Overview

overview

10

Static

static

3

random.exe

windows7-x64

10

random.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2025, 15:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    random.exe
  • Size 1.8MB
  • Sample250307-s5dv3asrt3
  • SHA256 ea01f9a6f6683f4ea8248176a8b741e2be63c216c92cee15bc156e76a8760599
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyasyncratlummastealcstormkitty092155traff1credential_accessdefense_evasiondiscoveryexecutionpyinstallerratspywarestealertrojanupx

Malware Config

Extracted

Family

  • amadey

Version

  • 5.21

Botnet

  • 092155

C2

  • http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://fostinjec.today/api

  • https://begindecafer.world/api

  • https://garagedrootz.top/api

  • https://modelshiverd.icu/api

  • https://arisechairedd.shop/api

  • https://6catterjur.run/api

  • https://orangemyther.live/api

  • https://sterpickced.digital/api

Extracted

Family

  • stealc

Botnet

  • traff1

Attributes
  • url_path

    /gtthfbsb2h.php

Extracted

Family

  • lumma

C2

  • https://techspherxe.top/api

  • https://agroecologyguide.digital/api

  • https://codxefusion.top/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 18 IoCs
  • Uses browser remote debugging 2 TTPs 10 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 26 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 39 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 10 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\random.exe
        "C:\Users\Admin\AppData\Local\Temp\random.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
          "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Downloads MZ/PE file
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1152
          • C:\Users\Admin\AppData\Local\Temp\10111840101\HmngBpR.exe
            "C:\Users\Admin\AppData\Local\Temp\10111840101\HmngBpR.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1648
            • C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\SplashWin.exe
              C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\SplashWin.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4844
              • C:\Users\Admin\AppData\Roaming\Dockerprotectysd\SplashWin.exe
                C:\Users\Admin\AppData\Roaming\Dockerprotectysd\SplashWin.exe
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:4948
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\SysWOW64\cmd.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:636
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    PID:2644
          • C:\Users\Admin\AppData\Local\Temp\10112790101\ADFoyxP.exe
            "C:\Users\Admin\AppData\Local\Temp\10112790101\ADFoyxP.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2104
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c expand Go.pub Go.pub.bat & Go.pub.bat
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3060
              • C:\Windows\SysWOW64\expand.exe
                expand Go.pub Go.pub.bat
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4212
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3936
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "opssvc wrsa"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1124
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4816
              • C:\Windows\SysWOW64\findstr.exe
                findstr "bdservicehost AvastUI AVGUI nsWscSvc ekrn SophosHealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4384
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 353090
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4808
              • C:\Windows\SysWOW64\extrac32.exe
                extrac32 /Y /E Really.pub
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4832
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "posted" Good
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1904
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b 353090\Seat.com + Pf + Somewhere + Volumes + Commission + Lane + Hit + Strong + Copied + Wearing + Acquire 353090\Seat.com
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3320
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Maintains.pub + ..\Legislation.pub + ..\Blood.pub + ..\Document.pub + ..\Breaks.pub + ..\Both.pub + ..\Explicitly.pub + ..\Governor.pub + ..\Bull.pub + ..\Comparison.pub + ..\Performing.pub + ..\Gate.pub + ..\Republican.pub + ..\Reverse.pub + ..\Thousand.pub + ..\Apartments.pub + ..\Swingers.pub + ..\Urban.pub + ..\Robert.pub + ..\Regulation.pub + ..\Confusion.pub + ..\Listening.pub + ..\Generating.pub + ..\Argentina.pub + ..\Amenities.pub + ..\Vacation.pub + ..\Vampire.pub + ..\Trademarks.pub + ..\Distinguished.pub + ..\Silly.pub + ..\Hell.pub + ..\Worcester.pub + ..\Concept.pub + ..\Enlarge.pub + ..\Preference.pub + ..\Poem.pub m
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4792
              • C:\Users\Admin\AppData\Local\Temp\353090\Seat.com
                Seat.com m
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3304
                • C:\Users\Admin\AppData\Local\Temp\353090\RegAsm.exe
                  C:\Users\Admin\AppData\Local\Temp\353090\RegAsm.exe
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2276
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1436
                    8⤵
                    • Program crash
                    PID:5808
                • C:\Users\Admin\AppData\Local\Temp\353090\RegAsm.exe
                  C:\Users\Admin\AppData\Local\Temp\353090\RegAsm.exe
                  7⤵
                    PID:5688
                • C:\Windows\SysWOW64\choice.exe
                  choice /d y /t 5
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3900
            • C:\Users\Admin\AppData\Local\Temp\10114440101\9hUDDVk.exe
              "C:\Users\Admin\AppData\Local\Temp\10114440101\9hUDDVk.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5052
            • C:\Users\Admin\AppData\Local\Temp\10114630101\pwHxMTy.exe
              "C:\Users\Admin\AppData\Local\Temp\10114630101\pwHxMTy.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2432
              • C:\Users\Admin\AppData\Local\Temp\10114630101\pwHxMTy.exe
                "C:\Users\Admin\AppData\Local\Temp\10114630101\pwHxMTy.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3244
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 772
                5⤵
                • Program crash
                PID:3712
            • C:\Users\Admin\AppData\Local\Temp\10115790101\T0QdO0l.exe
              "C:\Users\Admin\AppData\Local\Temp\10115790101\T0QdO0l.exe"
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4964
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\10119590141\ogfNbjS.ps1"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2432
            • C:\Users\Admin\AppData\Local\Temp\10121660101\amnew.exe
              "C:\Users\Admin\AppData\Local\Temp\10121660101\amnew.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4872
              • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                5⤵
                • Downloads MZ/PE file
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1856
                • C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
                  "C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:5240
                  • C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
                    "C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:6012
                • C:\Users\Admin\AppData\Local\Temp\10001960101\cronikxqqq.exe
                  "C:\Users\Admin\AppData\Local\Temp\10001960101\cronikxqqq.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5140
                  • C:\Users\Admin\AppData\Local\Temp\10001960101\cronikxqqq.exe
                    "C:\Users\Admin\AppData\Local\Temp\10001960101\cronikxqqq.exe"
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:5576
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 812
                    7⤵
                    • Program crash
                    PID:404
            • C:\Users\Admin\AppData\Local\Temp\10122730101\bncn6rv.exe
              "C:\Users\Admin\AppData\Local\Temp\10122730101\bncn6rv.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:5316
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                5⤵
                • Uses browser remote debugging
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:4260
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd28c8cc40,0x7ffd28c8cc4c,0x7ffd28c8cc58
                  6⤵
                    PID:3144
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1864 /prefetch:2
                    6⤵
                      PID:2044
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1888,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2028 /prefetch:3
                      6⤵
                        PID:5212
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2264 /prefetch:8
                        6⤵
                          PID:5796
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3192 /prefetch:1
                          6⤵
                          • Uses browser remote debugging
                          PID:5980
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3240 /prefetch:1
                          6⤵
                          • Uses browser remote debugging
                          PID:1396
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3632,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4528 /prefetch:1
                          6⤵
                          • Uses browser remote debugging
                          PID:5736
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4696,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4712 /prefetch:8
                          6⤵
                            PID:4484
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4468,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4684 /prefetch:8
                            6⤵
                              PID:2472
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4744,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3628 /prefetch:8
                              6⤵
                                PID:5452
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4920 /prefetch:8
                                6⤵
                                  PID:924
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4792,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5040 /prefetch:8
                                  6⤵
                                    PID:5808
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5264,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5272 /prefetch:8
                                    6⤵
                                      PID:2276
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5140,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5132 /prefetch:8
                                      6⤵
                                        PID:2072
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4996,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5148 /prefetch:8
                                        6⤵
                                          PID:5820
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5320,i,3573762824169474626,6833022349805471320,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5288 /prefetch:2
                                          6⤵
                                          • Uses browser remote debugging
                                          PID:4252
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                                        5⤵
                                        • Uses browser remote debugging
                                        • Enumerates system info in registry
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        PID:6112
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffd28c946f8,0x7ffd28c94708,0x7ffd28c94718
                                          6⤵
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          PID:2904
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17961604570782891519,9301403051777422541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                                          6⤵
                                            PID:5768
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17961604570782891519,9301403051777422541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                                            6⤵
                                              PID:5352
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17961604570782891519,9301403051777422541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
                                              6⤵
                                                PID:5364
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2080,17961604570782891519,9301403051777422541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                                6⤵
                                                • Uses browser remote debugging
                                                PID:5888
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2080,17961604570782891519,9301403051777422541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                                                6⤵
                                                • Uses browser remote debugging
                                                PID:3768
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2080,17961604570782891519,9301403051777422541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
                                                6⤵
                                                • Uses browser remote debugging
                                                PID:5836
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2080,17961604570782891519,9301403051777422541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
                                                6⤵
                                                • Uses browser remote debugging
                                                PID:5956
                                          • C:\Users\Admin\AppData\Local\Temp\10123540101\packed.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10123540101\packed.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Enumerates system info in registry
                                            PID:3956
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\runtime'"
                                              5⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5884
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks.exe /create /tn "COM Surrogate Task" /tr "C:\Program Files\runtime\COM Surrogate.exe" /sc onlogon /rl HIGHEST /f
                                              5⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5808
                                            • C:\Program Files\runtime\COM Surrogate.exe
                                              "C:\Program Files\runtime\COM Surrogate.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Modifies system certificate store
                                              PID:5660
                                          • C:\Users\Admin\AppData\Local\Temp\10123850101\PQkVDtx.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10123850101\PQkVDtx.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Enumerates system info in registry
                                            PID:904
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\runtime'"
                                              5⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5088
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10124111121\skf7iF4.cmd"
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5396
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\10124111121\skf7iF4.cmd' -ArgumentList 'sgcCUaUFtA' -WindowStyle Hidden -Verb RunAs"
                                              5⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3552
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10124111121\skf7iF4.cmd" sgcCUaUFtA
                                                6⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5940
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell.exe "if ((Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model | findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse | Where-Object { -not $_.PSIsContainer } | Measure-Object).Count)) {exit 900} else {exit 1}"
                                                  7⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2608
                                                  • C:\Windows\SysWOW64\findstr.exe
                                                    "C:\Windows\system32\findstr.exe" /i WDS100T2B0A
                                                    8⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3936
                                          • C:\Users\Admin\AppData\Local\Temp\10124820101\yUI6F6C.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10124820101\yUI6F6C.exe"
                                            4⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            PID:5304
                                          • C:\Users\Admin\AppData\Local\Temp\10124840101\CgmaT61.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10124840101\CgmaT61.exe"
                                            4⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • System Location Discovery: System Language Discovery
                                            PID:5656
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c schtasks.exe /create /tn "Coast" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js'" /sc minute /mo 5 /F
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4780
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks.exe /create /tn "Coast" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js'" /sc minute /mo 5 /F
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4288
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & echo URL="C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & exit
                                        2⤵
                                        • Drops startup file
                                        • System Location Discovery: System Language Discovery
                                        PID:2688
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2072
                                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2204
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2432 -ip 2432
                                      1⤵
                                        PID:1392
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2276 -ip 2276
                                        1⤵
                                          PID:5044
                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                          1⤵
                                            PID:5848
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                            1⤵
                                              PID:3796
                                            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                              C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                              1⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              PID:2160
                                            • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                              C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:4936
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5140 -ip 5140
                                              1⤵
                                                PID:4496

                                              Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Command and Scripting Interpreter

                                                    1
                                                    T1059

                                                    PowerShell

                                                    1
                                                    T1059.001

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Persistence

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Privilege Escalation

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Defense Evasion

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Modify Registry

                                                    1
                                                    T1112

                                                    Subvert Trust Controls

                                                    1
                                                    T1553

                                                    Install Root Certificate

                                                    1
                                                    T1553.004

                                                    Virtualization/Sandbox Evasion

                                                    2
                                                    T1497

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Steal Web Session Cookie

                                                    1
                                                    T1539

                                                    Unsecured Credentials

                                                    5
                                                    T1552

                                                    Credentials In Files

                                                    5
                                                    T1552.001

                                                    Discovery

                                                    Browser Information Discovery

                                                    1
                                                    T1217

                                                    Process Discovery

                                                    1
                                                    T1057

                                                    Query Registry

                                                    8
                                                    T1012

                                                    System Information Discovery

                                                    5
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    Virtualization/Sandbox Evasion

                                                    2
                                                    T1497

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    4
                                                    T1005

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    mozglue.dll
                                                    • Path C:\ProgramData\mozglue.dll
                                                    • Size 593KB
                                                    • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    BrowsingTopicsState
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                    • Size 649B
                                                    • SHA256 e23c42a71c816a371edeaaa8978450b87ecceb38f9b3e8ce21baeaae9fb21752
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    messages.json
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json
                                                    • Size 851B
                                                    • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    dasherSettingSchema.json
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json
                                                    • Size 854B
                                                    • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 152B
                                                    • SHA256 ac0ff4d0e002d553021c6b0fc324efa915ce2d5ef2d1691de247e9929fa29b00
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 152B
                                                    • SHA256 b0fdea5fbcfa795d8165445dc5bae9837ba12c93e6a27bae8888d1585944a745
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    5b0ccd97-f08e-4cf7-91cf-8a45448e03fe.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b0ccd97-f08e-4cf7-91cf-8a45448e03fe.tmp
                                                    • Size 5KB
                                                    • SHA256 16ccab29d720b9e0d03de59c83cef1236e2f70ae6a1d741bf0bf16333aa7077d
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    bc02f7ec-5a5e-4b48-810c-4528e5aeca24.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc02f7ec-5a5e-4b48-810c-4528e5aeca24.tmp
                                                    • Size 1B
                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    trano1221.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
                                                    • Size 19.4MB
                                                    • SHA256 1be1102a35feb821793dd317c1d61957d95475eab0a9fdc2232f3a3052623e35
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    cronikxqqq.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10001960101\cronikxqqq.exe
                                                    • Size 445KB
                                                    • SHA256 fc8cbb7809af3ab0b5f7ed07919bbd6c66366d1ed51681a8b91783ad8dafbb3d
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    HmngBpR.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10111840101\HmngBpR.exe
                                                    • Size 9.9MB
                                                    • SHA256 9b49dad54f6489a7ee2e7cd6f52a90e6105e7be66b0f000c9a6fff6a24cd0ed7
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    ADFoyxP.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10112790101\ADFoyxP.exe
                                                    • Size 3.5MB
                                                    • SHA256 b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    9hUDDVk.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10114440101\9hUDDVk.exe
                                                    • Size 6.9MB
                                                    • SHA256 1be77012b7c721e4d4027f214bad43253c1f0116c6b2a4364685d8d69120e2aa
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    pwHxMTy.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10114630101\pwHxMTy.exe
                                                    • Size 373KB
                                                    • SHA256 4a3e426a814286b2b650ed9cfb20d6ef36a7f32a1a784d2ec33b1cfde6bf1c17
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    T0QdO0l.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10115790101\T0QdO0l.exe
                                                    • Size 1.3MB
                                                    • SHA256 ff07f07ed8d9ebf869603100b975c0e172d66e62973150e3e4b918e2faacf4b1
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    ogfNbjS.ps1
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10119590141\ogfNbjS.ps1
                                                    • Size 1B
                                                    • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    amnew.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10121660101\amnew.exe
                                                    • Size 429KB
                                                    • SHA256 87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    bncn6rv.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10122730101\bncn6rv.exe
                                                    • Size 1.8MB
                                                    • SHA256 cda1bd2378835d92b53fca1f433da176f25356474baddacdd3cf333189961a19
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    packed.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10123540101\packed.exe
                                                    • Size 6.0MB
                                                    • SHA256 b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    skf7iF4.cmd
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10124111121\skf7iF4.cmd
                                                    • Size 6.0MB
                                                    • SHA256 c0b082bae70e899007157ffc0267d41b7d80d6c42ee6f71a8c052cd9517cb845
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    yUI6F6C.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\10124820101\yUI6F6C.exe
                                                    • Size 2.0MB
                                                    • SHA256 936d17e301a6f5b6878b1a6f46a215d5af02d8254c65dc64a8679f7b2ff25213
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Seat.com
                                                    • Path C:\Users\Admin\AppData\Local\Temp\353090\Seat.com
                                                    • Size 1KB
                                                    • SHA256 a25f8422123bbb46e301f0c0d233d436317796c7893021f4bb95d46637cd069d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    99da9e2f
                                                    • Path C:\Users\Admin\AppData\Local\Temp\99da9e2f
                                                    • Size 3.6MB
                                                    • SHA256 78d41b42ae232c56c713ac73e4570ced6943ff340e2436bd73389288eb71eaa3
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Acquire
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Acquire
                                                    • Size 69KB
                                                    • SHA256 62d84da9a86179c1d097de81911364ef571096e39f1be781ded0d01bb5b03f2f
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Apartments.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Apartments.pub
                                                    • Size 89KB
                                                    • SHA256 36a1197973ca14a3b37631378354614601d8114fe55d662331ff36c635156dc2
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Blood.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Blood.pub
                                                    • Size 86KB
                                                    • SHA256 35954b0d4cd49c7db07a07b373130f7d2d67cf0f71806928438c17f79bf3aee6
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Both.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Both.pub
                                                    • Size 97KB
                                                    • SHA256 7cf5864584925dc11a0a34d287aa3347690219cd66f6f1e1b32886d4d8481c75
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Breaks.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Breaks.pub
                                                    • Size 95KB
                                                    • SHA256 a2c107ca22235dfa67bbe30009d5ee1df2e443f24f2fab23f6e5113636999b84
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Bull.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Bull.pub
                                                    • Size 85KB
                                                    • SHA256 f85697dcd7b84e241b1c7f76e629fe261d163bdba155db84a966bded4da3017b
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Commission
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Commission
                                                    • Size 90KB
                                                    • SHA256 0706b3ff8afceb1fa457be75b0686fe85b177566a2f927c80a5d5166c708cc23
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Comparison.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Comparison.pub
                                                    • Size 51KB
                                                    • SHA256 ff9fa6049de4b67aa3ffe200eae66f228ccf3f80c14b72941eaa7e60264b0536
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Confusion.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Confusion.pub
                                                    • Size 78KB
                                                    • SHA256 288b1f4c716dfb1b821171f03a5e6e4f35953bc2abe08c15d9393728e9a06257
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Copied
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Copied
                                                    • Size 129KB
                                                    • SHA256 1c4d967806773a9e1dc5649d5f1217e23624e77d8e8a449f588b60b3e3cf3c94
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    DuiLib_u.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\DuiLib_u.dll
                                                    • Size 860KB
                                                    • SHA256 5a3e6b212447ecee8e9a215c35f56aa3a3f45340f116ad9015c87d0c9c6e21af
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    MSVCP140.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\MSVCP140.dll
                                                    • Size 437KB
                                                    • SHA256 4cb882621a3d1c6283570447f842801b396db1b3dcd2e01c2f7002efd66a0a97
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    SplashWin.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\SplashWin.exe
                                                    • Size 446KB
                                                    • SHA256 c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    VCRUNTIME140.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\VCRUNTIME140.dll
                                                    • Size 74KB
                                                    • SHA256 e610cdac0a37147919032d0d723b967276c217ff06ea402f098696ab4112512a
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    addax.eml
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\addax.eml
                                                    • Size 1.5MB
                                                    • SHA256 fa9df7930fe6e974ec0ff44419d678229e53f0cf725b5f24d7751aef2445edc4
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    separator.wma
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Dockerprotectysd\separator.wma
                                                    • Size 62KB
                                                    • SHA256 ff1ce0b694b8d81c4321789a5332b422ef8a7e423edb5f51949527df3ad84f3e
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Document.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Document.pub
                                                    • Size 61KB
                                                    • SHA256 224930c54c57e8fe9aeee19de1ac0799ad05b9014e3034ee2cefa5272d68d0be
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Explicitly.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Explicitly.pub
                                                    • Size 56KB
                                                    • SHA256 dcd46e5e62353b800403fa27952d4d0fa91e097d12cfffebb134a8794ef560d1
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Gate.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Gate.pub
                                                    • Size 56KB
                                                    • SHA256 7bf9529b155b898532c530311215633371f6d24f0fde35a18d91cee7f498e5a6
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Good
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Good
                                                    • Size 1KB
                                                    • SHA256 6985c6bbb8edc764ff0bbfe76bbb67f95b7c3cb7ea16a22b79d9a7f57b2ca742
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Governor.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Governor.pub
                                                    • Size 84KB
                                                    • SHA256 6ce95bb839c41ddecbbcd95484471674573f54bcc431351202eb10f7430251c9
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Hit
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Hit
                                                    • Size 85KB
                                                    • SHA256 21baed50bc11d106116b0c853d6261d15848b31069a6f342d7f6ca54f2ecdd4f
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Lane
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Lane
                                                    • Size 71KB
                                                    • SHA256 bc6459d6f053f192d2c37332c8f6c94b1ec466c57b593b71abd7737ca684b206
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Legislation.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Legislation.pub
                                                    • Size 79KB
                                                    • SHA256 f550e56fa09560678c99a8c171552e7aed6bcbc26d4b7b95d50851b8ef4fa8fa
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Maintains.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Maintains.pub
                                                    • Size 98KB
                                                    • SHA256 82f2723cfdc19e16c28300632ab3fc560e38321afe406bbc4735a8dd37d7ef30
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Performing.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Performing.pub
                                                    • Size 62KB
                                                    • SHA256 dc3d84237bd8327d44d5a36a9f89087d965c0cbe3b4b337212dc7685ddd19121
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Pf
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Pf
                                                    • Size 74KB
                                                    • SHA256 e8d846ac73734ef0588d63ffa2f7199563ba164a436f519fbe81f621548b3b8b
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Really.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Really.pub
                                                    • Size 477KB
                                                    • SHA256 df005abf51ceba058a407035e214657c56a3efc11712b15714493cc8d3494a17
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Regulation.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Regulation.pub
                                                    • Size 52KB
                                                    • SHA256 df385629d5d793675cefcc372483ff65c916f201ec73f9b0ad380a403cdfb533
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Republican.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Republican.pub
                                                    • Size 53KB
                                                    • SHA256 cd07b5c75a06b9df7fd35735996504ffc358ba10e5481ed8da6de23925b81348
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Reverse.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Reverse.pub
                                                    • Size 97KB
                                                    • SHA256 f12e2b024b99fec45e7a053409a968411b205e77c41f6692edf94ec77c0885f1
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Robert.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Robert.pub
                                                    • Size 65KB
                                                    • SHA256 58cdfb9cd191c0485598c04a1c69354b08ab7e3a498379ac92f1d9643b7ac1bd
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Somewhere
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Somewhere
                                                    • Size 119KB
                                                    • SHA256 6ddb966ba6ae74e589d3abaf0dc49caa54a581e7d250d743d2cf4c9a5df84f2f
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Strong
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Strong
                                                    • Size 76KB
                                                    • SHA256 060afb577b607347da33bb11b50e42309517490b2b4ef8bcabdbfb2c37d7bc4c
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Swingers.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Swingers.pub
                                                    • Size 88KB
                                                    • SHA256 d414b67963b0763f5fdce9946e66a8b12c0f3836f0451bfbab5151c96eb1d529
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Thousand.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Thousand.pub
                                                    • Size 66KB
                                                    • SHA256 ce8982db5f8b2a34ca8270d6d5d74c46e8d799f4faec751c79e2355d1b2f2c22
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Urban.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Urban.pub
                                                    • Size 81KB
                                                    • SHA256 17c426d4a196bf632571971a28b66cbdc6055b5bbd4ced950a91bcdbbd0694f4
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Volumes
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Volumes
                                                    • Size 138KB
                                                    • SHA256 cf8ad19c5ad510d10504d573110968389e2d0896d201d14d8d2b3da3627bf354
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Wearing
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Wearing
                                                    • Size 72KB
                                                    • SHA256 f508cf5939abe1d0e4c63042a62389302de63359de1122ce3c408d2234f1c197
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    __PSScriptPolicyTest_tgwgqlyi.xey.ps1
                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tgwgqlyi.xey.ps1
                                                    • Size 60B
                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    a28befe5
                                                    • Path C:\Users\Admin\AppData\Local\Temp\a28befe5
                                                    • Size 1.8MB
                                                    • SHA256 d55befb5fff9b3d3b05fb548b9c6ec34458ea62ea69e048025f6b90844998125
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    rapes.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                    • Size 1.8MB
                                                    • SHA256 ea01f9a6f6683f4ea8248176a8b741e2be63c216c92cee15bc156e76a8760599
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    go.pub
                                                    • Path C:\Users\Admin\AppData\Local\Temp\go.pub
                                                    • Size 33KB
                                                    • SHA256 2ad688d4cc19277263c8e5637f58929142773873d53919bdd6f390063835f6fe
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    messages.json
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4260_1287993705\CRX_INSTALL\_locales\en_CA\messages.json
                                                    • Size 711B
                                                    • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    f4d15ba6-3e7a-472d-9f2b-159e08719941.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4260_1287993705\f4d15ba6-3e7a-472d-9f2b-159e08719941.tmp
                                                    • Size 150KB
                                                    • SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    memory/636-161-0x00007FFD36E10000-0x00007FFD37005000-memory.dmp
                                                    Download

                                                    memory/636-242-0x00000000736D0000-0x000000007384B000-memory.dmp
                                                    Download

                                                    memory/1152-18-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-21-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-96-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-19-0x0000000000611000-0x000000000063F000-memory.dmp
                                                    Download

                                                    memory/1152-240-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-241-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-27-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-20-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-259-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-26-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-22-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-302-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-23-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-24-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1152-25-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/1648-53-0x00007FFD16F10000-0x00007FFD17082000-memory.dmp
                                                    Download

                                                    memory/1648-51-0x00007FFD16F10000-0x00007FFD17082000-memory.dmp
                                                    Download

                                                    memory/1648-45-0x0000000000400000-0x0000000000E0C000-memory.dmp
                                                    Download

                                                    memory/1648-97-0x00007FFD16F10000-0x00007FFD17082000-memory.dmp
                                                    Download

                                                    memory/2160-2163-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/2160-2161-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/2204-105-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/2204-100-0x0000000000610000-0x0000000000AC1000-memory.dmp
                                                    Download

                                                    memory/2276-1644-0x0000000001380000-0x0000000001684000-memory.dmp
                                                    Download

                                                    memory/2432-1658-0x0000000004CD0000-0x0000000004CF2000-memory.dmp
                                                    Download

                                                    memory/2432-280-0x0000000005780000-0x0000000005D24000-memory.dmp
                                                    Download

                                                    memory/2432-1659-0x00000000053E0000-0x0000000005446000-memory.dmp
                                                    Download

                                                    memory/2432-1670-0x00000000056B0000-0x0000000005A04000-memory.dmp
                                                    Download

                                                    memory/2432-1671-0x0000000005B70000-0x0000000005B8E000-memory.dmp
                                                    Download

                                                    memory/2432-1660-0x0000000005540000-0x00000000055A6000-memory.dmp
                                                    Download

                                                    memory/2432-1672-0x0000000005BB0000-0x0000000005BFC000-memory.dmp
                                                    Download

                                                    memory/2432-279-0x00000000009B0000-0x0000000000A16000-memory.dmp
                                                    Download

                                                    memory/2432-1656-0x0000000002260000-0x0000000002296000-memory.dmp
                                                    Download

                                                    memory/2432-1657-0x0000000004D40000-0x0000000005368000-memory.dmp
                                                    Download

                                                    memory/2644-260-0x00007FFD36E10000-0x00007FFD37005000-memory.dmp
                                                    Download

                                                    memory/2644-263-0x00000000000C0000-0x0000000000379000-memory.dmp
                                                    Download

                                                    memory/3244-282-0x0000000000400000-0x0000000000466000-memory.dmp
                                                    Download

                                                    memory/3244-283-0x0000000000400000-0x0000000000466000-memory.dmp
                                                    Download

                                                    memory/4304-0-0x0000000000420000-0x00000000008D1000-memory.dmp
                                                    Download

                                                    memory/4304-4-0x0000000000420000-0x00000000008D1000-memory.dmp
                                                    Download

                                                    memory/4304-3-0x0000000000420000-0x00000000008D1000-memory.dmp
                                                    Download

                                                    memory/4304-2-0x0000000000421000-0x000000000044F000-memory.dmp
                                                    Download

                                                    memory/4304-17-0x0000000000420000-0x00000000008D1000-memory.dmp
                                                    Download

                                                    memory/4304-1-0x0000000077A24000-0x0000000077A26000-memory.dmp
                                                    Download

                                                    memory/4844-76-0x00007FFD36E10000-0x00007FFD37005000-memory.dmp
                                                    Download

                                                    memory/4844-75-0x00000000736D0000-0x000000007384B000-memory.dmp
                                                    Download

                                                    memory/4948-101-0x00000000736D0000-0x000000007384B000-memory.dmp
                                                    Download

                                                    memory/4948-95-0x00007FFD36E10000-0x00007FFD37005000-memory.dmp
                                                    Download

                                                    memory/4948-94-0x00000000736D0000-0x000000007384B000-memory.dmp
                                                    Download

                                                    memory/4964-312-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-316-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-1633-0x0000000005EF0000-0x0000000005F3C000-memory.dmp
                                                    Download

                                                    memory/4964-1632-0x0000000005D10000-0x0000000005D96000-memory.dmp
                                                    Download

                                                    memory/4964-1630-0x0000000005C40000-0x0000000005CCA000-memory.dmp
                                                    Download

                                                    memory/4964-318-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-301-0x0000000005B40000-0x0000000005BD2000-memory.dmp
                                                    Download

                                                    memory/4964-303-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-304-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-306-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-308-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-310-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-314-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-1635-0x0000000005F40000-0x0000000005F94000-memory.dmp
                                                    Download

                                                    memory/4964-320-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-300-0x0000000005800000-0x0000000005930000-memory.dmp
                                                    Download

                                                    memory/4964-322-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-324-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-326-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-328-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-330-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-299-0x0000000000F60000-0x00000000010BC000-memory.dmp
                                                    Download

                                                    memory/4964-332-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/4964-334-0x0000000005800000-0x000000000592A000-memory.dmp
                                                    Download

                                                    memory/5316-2397-0x00000000002D0000-0x00000000009CE000-memory.dmp
                                                    Download

                                                    memory/5316-2172-0x00000000002D0000-0x00000000009CE000-memory.dmp
                                                    Download

                                                    memory/5316-1713-0x00000000002D0000-0x00000000009CE000-memory.dmp
                                                    Download

                                                    memory/5884-2242-0x00000257F2AA0000-0x00000257F2AC2000-memory.dmp
                                                    Download

                                                    memory/6012-2412-0x00007FFD19770000-0x00007FFD1983F000-memory.dmp
                                                    Download

                                                    memory/6012-2428-0x00007FFD18F60000-0x00007FFD191A9000-memory.dmp
                                                    Download

                                                    memory/6012-2402-0x00007FFD2A740000-0x00007FFD2A759000-memory.dmp
                                                    Download

                                                    memory/6012-2403-0x00007FFD2A6B0000-0x00007FFD2A6DD000-memory.dmp
                                                    Download

                                                    memory/6012-2404-0x00007FFD2A670000-0x00007FFD2A6A6000-memory.dmp
                                                    Download

                                                    memory/6012-2405-0x00007FFD2D360000-0x00007FFD2D36D000-memory.dmp
                                                    Download

                                                    memory/6012-2406-0x00007FFD28DD0000-0x00007FFD28E03000-memory.dmp
                                                    Download

                                                    memory/6012-2408-0x00007FFD28180000-0x00007FFD2824D000-memory.dmp
                                                    Download

                                                    memory/6012-2407-0x00007FFD172F0000-0x00007FFD178D9000-memory.dmp
                                                    Download

                                                    memory/6012-2410-0x00007FFD2D4A0000-0x00007FFD2D4C3000-memory.dmp
                                                    Download

                                                    memory/6012-2409-0x000002359F500000-0x000002359FA20000-memory.dmp
                                                    Download

                                                    memory/6012-2411-0x00007FFD16DD0000-0x00007FFD172F0000-memory.dmp
                                                    Download

                                                    memory/6012-2414-0x00007FFD28350000-0x00007FFD283D7000-memory.dmp
                                                    Download

                                                    memory/6012-2415-0x00007FFD2A650000-0x00007FFD2A664000-memory.dmp
                                                    Download

                                                    memory/6012-2413-0x00007FFD2D370000-0x00007FFD2D389000-memory.dmp
                                                    Download

                                                    memory/6012-2400-0x00007FFD2D370000-0x00007FFD2D389000-memory.dmp
                                                    Download

                                                    memory/6012-2416-0x00007FFD2A420000-0x00007FFD2A42B000-memory.dmp
                                                    Download

                                                    memory/6012-2418-0x00007FFD2A670000-0x00007FFD2A6A6000-memory.dmp
                                                    Download

                                                    memory/6012-2417-0x00007FFD28B80000-0x00007FFD28BA6000-memory.dmp
                                                    Download

                                                    memory/6012-2419-0x00007FFD191B0000-0x00007FFD192CC000-memory.dmp
                                                    Download

                                                    memory/6012-2421-0x00007FFD28270000-0x00007FFD282B3000-memory.dmp
                                                    Download

                                                    memory/6012-2420-0x00007FFD2D360000-0x00007FFD2D36D000-memory.dmp
                                                    Download

                                                    memory/6012-2423-0x00007FFD28B60000-0x00007FFD28B72000-memory.dmp
                                                    Download

                                                    memory/6012-2422-0x00007FFD28DD0000-0x00007FFD28E03000-memory.dmp
                                                    Download

                                                    memory/6012-2424-0x00007FFD28180000-0x00007FFD2824D000-memory.dmp
                                                    Download

                                                    memory/6012-2430-0x00007FFD28FC0000-0x00007FFD28FEE000-memory.dmp
                                                    Download

                                                    memory/6012-2431-0x00007FFD28350000-0x00007FFD283D7000-memory.dmp
                                                    Download

                                                    memory/6012-2432-0x00007FFD196B0000-0x00007FFD1976C000-memory.dmp
                                                    Download

                                                    memory/6012-2429-0x00007FFD19770000-0x00007FFD1983F000-memory.dmp
                                                    Download

                                                    memory/6012-2401-0x00007FFD2D490000-0x00007FFD2D49D000-memory.dmp
                                                    Download

                                                    memory/6012-2427-0x00007FFD16DD0000-0x00007FFD172F0000-memory.dmp
                                                    Download

                                                    memory/6012-2426-0x00007FFD28FF0000-0x00007FFD29014000-memory.dmp
                                                    Download

                                                    memory/6012-2425-0x000002359F500000-0x000002359FA20000-memory.dmp
                                                    Download

                                                    memory/6012-2433-0x00007FFD2A650000-0x00007FFD2A664000-memory.dmp
                                                    Download

                                                    memory/6012-2434-0x00007FFD28660000-0x00007FFD2868B000-memory.dmp
                                                    Download

                                                    memory/6012-2491-0x00007FFD18F60000-0x00007FFD191A9000-memory.dmp
                                                    Download

                                                    memory/6012-2490-0x00007FFD28180000-0x00007FFD2824D000-memory.dmp
                                                    Download

                                                    memory/6012-2489-0x00007FFD28DD0000-0x00007FFD28E03000-memory.dmp
                                                    Download

                                                    memory/6012-2488-0x00007FFD2D360000-0x00007FFD2D36D000-memory.dmp
                                                    Download

                                                    memory/6012-2487-0x00007FFD2A670000-0x00007FFD2A6A6000-memory.dmp
                                                    Download

                                                    memory/6012-2486-0x00007FFD2A6B0000-0x00007FFD2A6DD000-memory.dmp
                                                    Download

                                                    memory/6012-2485-0x00007FFD2A740000-0x00007FFD2A759000-memory.dmp
                                                    Download

                                                    memory/6012-2484-0x00007FFD2D490000-0x00007FFD2D49D000-memory.dmp
                                                    Download

                                                    memory/6012-2483-0x00007FFD2D370000-0x00007FFD2D389000-memory.dmp
                                                    Download

                                                    memory/6012-2482-0x00007FFD31AA0000-0x00007FFD31AAF000-memory.dmp
                                                    Download

                                                    memory/6012-2481-0x00007FFD16DD0000-0x00007FFD172F0000-memory.dmp
                                                    Download

                                                    memory/6012-2480-0x00007FFD2D4A0000-0x00007FFD2D4C3000-memory.dmp
                                                    Download

                                                    memory/6012-2492-0x00007FFD172F0000-0x00007FFD178D9000-memory.dmp
                                                    Download

                                                    memory/6012-2497-0x00007FFD28B80000-0x00007FFD28BA6000-memory.dmp
                                                    Download

                                                    memory/6012-2498-0x00007FFD191B0000-0x00007FFD192CC000-memory.dmp
                                                    Download

                                                    memory/6012-2496-0x00007FFD2A420000-0x00007FFD2A42B000-memory.dmp
                                                    Download

                                                    memory/6012-2495-0x00007FFD2A650000-0x00007FFD2A664000-memory.dmp
                                                    Download

                                                    memory/6012-2494-0x00007FFD28350000-0x00007FFD283D7000-memory.dmp
                                                    Download

                                                    memory/6012-2493-0x00007FFD19770000-0x00007FFD1983F000-memory.dmp
                                                    Download

                                                    memory/6012-2399-0x00007FFD31AA0000-0x00007FFD31AAF000-memory.dmp
                                                    Download

                                                    memory/6012-2398-0x00007FFD2D4A0000-0x00007FFD2D4C3000-memory.dmp
                                                    Download

                                                    memory/6012-2395-0x00007FFD172F0000-0x00007FFD178D9000-memory.dmp
                                                    Download