"
                          12⤵
                          • Enumerates processes with tasklist
                          PID:2220
                        • C:\Windows\system32\regsvr32.exe
                          "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
                          12⤵
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of SetWindowsHookEx
                          PID:4488
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDVENEE5RTctNTUwMS00Njc5LUJGRjUtMTRFMjU2NDk4RjAyfSIgdXNlcmlkPSJ7QjdFNzhBMEQtRDVFMy00MDRDLTgyNkMtN0U0OTcwRDZDNUU2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODc0Nzg3QTEtQ0EzRS00RUIxLTk4OTctNDVBMjM0RTc4QUFDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4NjAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODIxNjMwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTE3NDk0NDA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3692
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6af5f92a-3e03-754e-b4f5-18ea05c196f2}\oemvista.inf" "9" "4d14a44ff" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2220
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000148"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:3456
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:5112
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2976
    • C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe
      "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe"
      1⤵
      • Executes dropped EXE
      PID:2964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3424
      • C:\Windows\system32\tasklist.exe
        "tasklist" /FI "IMAGENAME eq regsvr32.exe"
        2⤵
        • Enumerates processes with tasklist
        PID:4652
      • C:\Windows\system32\regsvr32.exe
        "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
        2⤵
          PID:3136
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2136
        • C:\Windows\system32\tasklist.exe
          "tasklist" /FI "IMAGENAME eq regsvr32.exe"
          2⤵
          • Enumerates processes with tasklist
          PID:4020
        • C:\Windows\system32\regsvr32.exe
          "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
          2⤵
            PID:5040
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2452
          • C:\Windows\system32\tasklist.exe
            "tasklist" /FI "IMAGENAME eq regsvr32.exe"
            2⤵
            • Enumerates processes with tasklist
            PID:4696
          • C:\Windows\system32\regsvr32.exe
            "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
            2⤵
              PID:2480
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2428
            • C:\Windows\system32\tasklist.exe
              "tasklist" /FI "IMAGENAME eq regsvr32.exe"
              2⤵
              • Enumerates processes with tasklist
              PID:3292
            • C:\Windows\system32\regsvr32.exe
              "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
              2⤵
                PID:1768
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1196
              • C:\Windows\system32\tasklist.exe
                "tasklist" /FI "IMAGENAME eq regsvr32.exe"
                2⤵
                • Enumerates processes with tasklist
                PID:3648
              • C:\Windows\system32\regsvr32.exe
                "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
                2⤵
                  PID:4516
              • C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe
                "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe"
                1⤵
                • Executes dropped EXE
                PID:1744
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3708
                • C:\Windows\system32\tasklist.exe
                  "tasklist" /FI "IMAGENAME eq regsvr32.exe"
                  2⤵
                  • Enumerates processes with tasklist
                  PID:516
                • C:\Windows\system32\regsvr32.exe
                  "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
                  2⤵
                    PID:1988
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2436
                  • C:\Windows\system32\tasklist.exe
                    "tasklist" /FI "IMAGENAME eq regsvr32.exe"
                    2⤵
                    • Enumerates processes with tasklist
                    PID:1296
                  • C:\Windows\system32\regsvr32.exe
                    "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
                    2⤵
                      PID:4584
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:1072
                    • C:\Windows\system32\tasklist.exe
                      "tasklist" /FI "IMAGENAME eq regsvr32.exe"
                      2⤵
                      • Enumerates processes with tasklist
                      PID:3512
                    • C:\Windows\system32\regsvr32.exe
                      "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
                      2⤵
                        PID:3964
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:2552
                      • C:\Windows\system32\tasklist.exe
                        "tasklist" /FI "IMAGENAME eq regsvr32.exe"
                        2⤵
                        • Enumerates processes with tasklist
                        PID:2452
                      • C:\Windows\system32\regsvr32.exe
                        "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
                        2⤵
                          PID:5060
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{69A0DE0B-0647-467A-BA31-E1878E3C76B8}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4484
                        • C:\Windows\system32\tasklist.exe
                          "tasklist" /FI "IMAGENAME eq regsvr32.exe"
                          2⤵
                          • Enumerates processes with tasklist
                          PID:1884
                        • C:\Windows\system32\regsvr32.exe
                          "regsvr32" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll"
                          2⤵
                            PID:2912

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        2
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Event Triggered Execution

                        1
                        T1546

                        Netsh Helper DLL

                        1
                        T1546.007

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Event Triggered Execution

                        1
                        T1546

                        Netsh Helper DLL

                        1
                        T1546.007

                        Defense Evasion

                        Impair Defenses

                        1
                        T1562

                        Disable or Modify System Firewall

                        1
                        T1562.004

                        Modify Registry

                        2
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Credential Access

                        Discovery

                        Network Service Discovery

                        1
                        T1046

                        Peripheral Device Discovery

                        1
                        T1120

                        Process Discovery

                        1
                        T1057

                        Query Registry

                        4
                        T1012

                        System Information Discovery

                        5
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        System Network Configuration Discovery

                        1
                        T1016

                        Internet Connection Discovery

                        1
                        T1016.001

                        Lateral Movement

                        Collection

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
                          Filesize

                          318B

                          MD5

                          b34636a4e04de02d079ba7325e7565f0

                          SHA1

                          f32c1211eac22409bb195415cb5a8063431f75cd

                          SHA256

                          a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

                          SHA512

                          6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

                          Download Submit

                        • C:\Program Files (x86)\letsvpn\LetsPRO.exe
                          Filesize

                          242KB

                          MD5

                          3530cb1b45ff13ba4456e4ffbcae6379

                          SHA1

                          5be7b8e19418212a5a93e900c12830facfd6ba54

                          SHA256

                          e0669b6312baaef6a3c86f3142b333eab48494511405398bb09cc464881a43c9

                          SHA512

                          23baae23815fc946203be6d93cef84ff23fde8ed88017179c65b7de1f3b6114bc8343c277b8ae5a1d85aa59f25b5f146c1d827b7e4617bfd0aa0ff20359f49b5

                          Download Submit

                        • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe
                          Filesize

                          1.5MB

                          MD5

                          56162a01d3de7cb90eb9a2222c6b8f24

                          SHA1

                          c4c10199b5f7d50d641d115f9d049832ec836785

                          SHA256

                          a41077ed210d8d454d627d15663b7523c33e6f7386cd920a56fbcfbb0a37547d

                          SHA512

                          23c4aac046ffdecaa64acbee9579634c419202be43463927dfabf9798ded17b1b7a1199f1db54e247d28d82f39f3f352ac3acbade2118c67717fd37260bd8b4f

                          Download Submit

                        • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe.config
                          Filesize

                          26KB

                          MD5

                          11752aa56f176fbbbf36420ec8db613a

                          SHA1

                          0affc2837cee71750450911d11968e0692947f13

                          SHA256

                          d66328eb01118a727e919b52318562094f2ff593bd33e5d3aab5e73602388dfa

                          SHA512

                          ed78045e4b6b85a1a0557c2ccd85a27e90defc48e50d2833d3d8d23526dc8d1040a64e883cb42aea3052d499ea4c95e775384ae710b1222191ead6f8b0e0b560

                          Download Submit

                        • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsVPNDomainModel.dll
                          Filesize

                          22KB

                          MD5

                          4fb031cb8840ee01cb6aa90696557143

                          SHA1

                          b009c8c975929b73dd977969e6816066d57f39c6

                          SHA256

                          64b09932ef5b25f5c2c185fe955c7784ab23cdf7d12fdad77fe05947e20006ba

                          SHA512

                          03731c0f6423f2fa3d6710b86c7cc41aa970058b818ab724321040984841dc451109638c813d564cb89dd00af3962e84811aed5a3b37ae9a1b9c1febeb85ae60

                          Download Submit

                        • C:\Program Files (x86)\letsvpn\app-3.12.0\Utils.dll
                          Filesize

                          127KB

                          MD5

                          0e444739d07678a3f6ea4202c4237832

                          SHA1

                          0689c9cdad379b4b0952674a7bf75a5a1f2f33a9

                          SHA256

                          a3aab8ca7b0747242207d1223e241e602b45ba69f25ba5b611a12eeacd19ec1a

                          SHA512

                          85f6d4920d93f8ee2bb7a384424c9eea25cc5591bf7a7301bdc31170944549b3860a90c5694f194ee0f9cd85f0ea053e89039f95ff806b735e526d583ee7e0bf

                          Download Submit

                        • C:\Program Files (x86)\letsvpn\app-3.12.0\log4net.dll
                          Filesize

                          275KB

                          MD5

                          c5098ff401b766e6e554499d37d0b716

                          SHA1

                          fd4c3df050ec2b30740e2d62b27a9e375401f190

                          SHA256

                          b015c62c09b4033d0a4caae36f3a9804a8cee2549145e199ada5a9bf51095e0d

                          SHA512

                          04f3261ed8d59e5e8455d868cb7ceef97466fb4fc57a98544024f53c4ba9d935e9441169f0705877cf3578f2ef4fc1b54921e9e15ecc70003c67452ae1393f01

                          Download Submit

                        • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
                          Filesize

                          7KB

                          MD5

                          26009f092ba352c1a64322268b47e0e3

                          SHA1

                          e1b2220cd8dcaef6f7411a527705bd90a5922099

                          SHA256

                          150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

                          SHA512

                          c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

                          Download Submit

                        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                          Filesize

                          99KB

                          MD5

                          1e3cf83b17891aee98c3e30012f0b034

                          SHA1

                          824f299e8efd95beca7dd531a1067bfd5f03b646

                          SHA256

                          9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

                          SHA512

                          fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                          Filesize

                          3KB

                          MD5

                          fee026663fcb662152188784794028ee

                          SHA1

                          3c02a26a9cb16648fad85c6477b68ced3cb0cb45

                          SHA256

                          dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

                          SHA512

                          7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          Filesize

                          1KB

                          MD5

                          fc35bf2367ee5c6feb084ab39f5c26eb

                          SHA1

                          cd9742c05391a92780a81fe836797a5909c7f9c1

                          SHA256

                          7ad08f1c2e7df4102eb3a6d213f4a0c245300c275fd53e463655a8ab9fa3ec64

                          SHA512

                          0b6662ea93907902c9f5db98bed4e9d322a69e7b8df921f6b8bd8026fdbfa556b0afe29013e3ecc8982a6339c48b4fe371ba587f02c39de72cb3840ed0e6747b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          Filesize

                          1KB

                          MD5

                          862a8f3822debcaab6263a759963a5ea

                          SHA1

                          7d9d09fb07f7d9532207f8aadf3f36ed59b5dc43

                          SHA256

                          68680affea909fcbd1a71d451469a0d34c7b1e757625dd8b9605adb479fa1b2d

                          SHA512

                          c0e04c9ab1d9a5241b49d4353db3bd725b79dc39d54083c924a64251cc2587b477f71b65395a86fb836783a2ec002a9419f9bc47c9528f7ba16f88f7a9ddd383

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gtgtwpd.ry3.ps1
                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\is-BASDV.tmp\_isetup\_isdecmp.dll
                          Filesize

                          13KB

                          MD5

                          a813d18268affd4763dde940246dc7e5

                          SHA1

                          c7366e1fd925c17cc6068001bd38eaef5b42852f

                          SHA256

                          e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

                          SHA512

                          b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\is-DN6EM.tmp\683f0e829eeb0860f19ac325bb399d4bb4837d9c011ac018fee6118490a1666c.tmp
                          Filesize

                          1.1MB

                          MD5

                          070f66d3e84cd5ecccbb772fcf8e7811

                          SHA1

                          bc9c66bbe77da53a8d57ad9e41fd92936e892937

                          SHA256

                          b61184c727ecfeed0d77a237872ba282a544e15cfc54c28f420f06a5abea55db

                          SHA512

                          aa0803ae82c115b28e5965b1c3387580b833330db03fe69778d1f5680948bb5369d48336ed2e016a279ddfd239a39ea17922e66a017858f128d9f4aa4a9bbdcf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\is-TQRCJ.tmp\ksUu.tmp
                          Filesize

                          1.1MB

                          MD5

                          8fdc58c7d4c59472615682d6dea9d190

                          SHA1

                          8e131fe09fd238493719b4fd92e6c833bf3596c1

                          SHA256

                          26a5be637ee680b1ec11d1adf2fd0972cc52078cbd200d9273f8bb826707c83b

                          SHA512

                          b05b9fd8ff3d627b562cbd2968466fb54adbc2fa5591ebe803300a3c5ef7887bc1761d8013b47aab0f5387265c8b7b15078a01abb75d4c3180671780181ebe24

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\is-UQU0E.tmp\_isetup\_shfoldr.dll
                          Filesize

                          22KB

                          MD5

                          92dc6ef532fbb4a5c3201469a5b5eb63

                          SHA1

                          3e89ff837147c16b4e41c30d6c796374e0b8e62c

                          SHA256

                          9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                          SHA512

                          9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\nsw9665.tmp\System.dll
                          Filesize

                          12KB

                          MD5

                          192639861e3dc2dc5c08bb8f8c7260d5

                          SHA1

                          58d30e460609e22fa0098bc27d928b689ef9af78

                          SHA256

                          23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

                          SHA512

                          6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\nsw9665.tmp\modern-wizard.bmp
                          Filesize

                          51KB

                          MD5

                          7f8e1969b0874c8fb9ab44fc36575380

                          SHA1

                          3057c9ce90a23d29f7d0854472f9f44e87b0f09a

                          SHA256

                          076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

                          SHA512

                          7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\nsw9665.tmp\nsDialogs.dll
                          Filesize

                          9KB

                          MD5

                          b7d61f3f56abf7b7ff0d4e7da3ad783d

                          SHA1

                          15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

                          SHA256

                          89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

                          SHA512

                          6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\nsw9665.tmp\nsExec.dll
                          Filesize

                          7KB

                          MD5

                          11092c1d3fbb449a60695c44f9f3d183

                          SHA1

                          b89d614755f2e943df4d510d87a7fc1a3bcf5a33

                          SHA256

                          2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

                          SHA512

                          c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\nsw9665.tmp\nsProcess.dll
                          Filesize

                          4KB

                          MD5

                          f0438a894f3a7e01a4aae8d1b5dd0289

                          SHA1

                          b058e3fcfb7b550041da16bf10d8837024c38bf6

                          SHA256

                          30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                          SHA512

                          f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\unins000.dat
                          Filesize

                          3KB

                          MD5

                          44b24b72e392824c526f4243e3c0da49

                          SHA1

                          fea687c3139cda5fd4e1a336b033fc6f4f4f9804

                          SHA256

                          51a03b4d95529bb5adcf10f565821eebc7c6311d3b4f22ab50c42ab2dd144c3e

                          SHA512

                          2e6c2014b84cbdb5424293887aeac2589cd1e9941242445d770c7d7b0a06966c9555e55119ab7a63f834fa5e8220358f711d19e072b5adff748fe76db10441c9

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedge_elf.dll
                          Filesize

                          792KB

                          MD5

                          49b060366422b6af60958aeb35f1eb06

                          SHA1

                          50240c19542c8a61507d169757ed91a4e801f2f5

                          SHA256

                          589715ba10dcb4ff605571fb03e3d6fd79214e659868aa36512a0bde3214283d

                          SHA512

                          f6ef75a3568aad0d302c1804acf9157ef95906b84e4e75b1f5955912eba30ecf2f7aa80600f9b9754dfc4b6f015a2607a70ad16ae80fbdea4d0ea09173c60233

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\NVIDIA app\864\msedgewebview2.exe
                          Filesize

                          3.2MB

                          MD5

                          71fdf2d301949413f8b14e0f12c2e0f5

                          SHA1

                          c57e8eff6bfc0be6420e97cfd6de895c937fd5b7

                          SHA256

                          1e7e2c05c6c634aa7f11c8c217bf9c21fbe336f128d744fbaf3fc91d643925a0

                          SHA512

                          752fe30b893a1e0a0fbd93fb91dceea2b88f5e1c067e8f780fbedcf1fd4a11ec1317d65bbc3c11086926a2d37a49e5f519c40f7d65dba335079dc2044dd53f58

                          Download Submit

                        • C:\Users\Public\Documents\ksUu.exe
                          Filesize

                          1.9MB

                          MD5

                          1f2be558a74cb83afab86147e70d87d6

                          SHA1

                          67aa1ef5fca4e3e720feb6080d0f1ac20b503b26

                          SHA256

                          4ce381358bde90843640ac7cc0d59f4c4066adf1f26db2e6ba4130e9f72b6af8

                          SHA512

                          5f8af4ea3bd3a5078b91d086ef1d4d1a9d88f2065621eb76ce21573e02144deab5f6e33d65a0525caff1387e5bbfa1ea4bb3f288e60045efcf7a82d5f57e87a9

                          Download Submit

                        • C:\Users\Public\Documents\pHHY_506.exe
                          Filesize

                          14.8MB

                          MD5

                          9f5f358aa1a85d222ad967f4538bc753

                          SHA1

                          567404faec3641f4df889c2c92164cee92723741

                          SHA256

                          eb11627e59757105bddb884540854d56b173fe42417878de4e7d246cac92c932

                          SHA512

                          d5a4c4b343704b96c98183d13d90e37065c8be0d0ed053696fb28b5e29f1432175d5e9f63c2d2879c3eb3541e4822a64ae7bfa2230c0c00b5c3ada0a1ac82bed

                          Download Submit

                        • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
                          Filesize

                          38KB

                          MD5

                          c10ccdec5d7af458e726a51bb3cdc732

                          SHA1

                          0553aab8c2106abb4120353360d747b0a2b4c94f

                          SHA256

                          589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

                          SHA512

                          7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

                          Download Submit

                        • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
                          Filesize

                          10KB

                          MD5

                          f73ac62e8df97faf3fc8d83e7f71bf3f

                          SHA1

                          619a6e8f7a9803a4c71f73060649903606beaf4e

                          SHA256

                          cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

                          SHA512

                          f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

                          Download Submit

                        • memory/572-53-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/572-21-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/572-23-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/1072-1100-0x0000028F27AB0000-0x0000028F27B65000-memory.dmp

                          Filesize

                          724KB

                          Download

                        • memory/1196-25-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1196-7-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1284-760-0x0000000005C10000-0x0000000005C56000-memory.dmp

                          Filesize

                          280KB

                          Download

                        • memory/1284-769-0x0000000006A90000-0x0000000006FBC000-memory.dmp

                          Filesize

                          5.2MB

                          Download

                        • memory/1284-762-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/1284-763-0x0000000005EA0000-0x0000000005F52000-memory.dmp

                          Filesize

                          712KB

                          Download

                        • memory/1284-752-0x0000000000D30000-0x0000000000EB8000-memory.dmp

                          Filesize

                          1.5MB

                          Download

                        • memory/1284-764-0x0000000005F90000-0x00000000062E4000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/1284-756-0x00000000057D0000-0x00000000057F4000-memory.dmp

                          Filesize

                          144KB

                          Download

                        • memory/1296-89-0x0000000000400000-0x0000000000528000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1640-600-0x0000000005060000-0x0000000005688000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/1640-602-0x0000000004FA0000-0x0000000005006000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/1640-616-0x0000000005D00000-0x0000000005D4C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/1640-613-0x00000000058E0000-0x0000000005C34000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/1640-618-0x00000000062A0000-0x00000000062D2000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/1640-619-0x000000006F870000-0x000000006F8BC000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/1640-629-0x00000000062E0000-0x00000000062FE000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/1640-630-0x0000000006ED0000-0x0000000006F73000-memory.dmp

                          Filesize

                          652KB

                          Download

                        • memory/1640-631-0x00000000076A0000-0x0000000007D1A000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/1640-632-0x0000000006FF0000-0x000000000700A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/1640-633-0x0000000007060000-0x000000000706A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/1640-634-0x0000000007290000-0x0000000007326000-memory.dmp

                          Filesize

                          600KB

                          Download

                        • memory/1640-635-0x00000000071F0000-0x0000000007201000-memory.dmp

                          Filesize

                          68KB

                          Download

                        • memory/1640-636-0x0000000007230000-0x000000000723E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1640-637-0x0000000007240000-0x0000000007254000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/1640-638-0x0000000007330000-0x000000000734A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/1640-639-0x0000000007270000-0x0000000007278000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/1640-615-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/1640-603-0x0000000005690000-0x00000000056F6000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/1640-601-0x0000000004E00000-0x0000000004E22000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/1640-599-0x00000000023E0000-0x0000000002416000-memory.dmp

                          Filesize

                          216KB

                          Download

                        • memory/1772-91-0x0000000000400000-0x000000000042D000-memory.dmp

                          Filesize

                          180KB

                          Download

                        • memory/1772-57-0x0000000000400000-0x000000000042D000-memory.dmp

                          Filesize

                          180KB

                          Download

                        • memory/1824-82-0x0000000000400000-0x000000000042D000-memory.dmp

                          Filesize

                          180KB

                          Download

                        • memory/1824-116-0x0000000000400000-0x000000000042D000-memory.dmp

                          Filesize

                          180KB

                          Download

                        • memory/2212-153-0x00007FFCDFFE0000-0x00007FFCE0089000-memory.dmp

                          Filesize

                          676KB

                          Download

                        • memory/2436-1077-0x0000017559BA0000-0x0000017559C55000-memory.dmp

                          Filesize

                          724KB

                          Download

                        • memory/2964-1004-0x00007FFCDFFE0000-0x00007FFCE0089000-memory.dmp

                          Filesize

                          676KB

                          Download

                        • memory/3396-51-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/3396-30-0x0000000000400000-0x000000000052D000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/3424-914-0x00000201E9070000-0x00000201E907A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/3424-915-0x00000201E91E0000-0x00000201E91FC000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/3424-911-0x00000201E8D80000-0x00000201E8D9C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/3424-913-0x00000201E8FB0000-0x00000201E9065000-memory.dmp

                          Filesize

                          724KB

                          Download

                        • memory/3708-1054-0x000001D0F4F80000-0x000001D0F5035000-memory.dmp

                          Filesize

                          724KB

                          Download

                        • memory/4100-152-0x00007FFCDFFE0000-0x00007FFCE0089000-memory.dmp

                          Filesize

                          676KB

                          Download

                        • memory/4488-154-0x00007FFCDFFE0000-0x00007FFCE0089000-memory.dmp

                          Filesize

                          676KB

                          Download

                        • memory/4488-150-0x0000000002160000-0x0000000002172000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/4556-0-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/4556-26-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/4556-2-0x0000000000401000-0x0000000000417000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/4780-861-0x000000003E3C0000-0x000000003E3D1000-memory.dmp

                          Filesize

                          68KB

                          Download

                        • memory/4780-1022-0x000000006B9C0000-0x000000006C180000-memory.dmp

                          Filesize

                          7.8MB

                          Download

                        • memory/4780-797-0x0000000006240000-0x000000000624C000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/4780-798-0x000000002FD60000-0x000000002FD6A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/4780-800-0x000000002FD80000-0x000000002FD90000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/4780-799-0x000000002FDB0000-0x000000002FDD6000-memory.dmp

                          Filesize

                          152KB

                          Download

                        • memory/4780-815-0x00000000397E0000-0x0000000039872000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/4780-816-0x000000003B100000-0x000000003B108000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/4780-819-0x000000003B160000-0x000000003B16E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/4780-818-0x000000003B180000-0x000000003B1B8000-memory.dmp

                          Filesize

                          224KB

                          Download

                        • memory/4780-820-0x000000003C7B0000-0x000000003C7C2000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/4780-824-0x000000003C2E0000-0x000000003C2FE000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/4780-827-0x0000000039990000-0x00000000399A0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/4780-828-0x00000000399C0000-0x00000000399D6000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/4780-829-0x00000000399A0000-0x00000000399B0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/4780-839-0x000000003EB80000-0x000000003F124000-memory.dmp

                          Filesize

                          5.6MB

                          Download

                        • memory/4780-843-0x000000003C8C0000-0x000000003C90A000-memory.dmp

                          Filesize

                          296KB

                          Download

                        • memory/4780-848-0x000000003C910000-0x000000003C924000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/4780-849-0x000000003C880000-0x000000003C888000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/4780-847-0x000000003C890000-0x000000003C8A2000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/4780-846-0x00000000303E0000-0x00000000303E8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/4780-850-0x000000003D740000-0x000000003D78C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/4780-860-0x000000003E2B0000-0x000000003E353000-memory.dmp

                          Filesize

                          652KB

                          Download

                        • memory/4780-790-0x0000000006040000-0x0000000006062000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/4780-796-0x0000000006230000-0x000000000623A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/4780-862-0x000000003FD40000-0x000000003FDB6000-memory.dmp

                          Filesize

                          472KB

                          Download

                        • memory/4780-794-0x0000000006260000-0x0000000006286000-memory.dmp

                          Filesize

                          152KB

                          Download

                        • memory/4780-871-0x000000006B9C0000-0x000000006C180000-memory.dmp

                          Filesize

                          7.8MB

                          Download

                        • memory/4780-881-0x000000003D4F0000-0x000000003D522000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/4780-885-0x000000006B9C0000-0x000000006C180000-memory.dmp

                          Filesize

                          7.8MB

                          Download

                        • memory/4780-884-0x000000006CF10000-0x000000006D978000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/4780-891-0x000000006B9C0000-0x000000006C180000-memory.dmp

                          Filesize

                          7.8MB

                          Download

                        • memory/4780-890-0x000000006CF10000-0x000000006D978000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/4780-789-0x00000000057C0000-0x0000000005B14000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/4780-795-0x0000000006210000-0x0000000006218000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/4780-870-0x000000006CF10000-0x000000006D978000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/4780-793-0x0000000006220000-0x000000000622A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/4780-791-0x00000000061D0000-0x00000000061EE000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/4780-1006-0x000000006B9C0000-0x000000006C180000-memory.dmp

                          Filesize

                          7.8MB

                          Download

                        • memory/4780-1005-0x000000006CF10000-0x000000006D978000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/4780-1010-0x000000006CF10000-0x000000006D978000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/4780-1011-0x000000006B9C0000-0x000000006C180000-memory.dmp

                          Filesize

                          7.8MB

                          Download

                        • memory/4780-1017-0x000000006B9C0000-0x000000006C180000-memory.dmp

                          Filesize

                          7.8MB

                          Download

                        • memory/4780-1016-0x000000006CF10000-0x000000006D978000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/4780-865-0x0000000040A20000-0x0000000040BA6000-memory.dmp

                          Filesize

                          1.5MB

                          Download

                        • memory/4780-1021-0x000000006CF10000-0x000000006D978000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/4780-1029-0x000000006B9C0000-0x000000006C180000-memory.dmp

                          Filesize

                          7.8MB

                          Download

                        • memory/4780-1028-0x000000006CF10000-0x000000006D978000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/4780-792-0x00000000061F0000-0x000000000620A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/5064-115-0x0000000000400000-0x0000000000528000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/5096-122-0x000001D3E9680000-0x000001D3E96A2000-memory.dmp

                          Filesize

                          136KB

                          Download